Abstract: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to detect triggering of one or more threat detectors and activate a subset of nodes associated with the triggered threat detectors from a plurality of nodes in a Bayesian network in response to the detection. The at least one processor is further configured to determine that feedback associated with the triggered threat detectors is available and, if so, accumulate the feedback to a feedback node of the network, the feedback node associated with the triggered threat detectors. The at least one processor is further configured to calculate a probability of malicious action using the network to combine probabilities associated with the activated subset of nodes and the feedback node, determine that the probability exceeds a threshold value, and perform a security action in response to the determination.

Abstract: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to detect triggering of one or more threat detectors. The at least one processor is further configured to activate a subset of nodes from a plurality of nodes in a Bayesian network in response to the detection, the activated subset of nodes associated with the triggered threat detectors. The at least one processor is further configured to calculate a probability of malicious action using the Bayesian network to combine probabilities associated with the activated subset of nodes. The at least one processor is further configured to determine that the probability exceeds a threshold value. The at least one processor is further configured to perform a security action in response to the determination.

Abstract: Described embodiments provide systems and methods for detection of the degradation of a virtual desktop environment. A computing device may receive data from a plurality of client devices. The computing device may identify a subset of client devices from the plurality of client devices with at least one characteristic in common based on the received data. The computing device may determine a ratio of the identified subset of client devices, the ratio being a comparison of client devices of the subset with a value above a first threshold to a total number of client devices of the subset, and the value being indicative of a characteristic of performance for that client device. The computing device may identify a cause of an anomaly in the performance of the application based on the ratio exceeding a second threshold.

Abstract: Described embodiments provide systems, methods, and computer readable media for generating environment descriptors. A device having at least one process may identify a plurality of feature vectors. Each vector may describe a corresponding access to an application hosted on a server in one of a plurality of network environments and having a corresponding performance metric. The device may provide a performance model using the plurality of feature vectors and the corresponding performance metrics. The performance model may be used to determine expected performance metrics for at least a first network environment. A first environment descriptor of the expected performance metrics may be generated for at least the first network environment. The first environment descriptor of the expected performance metrics may be used to assess a measured performance metric or a second environment descriptor of a second network environment.

Abstract: A system and method that detects malicious account creation in a web-based platform. A method includes detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an IP address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collections of account creation processes; and determining an alert condition based on at least one malicious event detection.

Abstract: Described embodiments provide systems and methods for detection of the degradation of a virtual desktop environment. A computing device may receive data from a plurality of client devices. The computing device may identify a subset of client devices from the plurality of client devices with at least one characteristic in common based on the received data. The computing device may determine a ratio of the identified subset of client devices, the ratio being a comparison of client devices of the subset with a value above a first threshold to a total number of client devices of the subset, and the value being indicative of a characteristic of performance for that client device. The computing device may identify a cause of an anomaly in the performance of the application based on the ratio exceeding a second threshold.

Abstract: Described embodiments provide systems and methods for determining a change in a performance of a server. A device can receive a processing load and a request rate of a server. The device can determine a value indicative of a correlation between the processing load and the request rate of the server for a range of time. The device can determine whether the value is outside a range of a threshold for the server. The threshold can be indicative of one or more previous values determined for the server for the range of time. The device can generate an alert indicating a change in a performance of the server responsive to a comparison of the value to the threshold for the server.

Abstract: Described embodiments provide systems and methods for detection of the degradation of a virtual desktop environment. A computing device may receive data from a plurality of client devices. The computing device may identify a subset of client devices from the plurality of client devices with at least one characteristic in common based on the received data. The computing device may determine a ratio of the identified subset of client devices, the ratio being a comparison of client devices of the subset with a value above a first threshold to a total number of client devices of the subset, and the value being indicative of a characteristic of performance for that client device. The computing device may identify a cause of an anomaly in the performance of the application based on the ratio exceeding a second threshold.

Abstract: Described embodiments provide systems and methods for monitoring server utilization and reallocating resources using upper bound values. A device can determine a value indicative of an upper bound of a processing load of a server using data points detected for the processing load over a first range of time. The upper bound can correspond to a percentage of the processing load during the first range of time. The device can monitor, using the value, the processing load of the server over a second range of time. A determination can be made whether the value of the processing load is greater than a threshold during the second range of time. The device can generate an alert for the device responsive to a comparison of the value of the processing load to the threshold.

Abstract: Described embodiments provide systems and methods for monitoring server utilization and reallocating resources using upper bound values. A device can determine a value indicative of an upper bound of a processing load of a server using data points detected for the processing load over a first range of time. The upper bound can correspond to a percentage of the processing load during the first range of time. The device can monitor, using the value, the processing load of the server over a second range of time. A determination can be made whether the value of the processing load is greater than a threshold during the second range of time. The device can generate an alert for the device responsive to a comparison of the value of the processing load to the threshold.

Abstract: Described embodiments provide systems and methods for determining a change in a performance of a server. A device can receive a processing load and a request rate of a server. The device can determine a value indicative of a correlation between the processing load and the request rate of the server for a range of time. The device can determine whether the value is outside a range of a threshold for the server. The threshold can be indicative of one or more previous values determined for the server for the range of time. The device can generate an alert indicating a change in a performance of the server responsive to a comparison of the value to the threshold for the server.

Abstract: Described embodiments provide systems, methods, and computer readable media for generating environment descriptors. A device having at least one process may identify a plurality of feature vectors. Each vector may describe a corresponding access to an application hosted on a server in one of a plurality of network environments and having a corresponding performance metric. The device may provide a performance model using the plurality of feature vectors and the corresponding performance metrics. The performance model may be used to determine expected performance metrics for at least a first network environment. A first environment descriptor of the expected performance metrics may be generated for at least the first network environment. The first environment descriptor of the expected performance metrics may be used to assess a measured performance metric or a second environment descriptor of a second network environment.

Abstract: Systems and methods for identifying potential security incidents include an analytics engine that identifies a detection threshold for login failures according to a number of login successes to a system. The analytics engine may determine a number of login failures by a plurality of users to the system within a time window. The analytics engine may determine that the number of login failures to the system within the time window exceeds the detection threshold. The analytics engine may provide a notification to a device indicating a potential security incident responsive to the number of login failures exceeding the detection threshold.

Abstract: A method is described for adapting 3D image datasets so that they can be registered and combined with 2D images of the same subject, wherein deformation or movement of parts of the subject has occurred between obtaining the 3D image and the 2D image. 2D-3D registrations of the images with respect to multiple features visible in both images are used to provide point correspondences between the images in order to provide an interpolation function that can be used to determine the position of a feature visible in the first image but not the second image and thus mark the location of the feature on the second image. Also described is apparatus for carrying out this method.

Abstract: A method is described for adapting 3D image datasets so that they can be registered and combined with 2D images of the same subject, wherein deformation or movement of parts of the subject has occurred between obtaining the 3D image and the 2D image. 2D-3D registrations of the images with respect to multiple features visible in both images are used to provide point correspondences between the images in order to provide an interpolation function that can be used to determine the position of a feature visible in the first image but not the second image and thus mark the location of the feature on the second image. Also described is apparatus for carrying out this method.

Abstract: Embodiments of the invention introduce the concept of a virtual fiducial marker (VFM). This marker will not be placed prior to preoperative imaging. It will therefore not initially appear in the preoperative 3D image. Instead, the marker will be virtually placed in the 3D data set prior to surgery, and as such the marker does not even need to be attached to the patient, if the patient is not expected to move during surgery. The idea behind such a VFM comes from the observation that there is a big variation in the difficulty of an image based registration depending on the quality of the images and their field of view. However, provided two initial registrations to high quality wide field of view images can be carried out, it then becomes possible to use these registrations to insert a virtual fiducial marker within the 3D preoperative image. Once inserted it may then be used to obtain a starting position for a registration procedure, and particularly to obtain in-plane translations.

Abstract: Embodiments of the invention provide a system and method that is able to automatically provide a starting point for 2D to 3D image registration, without relying on human recognition of features shown in the 2D image. This is achieved by pre-processing the 3D data to obtain synthetically generated 2D images of those parts of the 3D data volume which will be used for registration purposes. Many different synthetically generated 2D images of the or each part of the 3D volume are produced, each from a different possible viewing direction. Each of these synthetic images is then subject to a feature extraction process to extract characterizing feature data of the registration feature shown in the images. Once the feature extraction has been undertaken for each image, when registration is to be performed the real-time 2D image is processed by applying each of the sets of extracted features thereto, to try and identify which set best matches the registration features in the 2D image.

Abstract: Embodiments of the invention introduce the concept of a virtual fiducial marker (VFM). This marker will not be placed prior to preoperative imaging. It will therefore not initially appear in the preoperative 3D image. Instead, the marker will be virtually placed in the 3D data set prior to surgery, and as such the marker does not even need to be attached to the patient, if the patient is not expected to move during surgery. The idea behind such a VFM comes from the observation that there is a big variation in the difficulty of an image based registration depending on the quality of the images and their field of view. However, provided two initial registrations to high quality wide field of view images can be carried out, it then becomes possible to use these registrations to insert a virtual fiducial marker within the 3D preoperative image. Once inserted it may then be used to obtain a starting position for a registration procedure, and particularly to obtain in-plane translations.

Abstract: Embodiments of the invention provide a system and method that is able to automatically provide a starting point for 2D to 3D image registration, without relying on human recognition of features shown in the 2D image. This is achieved by pre-processing the 3D data to obtain synthetically generated 2D images of those parts of the 3D data volume which will be used for registration purposes. Many different synthetically generated 2D images of the or each part of the 3D volume are produced, each from a different possible viewing direction. Each of these synthetic images is then subject to a feature extraction process to extract characterising feature data of the registration feature shown in the images. Once the feature extraction has been undertaken for each image, when registration is to be performed the real-time 2D image is processed by applying each of the sets of extracted features thereto, to try and identify which set best matches the registration features in the 2D image.