Micro Focus Lcc

Hewlett Packard Enterprise Development LP

Mijung Kim

Manish Marwah

Pratyusa Kumar Manadhata

Jun Li

Martin Arlitt

Krishnamurthy Viswanathan

Alexander Ulanov

Haris Volos

Pradeep Fernando

Network communication events are filtered to remove the network communication events having a predicted unrelatedness to beaconing. Each network communication event has a timestamp, a source entity, and a destination entity. The filtered network communication events are aggregated by unique source entity-destination entity pairs. For each unique source entity-destination entity pair, the network communication events are timestamp-sorted, time differentials between the timestamps of adjacent network communication events are calculated, and a beacon likelihood metric is calculated from the calculated time differentials. Which of the unique source entity-destination entity pairs are indicative of beaconing are identified based on the beacon likelihood metric calculated for each unique source entity-destination entity pair.

Identification of beaconing from network communication events of network traffic log

In some examples, a system balances a number of positive data points and a number of negative data points, to produce a balanced training data set, where the positive data points comprise features associated with authentication events that are positive with respect to an unauthorized classification, and the negative data points comprise features associated with authentication events that are negative with respect to the unauthorized classification. The system trains a plurality of models using the balanced training data set, wherein the plurality of models are trained according to respective different machine learning techniques. The system selects a model from the trained plurality of models based on relative performance of the plurality of models.

Training models based on balanced training data sets

In some examples, a system constructs, based on event data representing a plurality of events in a system, a representation of the plurality of events, the representation including information relating the events, and computes issue indications corresponding to potential issues in the system. The system adds information based on the issue indications to the representation to form an enriched representation, and searches the enriched representation to find a chain of events representing an issue in the system.

Chain of events representing an issue based on an enriched representation

In some examples, a system identifies, for a given authentication event between a plurality of devices in a network, a context comprising a set of authentication events that are temporally related to the given authentication event. The set of authentication events occur at the devices. A classifier is applied on a collection of features associated with the set of authentication events, the collection of features comprising a number of machines or a number of users associated with the set of authentication events. The system determines, based on an output of the classifier, whether the given authentication event is an unauthorized authentication event.

Unauthorized authentication event detection

In some examples, for a given authentication event between a plurality of devices in a network, a system identifies a set of events, at the devices, that are temporally related to the given authentication event. The system applies a classifier on a collection of features associated with the set of events, and determines, based on an output of the classifier, whether the given authentication event is an unauthorized authentication event.

Unauthorized authentication events

Examples herein involve processing data in a distributed data processing system using an off-heap memory store. An example involves allocating a shared memory region of a shared memory to store attributes corresponding to a first partition of a distributed data system, and updating, in the shared memory region, the attributes corresponding to updates to the local data from process iterations of the first partition, such that a second partition of the distributed data system has access to the updated attributes.

Shared memory for distributed data

In some examples, for a given authentication event between a plurality of devices in a network, a system identifies a set of events, at the devices, that are temporally related to the given authentication event. The system extracts features from the set of events by aggregating event data of the set of events. The system provides the extracted features to a classifier that detects unauthorized authentication events.

Extracting features for authentication events

In some examples, a system extracts features from event data representing events in a computing environment, trains ensembles of machine-learning models for respective analytics modules of a plurality of different types of analytics modules, and detects, by the different types of analytics modules using the respective trained ensembles of machine-learning models, an anomalous entity in response to further event data.

Detecting anomalous entities

Storing time series data for a search query includes identifying a time series whose representation is to be pre-computed based on available memory storage, pre-computing at least one representation of the identified time series, and storing the at least one representation in the memory storage.

Storing time series data for a search query

An example technique includes assigning partitions of a dataset of multidimensional points to a plurality of local memory nodes of a multicore machine and using the local memory nodes for a search query to determine similarity matches in the dataset for a given multidimensional point. The using includes parallel searching with the local memory nodes in the assigned partitions to identify candidate similarity matches to the given multidimensional point using indexes derived from the multidimensional points, the parallel searching for each node progressing through a sequence of search distances and providing an ongoing search result for each search distance from the given multidimensional point and regulating an extent of the parallel searching based on the ongoing search results.

Using local memory nodes of a multicore machine to process a search query

Examples herein involve fault tolerance in a shared memory. In examples herein, a metadata store of a shared memory indicating versions of data partitions of a resilient distributed dataset and a valid flag for the partitions of the resilient distributed dataset are used to achieve fault tolerance and/or recover from faults in the share memory.

Growing community of inventors

Sunnyvale, CA, United States of America

Mijung Kim