Symantec Corporation

Nortonlifelock Inc.

University of Arizona

Veritas Technologies LLC

Other

Hart Scientific Consulting International LLC

Michael Andrew Hart

Kevin Alejandro Roundy

Chris Gates

Christopher Gates

Matteo Dell'Amico

Anantharaman Ganesh

Yufei Han

Zachary Watson

Michael Spertus

Daniel Kats

Stanislav Miskovic

Peter Ashley

Darrell Kienzle

Darren Shou

Chetan Verma

Shang-Tse Chen

Sourabh Satish

William E Sobel

Stanley K Pau

David Luz Silva

Jeffrey Wilhelm

Acar Tamersoy

Saurabh Shintre

Sharada Sundaram

Brian T Witten

Phillip DiCorpo

Aleatha Parker-Wood

Yin Liu

Yuqiong Sun

Nitin Suresh Supekar

Nikolaos Vasiloglou

Brian Schlatter

Joseph Lopilato

Yining Wang

Steven Meckl

Jung Hui Yoon

Kushal Tayal

Lennon Reinhart

Charlotte Guthery

Methods, devices and systems are described that enable improved determination of wavefront errors associated with light traveling through turbulent media, such as through the atmosphere. The described systems use a Rayleigh-Raman polychromatic laser guide star (RRPLGS) to measure the tilt at the wavelength of observation by making use of the dispersion of the refractive index of air and differential tilt measurements at multiple combinations of wavelengths based on the Rayleigh and Raman back-scattered light. The described RRPLGS systems have a number of advantages, including scalability of returned flux and flexibility in selection of short wavelengths, allowing for a combination of multiple tilt measurements, and enabling characterization of the turbulent media without relying on photons from the object of interest.

Rayleigh-Raman polychromatic laser guide star

Methods, systems and devices are disclosed to detect and compensate wavefront errors associated with light that spans a large range of wavelengths and different polarization states. One example system includes an optical wavefront sensor that is positioned to receive input light after propagation through a turbulent medium, such as air or water or other liquids, and to detect a wavefront error associated with at least one spectral component of the received light that has a plurality of spectral components. The system further includes a wavefront compensator that is positioned to receive the input light and to simultaneously effectuate wavefront corrections for the plurality of spectral components of the input light based on the detected wavefront error.

Achromatic and polarization adaptive optics system

Methods, devices and systems are disclosed that enable accurate and reliable measurements of wavefront aberrations with a wide dynamic range. The described wavefront sensors can be implemented at a low cost and without any moving parts. One wavefront sensor includes an optical pyramid positioned to receive a focused incoming light beam. The optical pyramid includes three facets that each allow a portion of the focused incoming light beam to exit the optical pyramid. The wavefront sensor also includes one or more imaging lenses positioned to receive light that exits each of the facets of the optical pyramid, and one or more lenslet arrays positioned to receive light from the one or more imaging lenses and to produce a plurality of focused light spots corresponding to each lenslet of the lenslet array.

Wavefront sensor device and method

A method for learning queries in automated incident remediation is performed by one or more computing devices, each comprising one or more processors. The method includes parsing at least a portion of incidents from an incident log based at least in part on one or more incident types associated with each incident from the portion of the incidents, identifying parameters associated with a plurality of queries, grouping the plurality of queries into a plurality of query groups based at least in part on the identified parameters, identifying a new incident added to the incident log, and generating an automated query based at least in part on a similarity between the new incident and a prior incident.

Query learning for automated incident investigation and remediation

A method of remotely sensing an object includes: collecting photons from the object; directing the photons down pathways, wherein photons in each of the pathways have a different polarization state; detecting photons in each of the pathways using at least one optical detector, wherein the photons in each of the polarization states produce a signal; receiving, with at least one processor in communication with the at least one optical detector, signals corresponding to the photons in the pathways; determining, with the at least one processor and for a segment of the signals, at least one of: an angle of linear polarization, a degree of polarization, and a degree of circular polarization; and generating a signal corresponding to a sequential output of the angle of linear polarization, degree of polarization, or the degree of circular polarization for each segment.

Systems and methods for determining polarization properties with high temporal bandwidth

A computer system stores incident records in a database. When a user wants to resolve a particular current incident, the computer system will access the current incident record from an incident queue. The computer system also identifies historical incident records that share one or more attributes with the current incident record. The computer system creates a plurality of clusters from the current incident record and the selected historical incident records. The clusters are then arranged into a hierarchical tree. This hierarchical tree is presented in a graphical user interface. A user can select a node to access additional information for that node. The computer system generates a first suggested response to a particular current incident based on the incident records included in the selected node. The computer system presents the first suggested response to the particular current incident in a graphical user interface.

Efficient incident response through tree-based visualizations of hierarchical clustering

Log text is encoded into a low dimensional feature vector. A temporal predictive model is constructed based on the low dimensional feature vector. The temporal predictive model is used to calculate probabilities of the occurrence of security incidents based on signature names from the log text encoded in the low dimensional feature vector. A preventative security action is automatically taken in response to the calculated probability of the occurrence of a specific security incident exceeding a given threshold.

Identifying evidence of attacks by analyzing log text

The disclosed computer-implemented method for categorizing security incidents may include (i) generating, within a training dataset, a feature vector for each of a group of security incidents, the feature vector including features that describe the security incidents and the features including categories that were previously assigned to the security incidents as labels to describe the security incidents, (ii) training a supervised machine learning function on the training dataset such that the supervised machine learning function learns how to predict an assignment of future categories to future security incidents, (iii) assigning a category to a new security incident by applying the supervised machine learning function to a new feature vector that describes the new security incident, and (iv) notifying a client of the new security incident and the category assigned to the new security incident. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for categorizing security incidents

A photo-acoustic polarimetric remote sensing apparatus includes a telescope that directs visible light photons from an object. A polarizing beam splitter is in optical alignment with the telescope. The polarizing beam splitter has first and second pathways corresponding to first and second polarization states, respectively. The first and second pathways are substantially perpendicular. A first photodetector is in optical alignment with the first pathway, and a second photodetector is in optical alignment with the second pathway. At least one processor is in communication with the first and second photodetectors. The at least one processor generates a signal corresponding to a degree of linear polarization of the photons over time, and the signal is indicative of an acoustic signature of the object.

Systems and methods for optically determining an acoustic signature of an object

A computer-implemented method for managing computer security of client computing machines may include (i) monitoring a set of client computing devices, (ii) receiving security data on sets of security-related events from each client computing device in the set of client computing devices, (iii) clustering the sets of security-related events by calculating a dissimilarity value, for each set of security-related events, that indicates a uniqueness of the set of security-related events in relation to other sets of security-related events using a dissimilarity function and adjusting the dissimilarity function based on a homogeneity of clusters of sets of security-related events, (iv) determining, based on clustering the sets of security-related events by the dissimilarity value, that a set of security-related events comprises an anomaly, and (v) performing a security action in response to determining that the set of security-related events comprises the anomaly. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing computer security of client computing machines

A disclosed computer-implemented method for tokenizing user-annotated names may include (1) identifying an example set of user-annotated names, (2) creating a custom dictionary that includes known keywords by (a) extracting a set of known keywords from the example set of user-annotated names and (b) assigning a frequency score to each known keyword in the set of known keywords based on the respective frequency of each known keyword within the example set, and (3) enabling the computing device to tokenize an additional user-annotated name of arbitrary structure by performing a semantic analysis including (a) assigning, using the custom dictionary, a frequency score to a substring of the additional user-annotated name based on the substring matching the known keyword and (b) splitting the additional user-annotated name into tokens according to a permutation of substrings that received a top combined frequency score. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for tokenizing user-annotated names

The disclosed computer-implemented method for personalizing security incident reports may include (i) generating, within a training dataset, a feature vector for each of a group of security incidents, the feature vector including features that describe the security incidents and the features including response codes that a set of clients previously assigned to the security incidents as labels, (ii) training a supervised machine learning function on the training dataset using the response codes that the set of clients previously assigned to the security incidents, (iii) applying the supervised machine learning function to a feature vector that describes a new security incident on the set of clients to predict that the set of clients will ignore the new security incident, and (iv) personalizing a list of security incidents that is electronically reported to the set of clients by deprioritizing the new security incident. Other methods, systems, and computer-readable media are also disclosed.

Systems and methods for personalizing security incident reports

Encrypting and decrypting sensitive files on a network device. In one embodiment, a method may include determining that a file stored on a network device is a sensitive file, encrypting the sensitive file, sending, to an authentication server, an encryption key, initializing, at the network device, a Software Guard Extension (SGX) enclave, loading, into the SGX enclave, a retrieval application, receiving, at the retrieval application, an attestation from the authentication server that the retrieval application is authentic, receiving, at the retrieval application, the encryption key from the authentication server, receiving, at the retrieval application, a user request to decrypt the encrypted sensitive file, authenticating, at the retrieval application, the user request, decrypting, at the network device, the particular encrypted sensitive file, and providing the sensitive file to the user.

Encrypting and decrypting sensitive files on a network device

The disclosed computer-implemented method for detecting security incidents may include (i) collecting, by a security server, security information describing security events detected on at least one client device, (ii) generating, based on the collected security information, a mathematical graph that includes a set of nodes designating machine-windows of data and a set of nodes designating detected security events, (iii) executing a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats, and (iv) performing a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting security incidents

The disclosed computer-implemented method for remediating computer stability issues may include (i) determining that a device has experienced a computer stability problem, (ii) obtaining, from the device, one or more computer-generated log lines that potentially include information pertaining to a cause of the computer stability problem, (iii) directly analyzing text included within the computer-generated log lines, (iv) identifying information relating to the computer stability problem based on the direct analysis of the text, and (v) remediating the device to resolve the computer stability problem. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for remediating computer stability issues

Growing community of inventors

Mountain View, CA, United States of America

Michael Andrew Hart