Emc IP Holding Company LLC

Ohad Arnon

Shiri Gaber

Dany Shapiro

Amihai Savir

Omer Sagi

Ronen Rabani

Techniques described herein relate to a method for predicting results using ensemble models. The method may include receiving trained model data sets from a model source nodes, each trained model data set comprising a trained model, an important feature list, and a missing feature generator; receiving a prediction request data set; making a determination that the prediction request data set does not include an input feature for a trained model; generating, based on the determination and using a missing feature generator, a substitute feature to replace the input feature; executing the trained model using the prediction request data set and the substitute feature to obtain a first prediction; executing a second trained model using the prediction request data set to obtain a second prediction; and obtaining a final prediction using the first prediction, the second prediction, and an ensemble model.

Privacy preserving ensemble learning as a service

One example method includes data protection operations including cyber security operations, threat detection operations, and other security operations. Normal device behavior is learned based on data collected by an anomaly detection engine operating in a kernel. The normal data is used to train a machine learning model. Threats are detected when the machine learning model indicates that new data points deviate from normal device behavior. Associated processes are stopped. This allows threats to be detected based on normal behavior rather than on unknown threat behavior.

Cyber immunity system as a biological self-recognition model on operating systems

One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

Ai/ml approach for DDOS prevention on 5G CBRS networks

Techniques are provided for multi-party prediction using feature contribution values. One method comprises obtaining a first set of feature contribution values associated with respective ones of a plurality of machine learning models, wherein each machine learning model is trained using training data of a different party and each feature contribution value indicates a contribution by a corresponding feature to a prediction generated by the associated machine learning model; training an aggregate machine learning model using the obtained first sets of feature contribution values; receiving a second set of feature contribution values generated by applying data of at least one party to at least one machine learning model; and applying the second set of feature contribution values to the trained aggregate machine learning model to obtain a global prediction. Each feature contribution value may correspond to a masked feature, and the feature contribution values may not expose the source data of one party to another party.

Multi-party prediction using feature contribution values

Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp. A presence verification is optionally provided based on a deviation from the machine learning baseline behavioral model at the monitored location.

Machine learning-based anomaly detection for human presence verification

Techniques are provided for system operational analytics using additional features over time-series counters for health score computation. An exemplary method comprises: obtaining log data from data sources of a monitored system; applying a counting function to the log data to obtain time-series counters for a plurality of distinct features within the log data; applying an additional function to the time-series counters for the plurality of distinct features; and processing an output of the additional function using a machine learning model to obtain a health score for the monitored system based on the output of the additional function. The additional function comprises, for example, an entropy function representing a load balancing of a plurality of devices in the monitored system; one or more clustered counts for a plurality of entities in the monitored system; a number of unique values; and/or one or more modeled operations based on correlations between a plurality of different operations in the monitored system.

System operational analytics using additional features for health score computation

Techniques are provided for system operational analytics using normalized likelihood scores. In one embodiment, an exemplary method comprises: obtaining data from data sources associated with a monitored system; applying at least one function to the log data to obtain a plurality of time-series counters for a plurality of distinct features within the data; processing the plurality of time-series counters using at least one machine learning model to obtain a plurality of log likelihood values representing a behavior of the monitored system over time; determining a z-score for each of the plurality of log likelihood values over a predefined short-term time window; monitoring a distribution of the z-scores for the plurality of log likelihood values over a predefined long-term time window to map the z-scores to percentile values; and mapping the percentile values to a health score for the monitored system based on predefined percentile ranges and/or a transformation function.

Growing community of inventors

Beit Nir, Israel

Ohad Arnon