GRAPH-BASED FUSING OF HETEROGENEOUS ALERTS
    3.
    发明申请
    GRAPH-BASED FUSING OF HETEROGENEOUS ALERTS 审中-公开
    基于图形的非均匀报警融合

    公开(公告)号:WO2017176676A1

    公开(公告)日:2017-10-12

    申请号:PCT/US2017/025846

    申请日:2017-04-04

    Abstract: Methods and systems for reporting anomalous events include intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network. Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters. Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.

    Abstract translation: 用于报告异常事件的方法和系统包括基于对网络中的过程级事件的状态建模的过程图的主机内集群化一组警报。 基于各个群集中警报之间的隐藏关系,在主机内群集警报上执行隐藏关系群集。 基于模拟网络中的连接事件之间的源和目标关系的拓扑图,在隐藏关系群集警报上执行主机间群集。 报告超过可信赖阈值水平的主机间群集警报。

    MULTI-MODALITY DATA ANALYSIS ENGINE FOR DEFECT DETECTION

    公开(公告)号:WO2023086533A1

    公开(公告)日:2023-05-19

    申请号:PCT/US2022/049646

    申请日:2022-11-11

    Abstract: Systems and methods for defect detection for vehicle operations, including collecting a multiple modality input data stream from a plurality of different types of vehicle sensors, extracting one or more features from the input data stream using a grid-based feature extractor, and retrieving spatial attributes of objects positioned in any of a plurality of cells of the grid-based feature extractor. One or more anomalies are detected based on residual scores generated by each of cross attention-based anomaly detection and time-series-based anomaly detection. One or more defects are identified based on a generated overall defect score determined by integrating the residual scores for the cross attention-based anomaly detection and the time-series based anomaly detection being above a predetermined defect score threshold. Operation of the vehicle is controlled based on the one or more defects identified.

    VEHICLE INTELLIGENCE TOOL FOR EARLY WARNING WITH FAULT SIGNATURE

    公开(公告)号:WO2022055783A1

    公开(公告)日:2022-03-17

    申请号:PCT/US2021/048817

    申请日:2021-09-02

    Abstract: A method for early warning is provided. The method clusters (810) normal historical data of normal cars into groups based on the car subsystem to which they belong. The method extracts (820) (i) features based on group membership and (ii) feature correlations based on correlation graphs formed from the groups. The method trains (830) an Auto-Encoder and Auto Decoder (AE&AD) model based on the features and the feature correlations to reconstruct the normal historical data with minimum reconstruction errors. The method reconstructs (840), using the trained AE&AD model, historical data of specific car fault types with reconstruction errors, normalizes the reconstruction errors, and selects features of the car faults with a top k large errors as fault signatures. The method reconstructs (850) streaming data of monitored cars using the trained AE&AD model to determine streaming reconstruction errors, comparing the streaming reconstruction errors with the fault signatures to predict and provide alerts for impending known faults.

    PROTOCOL-INDEPENDENT ANOMALY DETECTION
    6.
    发明申请

    公开(公告)号:WO2020036850A1

    公开(公告)日:2020-02-20

    申请号:PCT/US2019/046112

    申请日:2019-08-12

    Abstract: A computer-implemented method for implementing protocol-independent anomaly detection within an industrial control system (ICS) includes implementing a detection stage (1400), including performing byte filtering using a byte filtering model based on at least one new network packet associated with the ICS (1430), performing horizontal detection to determine whether a horizontal constraint anomaly exists in the at least one network packet based on the byte filtering and a horizontal model (1440), including analyzing constraints across different bytes of the at least one new network packet, performing message clustering based on the horizontal detection to generate first cluster information (1450), and performing vertical detection to determine whether a vertical anomaly exists based on the first cluster information and a vertical model (1460), including analyzing a temporal pattern of each byte of the at least one new network packet.

    A GRAPH MODEL FOR ALERT INTERPRETATION IN ENTERPRISE SECURITY SYSTEM

    公开(公告)号:WO2019084072A1

    公开(公告)日:2019-05-02

    申请号:PCT/US2018/057198

    申请日:2018-10-24

    Abstract: A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, automatically analyzing the alerts, in real-time, by using a graph-based alert interpretation engine employing process-star graph models, retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation, and integrating the cause of the alerts, the aftermath of the alerts, and the baselines to output an alert interpretation graph to a user interface of a user device.

    BLUE PRINT GRAPHS FOR FUSING OF HETEROGENEOUS ALERTS
    8.
    发明申请
    BLUE PRINT GRAPHS FOR FUSING OF HETEROGENEOUS ALERTS 审中-公开
    用于融合非均匀报警的蓝色图表

    公开(公告)号:WO2017176673A1

    公开(公告)日:2017-10-12

    申请号:PCT/US2017/025843

    申请日:2017-04-04

    Abstract: Methods and systems for reporting anomalous events include building a process graph that models states of process-level events in a network. A topology graph is built that models source and destination relationships between connection events in the network. A set of alerts is clustered based on the process graph and the topology graph. Clustered alerts that exceed a threshold level of trustworthiness are reported.

    Abstract translation: 用于报告异常事件的方法和系统包括构建对网络中的过程级事件的状态建模的过程图。 建立一个拓扑图,模拟网络中连接事件之间的源和目标关系。 基于过程图和拓扑图来聚集一组警报。 报告超过可信赖阈值级别的群集警报。

    INTERPRETING CONVOLUTIONAL SEQUENCE MODEL BY LEARNING LOCAL AND RESOLUTION-CONTROLLABLE PROTOTYPES

    公开(公告)号:WO2021158409A1

    公开(公告)日:2021-08-12

    申请号:PCT/US2021/015280

    申请日:2021-01-27

    Abstract: A method interprets a convolutional sequence model. The method converts (610) an input data sequence having input segments into output features. The method clusters (620) the input segments into clusters using respective resolution-controllable class prototypes allocated to each of classes. Each respective class prototype includes a respective output feature subset characterizing a respective associated class. The method calculates (630), using the clusters, similarity scores that indicate a similarity of an output feature to a respective class prototypes responsive to distances between the output feature and the respective class prototypes. The method concatenates (640) the similarity scores to obtain a similarity vector. The method performs (650) a prediction and prediction support operation that provides a value of prediction and an interpretation for the value responsive to the input segments and similarity vector. The interpretation for the value of prediction is provided using only non-negative weights and lacking a weight bias in the fully connected layer.

Patent Agency Ranking