British Telecommunications Public Limited Company

British Telecommunications Corporation

Zhan Cui

Michael Schroeder

Brian Robert Odgers

Ian Herwono

Gery M Ducatel

Behnam Azvine

Nader Azarmi

Xiao-Si Wang

Martin Wanyonyi Koyabe

Beum Seuk Lee

Ben Azvine

Yang Li

Karl Smith

Brian R Odgers

Martin Brown

Qiao Tang

Simon J Case

Hongji Yang

Géry Michel Ducatel

A computer implemented method of protecting a target subnet, including a set of network connected devices in a hierarchy of subnets of a computer network, from malware attack. The method includes generating a dynamical system for each subnet in the network, each dynamical system modelling a rate of change of a number of network connected devices in the subnet that are: susceptible to infection by the malware; infected by the malware; protected against infection by the malware; and remediated of infection by the malware. The dynamical systems are based on rates of transmission of the malware between pairs of subnets; evaluating a measure of risk of infection of the target subnet at a predetermined point in time based on the dynamical system for the target subnet; and responsive to the measure of risk meeting a predetermined threshold, deploying malware protection measures to devices in the target subnet.

Malware infection prediction

A computer implemented method of protecting a portion of a computer network from malware attack, the computer network including a network connected devices organized into hierarchical subnets modelled by a tree data structure in which each subnet is represented as a node in the tree, each node having a connection to parent node save for a root node, the method including performing protective actions on devices in subnets associated with a first subset of nodes to provide protection against the malware, prioritizing devices in the subnets associated with a second subset of nodes so as to provide a barrier of subnets protected against the malware to impede the propagation of the malware to devices in subnets associated with each of the first subset of nodes.

Malware barrier

A multi-stage event detector for monitoring a system to detect the occurrence of multistage events in the monitored system, the multi-stage event detector includes: one or more event detecting detector units () for detecting observable events occurring on the monitored system; one or more parameter generating detector units () for generating parameter values which vary over time dependent on the behavior of the monitored system; a hidden state determiner () for determining a likely sequence of states of interest of the system based on the outputs of the one or more event detecting detector units; and a transition determiner () for determining a likely transition occurrence based on a comparison of a set of values of a parameter or set of parameters generated by one or more of the one or more parameter generating detector units with a plurality of pre-specified functions or sets of values of a corresponding parameter or set of parameters associated with different transition occurrences.

Method and apparatus for detecting a multi-stage event

A multi-stage event detector for monitoring a system, the multi-stage event detector including: a process generator operable to generate main and sub-processes, each main and sub-process being operable to generate and initiate a detection agent each of which is operable to be triggered by detecting the occurrence of a trigger event and to report back to its generating process or sub-process upon being so triggered. Each process or sub-process is operable to respond to receipt of a report from a triggered detection agent by reporting the detection of a multi-stage event to an overall controller.

A method of detecting loss of data connection in a plurality of links between an exchange and one or more of a plurality of network terminals arising during presence of a user at an intervention point node on the links between the exchange and the network terminals, comprising: receiving connection information about a loss of data connection on any one of the links; receiving duration information about a duration of the user presence at the intervention point node; determining if the loss of data connection occurred within the user presence duration; causing line tests to be conducted on each of the links for which loss of data connection is determined to have occurred within the user presence duration; receiving results of the line tests including a number of links being determined, by the line test, to exhibit a fault; and determining if the number of links determined to exhibit a fault exceeds a predetermined threshold number.

Detection of data connection loss

A system () for generating a computer readable data file representative of a mapping between a first representation of a set of concepts or of a data structure (e.g. a database schema) and a second representation of a set of concepts or of a data structure (e.g. an ontology), each representation comprising a plurality of complex representational elements (e.g. tables in a database schema and concepts in an ontology) each of which may itself include a number of associated subordinate representational elements (e.g. columns/fields of a table in a database schema and attributes of a concept in an ontology). The system () includes a semantic similarity calculation module () for calculating a semantic similarity measure between a subordinate element of the first representation and each of the subordinate elements in the second representation and a mapping generation module () for generating a mapping between the subordinate element of the first representation and one of the subordinate elements of the second representation selected in dependence upon the calculated semantic similarity measures between the subordinate elements.

Method and apparatus for processing electronic data

A system for monitoring connection status of a cable in a network comprising a detector operationally connected to the cable, a metal line test module, and a processor for receiving from the detector one or more connection status reports about connection of the cable to a network node, and configured to cause, upon a connection status report threshold being reached, a test of the cable by the metal line test module to confirm the connection status of the cable. Related apparatus and methods are also disclosed.

Cable damage detection

An electronic document retrieval system is disclosed. It has particular utility to World-Wide Web searching. The system requires webmasters to put forward categories into which the pages on their web-site might sensibly be divided, and to provide a list of those categories together with a list of popular keywords associated with those categories to a global search engine. The global search engine is then able to augment one or more of its search results with links to category-heading pages which most closely relate to the query provided by the user. In this way, a user is able to find the page most relevant to his query more rapidly than has hitherto been possible.

Electronic document retrieval system with links to external documents

A method according to the present invention enables the similarity between sequences of symbols to be determined using rules generated from a dictionary-based compression scheme according to the content of the columns from databases. Pairs of symbols can replaced by rules that do not comprise a repeated combination of two symbols and where each rule occurs more than once in the sequence of symbols. The similarity of each set of rules can then be expressed numerically.

Method of comparing data sequences

Video material is dividing into temporal segments. Each segment is examined to determine whether the soundtrack of the segment contains speech sufficient for analysis and if so, metadata are generated based on analysis of the speech. If not, the segment is analysed by comparing frames thereof with those of stored segments that already have metadata assigned to them. One then assigns to the segment under consideration stored metadata associated with one or more stored segments that are similar.

Method and system for annotating video material

A system for processing data comprising: a plurality of resource interfaces each of which is operable to access a corresponding underlying resource, and a processor unit for integrating data accessed from the underlying resources and controlling a user interface. The user interface is operable in use to permit a user to view all of the underlying resources currently accessible to the system and to select a plurality of these to form a subset comprising some, but not all, of the underlying resources from which to form an integrated view of the sub-set. The processor unit is operable to store the selection within a user selection store and to determine how to join the data from the selected underlying resources to generate an integrated view of the selected sub-set of underlying resources and to generate data for transmission to a device for displaying the generated view to the user.

Data processing

A store of electronic documents is automatically searched by controlling a user interface to permit a user to enter a search term, carrying out a search using the search term, the documents returned by the search into a plurality of distinct categories, and controlling the user interface to present in a left-hand panel the plurality of distinct categories and in a right-hand panel the documents returned by the search, or references thereto, in a grouped manner such that documents, or references thereto, of a particular category are grouped together, wherein the categories are selected in dependence upon the search term.

Document searching tool and method

A method for knowledge representation and management is disclosed which has particular but not exclusive application in knowledge recovery techniques. To help with program understanding, software maintainers use computer aided reverse engineering (CARE) tools which utilize techniques such as syntax analysis, structural analysis, and domain knowledge base analysis (DKBA). Known DKBA methods are complex since the domain knowledge recovery relies on the use of knowledge at different layers while some elements of the knowledge at domain level is not used at all. In the disclosed method for representing knowledge in a knowledge base, the knowledge is represented by a set of one or more concepts and by one or more first type of relationships between two or more or said concepts. The method comprises dividing the set of concepts into a plurality of sub-sets, each sub-set comprising a set of concepts related to a sub-set of the knowledge; dividing the relationships among the sub-sets of concepts; and providing a further set comprising all the concepts along with a second type of relationship that provides an association between each concept in the further set of concepts and one or more of the sub-sets of concepts and relationships.

Method and apparatus for extracting knowledge from software code or other structured data

A data management system stores and visualizes data generated during process management. The data management system provides different data management services and definitions of these are stored in a database. Management of data in this database is carried out by a collection of software agents, one of which, the management information agent, can access, update and download data in or from the database. Stored separately are graphical user interfaces which are downloaded to a user in accordance with the relevant service definition stored in the database when the user requests a particular data access service.

Growing community of inventors

London, United Kingdom

Zhan Cui