Nec Corporation

Other

Xiao Yu

Haifeng Chen

Junghwan Rhee

Ding Li

Zhengzhang Chen

Hui Joyce Zhang

Guofei Jiang

Wei Cheng

Zhichun Li

LuAn Tang

Cristian Lumezanu

Jianwu Xu

Masanao Natsumeda

Yuncong Chen

Kangkook Jee

Takehiko Mizoguchi

Yanchi Liu

Chung Hwan Kim

Pallavi Joshi

Kyungtae Kim

Qi Wang

Fei Zuo

Yufei Li

Xueyuan Han

Systems and methods are provided for adapting a pretrained language model to perform cybersecurity-specific named entity recognition and relation extraction. The method includes introducing a pretrained language model and a corpus of security text to a model adaptor, and generating a fine-tuned language model through unsupervised training utilizing the security text corpus. The method further includes combining a joint extraction model from a head for joint extraction with the fine-tuned language model to form an adapted joint extraction model that can perform entity and relation label prediction. The method further includes applying distant labels to security text in the corpus of security text to produce security text with distant labels, and performing Distant Supervision Training for joint extraction on the adapted joint extraction model using the security text to transform the adapted joint extraction model into a Security Language Model for name-entity recognition (NER) and relation extraction (RE).

Transformer assisted joint entity and relation extraction

A method for system metric prediction and influential events identification by concurrently employing metric logs and event logs is presented. The method includes concurrently modeling multivariate metric series and individual events in event series by a multi-stream recurrent neural network (RNN) to improve prediction of future metrics, where the multi-stream RNN includes a series of RNNs, one RNN for each metric and one RNN for each event sequence and modeling causality relations between the multivariate metric series and the individual events in the event series by employing an attention mechanism to identify target events most responsible for fluctuations of one or more target metrics.

Causal attention-based multi-stream RNN for computer system metric prediction and influential events identification based on metric and event logs

A computer-implemented method is provided for computer intrusion detection. The method includes establishing a mapping from low-level system calls to user functions in computer programs. The user functions run in a user space of an operating system. The method further includes identifying, using a search algorithm inputting the mapping and a system-call trace captured at runtime, any of the user functions that trigger the low-level system calls in the system-call trace. The method further includes performing, by a processor device, intrusion detection responsive to a provenance graph with program contexts. The provenance graph has nodes formed from the user functions that trigger the low-level system calls in the system-call trace. Edges in the provenance graph have edge labels describing high-level system operations for low-level system call to high-level system operation correlation-based intrusion detection.

Mining and integrating program-level context information into low-level system provenance graphs

A computer-implemented method for efficient and scalable enclave protection for machine learning (ML) programs includes tailoring at least one ML program to generate at least one tailored ML program for execution within at least one enclave, and executing the at least one tailored ML program within the at least one enclave.

Efficient and scalable enclave protection for machine learning programs

Systems and methods for a provenance based threat detection tool that builds a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks; samples the provenance graph to form a plurality of linear sample paths, and calculates a regularity score for each of the plurality of linear sample paths using a processor device; selects a subset of linear sample paths from the plurality of linear sample paths based on the regularity score, and embeds each of the subset of linear sample paths by converting each of the subset of linear sample paths into a numerical vector using a processor device; detects anomalies in the embedded paths to identify malicious process activities, and terminates a process related to the embedded path having the identified malicious process activities.

Provenance-based threat detection tools and stealthy malware detection

A computer-implemented method for securing software installation through deep graph learning includes extracting a new software installation graph (SIG) corresponding to a new software installation based on installation data associated with the new software installation, using at least two node embedding models to generate a first vector representation by embedding the nodes of the new SIG and inferring any embeddings for out-of-vocabulary (OOV) words corresponding to unseen pathnames, utilizing a deep graph autoencoder to reconstruct nodes of the new SIG from latent vector representations encoded by the graph LSTM, wherein reconstruction losses resulting from a difference of a second vector representation generated by the deep graph autoencoder and the first vector representation represent anomaly scores for each node, and performing anomaly detection by comparing an overall anomaly score of the anomaly scores to a threshold of normal software installation.

Securing software installation through deep graph learning

Methods and systems for security monitoring and response include assigning an anomaly score to each of a plurality of event paths that are stored in a first memory. Events that are cold, events that are older than a threshold, and events that are not part of a top-k anomalous path are identified. The identified events are evicted from the first memory to a second memory. A threat associated with events in the first memory is identified. A security action is performed responsive to the identified threat.

Real-time threat alert forensic analysis

Systems and methods are disclosed for detecting error in a cloud infrastructure by running a plurality of training tasks on the cloud infrastructure and generating training execution logs; generating a model miner with the training execution logs to represent one or more correct task executions in the cloud infrastructure; after training, running a plurality of tasks on the cloud infrastructure and capturing live execution logs; and from the live execution logs, if a current task deviates from the correct task execution, indicating an execution error for correction in real-time.

CloudSeer: using logs to detect errors in the cloud infrastructure

A liquid crystal display (LCD) system is provided. The LCD system includes a light source and a self-contained display unit including at least a LCD panel and a light guide plate coupled together, wherein the light guide plate is configured to guide light from the light source to the LCD panel as backlight and to structurally support the LCD panel. Further, a plurality of pre-made hollow spaces are contained in the display unit configured to host components of the LCD system. The LCD system also includes a controller contained in the plurality of pre-made hollow spaces and coupled to the LCD panel to control the LCD panel such that the light passing through the light guide plate is used as backlight for operation of the LCD panel.

Liquid crystal display (LCD) system and method

A system is provided for detecting a blind spot for a driver of a vehicle. The system includes a side mirror. The side mirror is arranged on a body of the vehicle and includes a side mirror body, a mirror, and a supporting structure. The system also includes a detection system. The detection system is physically coupled with the side mirror to detect an object in a detection zone of the detection system. The detection zone covers the blind spot, and the detection system includes a detection module, an alert indicator, and a control module. The detection module includes at least one of a transmitter and a receiver, and the alert indicator is configured to send an alert light to the driver at a predetermined angle such that the alert light does not interfere with drivers of other vehicles close to the vehicle.

Automobile blind spot detection system and method

A liquid crystal display (LCD) system is provided. The LCD system includes a light-passable plate, an LCD panel and a controller. The light-passable plate is configured to allow natural light to pass through the light-passable plate; and the LCD panel is coupled to the light-passable plate and is configured to receive the natural light passing through the light-passable plate. Further, the controller is coupled to the LCD panel to control the LCD panel such that the natural light passing through the light-passable plate is used as backlight for operation of the LCD panel. The light-passable plate structurally supports the LCD panel in addition to providing the natural light to the LCD panel.

Growing community of inventors

Princeton, NJ, United States of America

Xiao Yu