Emc IP Holding Company LLC

Emc Corporation

Affymetrix, Inc.

Richard Chiles

Andreas Wittenstein

Earl A Hubbell

Marcelo Blatt

Rui Mei

Simon Cawley

Hajime Matsuzaki

Teresa A Webster

Kineret Raviv

Uri Fleyder

Mike Eynon

Xiaojun Di

Eugene Gulko

Ofri Mann

Geoffrey Yang

Rakesh Nair

Brian Campbell

Guoying Liu

Disclosed are techniques for use in assessing the risk of electronic communications using logon types. In one embodiment, the techniques comprise a method. The method comprises receiving an electronic communication relating to a login request involving a user and a provider of a computerized resource. The method comprises determining a logon type associated with the logon request. The method comprises determining a first value relating to an amount of logon requests associated with the logon type involving the user and the provider over a first time period and a second value relating to an amount of logon requests associated with the logon type involving the user and the provider over a second time period that is greater than the first time period. The method comprises generating a risk score describing the risk associated with the logon request based on the first and the second values.

Method, apparatus and computer program product for assessing the risk of electronic communications using logon types

Improved techniques involve testing periodicity at a given period based on locations of clicks within a sampling window whose duration is a multiple of the given period. Along these lines, when a testing server receives a click stream from a client machine, the testing server assigns a timestamp to each of the clicks in the click stream. The testing server generates a list of candidate periods at which periodicity of the click stream is to be tested. For each of the candidate periods, the testing server forms a sampling window whose duration is a multiple of that candidate period and tests whether the click stream is periodic based on the locations of the clicks within the sampling window. If indeed the testing server finds that the click stream is periodic at any of the candidate periods, the testing server may send an alert to a security entity to indicate that suspect activity has been identified.

Periodicity detection

A processing device comprises a processor coupled to a memory and is configured to obtain data characterizing login events for multiple user identifiers. The data associated with a given one of the user identifiers is processed to generate a login profile for a corresponding user, and likelihood statistics are generated for respective ones of multiple time bins based on the login profile. Data characterizing one or more additional login events for the given user identifier is obtained, and a confidence measure is generated for a given one of the additional login events based on one or more of the likelihood statistics and a time bin associated with the given additional login event. The confidence measure is compared to a threshold and an alert relating to the given additional login event is generated and transmitted to a security agent. The processing device may be implemented in a network security system.

Automated detection of time-based access anomalies in a computer network through processing of login data

Methods and devices for correlative monitoring, analysis, and control of multi-service, multi-network systems are provided herein. Exemplary methods may include generating a network topology graph of a metanetwork using traffic records obtained from the metanetwork, generating a causal digraph of the metanetwork using the traffic records and the network topology graph, and transmitting one or more of the network topology graph and the causal digraph to a computing system.

Correlative monitoring, analysis, and control of multi-service, multi-network systems

Sequences of discrete events, such as clicks on a website, are evaluated for periodic behavior, a period is calculated, and the sequence is scored to determine the confidence that the sequence really exhibits periodicity. The random variations on the timing of the discrete events due to transmission delays or other factors may be reduced or eliminated from the evaluation. An apparatus for performing the method of evaluation may include a computer programmed to carry out the method.

Detecting periodicity in a stream of events

Improved techniques involve flagging anomalous behavior in a current session when there is sufficient difference between an observed distribution of Markov events in the current session and an observed distribution of Markov events in a global session. Here, 'Markov events' refer to events such as web page transitions and web page addresses. During a user session, a testing server generates a frequency distribution of a set of Markov events of the user session. The testing server also obtains a frequency distribution of previously observed Markov events of a global session, i.e., sets of sessions of previous user sessions or training sessions. The testing server then computes an anomaly statistic depending on the Markov events that indicates a difference between the user session and the global session. The testing server may produce an alert if the anomaly statistic differs significantly from some nominal value.

Markov behavior scoring

Methods, kits and arrays of nucleic acid probes for genotyping large numbers of human SNPs in parallel are provided. A set of more than 100,000 human SNPs, known to be biallelic in at least two populations is provided. Allele specific perfect match probes and genotyping probe sets are provided for each allele of each biallelic SNP in a set of human SNPs that is useful for genetic analysis within and across populations. Probe sets that include perfect match and mismatch probes are provided. The probe sets are suitable for inclusion in an array. The invention provides the SNP and surrounding sequence and provides the sequences in such a way as to make them available for a variety of analyses including genotyping. As such, the invention relates to diverse fields impacted by the nature of genetics, including biology, medicine, and medical diagnostics.

Methods for genotyping polymorphisms in humans

Growing community of inventors

Castro Valley, CA, United States of America

Richard Chiles