Abstract: A method of efficiently resolving cases within a system includes (a) receiving a set of cases within the system, (b) running an automated clustering agent to automatically create a plurality of clusters of related cases based on similarities between the related cases, each cluster including a plurality of cases, and (c) processing a set of the clusters of cases through a pipelined case cluster resolution system, the pipelined case cluster resolution system including a plurality of computerized agents and at least one human agent operating in a defined order, the pipelined case cluster resolution system resulting in a resolution of each case of a cluster of the plurality of clusters of related cases, each case having a same resolution as each other case in its respective cluster. An apparatus and computer program product for performing a similar method are also provided.

Abstract: A case management system includes a case database storing case records in association with respective internal case identifiers. Operation includes automatically generating memorable case identifiers and providing them to users for use in identifying respective case records, the memorable case identifiers being generated by encoding the internal case identifiers with respective user identifiers as respective sequences of words (e.g., 3-word sequences) of a natural language of the users according to an encoding function. Case records are retrieved from the case database and provided to the users based on memorable case identifiers received from the users, by decoding received memorable case identifiers into respective internal case identifiers and accessing the case database using the respective internal case identifiers from the decoding.

Abstract: A single system for detecting and blocking all cases of null-byte injection in all text data received for a network, before the text reaches potentially vulnerable services in the network. A set of directed graphs is received, each one of the directed graphs corresponding to a singly encoded null-byte that is encoded according to a corresponding character encoding method contained within a set of character encoding methods. The set of directed graphs is used to generate an output finite-state machine that models detection of at least one multiply encoded null-byte that is encoded according to at least one of the character encoding methods contained in the set of character encoding methods. The output finite-state machine is loaded into an attack detection and prevention system that receives input text, and that detects null-bytes, including multiply encoded null-bytes, within the input text.

Abstract: A computerized network defense system includes a user interface component for displaying an interactive landscape to an agent, including a graphical representation of (1) network components and interconnections within a computer network, (2) activity within the computer network, and (3) threat information associated with the activity. The activity and threat information is presented in visual association with corresponding network components and interconnections. Agent interaction with the landscape includes (a) selectively highlighting specific network components or interconnections, specific activity, and specific threat information represented on the interactive landscape, (b) causing additional more detailed information about a highlighted item to be displayed in a display element separate from the multidimensional graphical representation (e.g., pop-up box), and (c) selecting and directing use of remediation tools for remediation actions to counteract threat-associated activity.

Abstract: Techniques are disclosed for detecting malicious remote-administration tool (RAT) software by detecting reverse-connection communication activity. Communications are monitored over one or more persistent connections, such as TCP (Transmission Control Protocol) connections. Each monitored connection is between an initiator device and a follower device, and the initiator device is identified as the device that sent an initial packet to the follower device in order to open the connection. The disclosed techniques detect reverse-connection activity on the connection by detecting that communications over the connection are actually driven by the follower device, indicating that a malicious RAT is using the connection.

Abstract: Improved techniques involve comparing paronymous addresses received in transaction data with trusted sets of paronymous data stored in a database by both a trusted client computer and a trusted server computer. Along these lines, the trusted client computer sends data packets to the trusted server computer that contain network addresses and a secure identifier. In response, the trusted server computer sends acknowledgment data packets containing encrypted network addresses and the secure identifier. Upon sending the acknowledgement data packets, the server computer communicates the network addresses to an aggregator. When the client computer receives the acknowledgement data packets, the client computer communicates the network addresses to the aggregator. Once the aggregator receives transaction data containing paronymous addresses, the aggregator compares the paronymous addresses to those communicated to it by the trusted server and client computers.

Abstract: Methods and devices for correlative monitoring, analysis, and control of multi-service, multi-network systems are provided herein. Exemplary methods may include generating a network topology graph of a metanetwork using traffic records obtained from the metanetwork, generating a causal digraph of the metanetwork using the traffic records and the network topology graph, and transmitting one or more of the network topology graph and the causal digraph to a computing system.

Abstract: Sequences of discrete events, such as clicks on a website, are evaluated for periodic behavior, a period is calculated, and the sequence is scored to determine the confidence that the sequence really exhibits periodicity. The random variations on the timing of the discrete events due to transmission delays or other factors may be reduced or eliminated from the evaluation. An apparatus for performing the method of evaluation may include a computer programmed to carry out the method.

Abstract: A method is performed in a network security system implemented in a computer or electronic device that is coupled to secured online resources for detecting unauthorized accesses of those secured online resources. The method includes monitoring a user activity session. It is determined whether the user activity session is indicative of a hidden session by an attacker, where the determination includes comparing the user activity session to an average user activity session.

Abstract: A hanger assembly for a garment including a neck opening and a pair of shoulder areas, including: a frame having a pair of lateral ends, each lateral end configured to support one shoulder area of the pair of shoulder areas from inside the garment; and a suspensor, coupled to the frame to transition between a pair of locations along the frame with the pair of locations including a first location generally centered between the pair of ends and a second location closer to a particular lateral end than an other lateral end, the suspensor having a suspending mode wherein the suspensor is located at the first location and an insertion-removal mode in which the suspensor is located at the second location.

Abstract: A computer readable storage medium has instructions for execution on a computer. The instructions monitor transactions between a server and a set of clients. An evaluation of session indicators associated with the transactions is performed. Individual sessions between the server and individual clients of the plurality of clients are isolated in response to the evaluation.

Abstract: Methods and devices for correlative monitoring, analysis, and control of multi-service, multi-network systems are provided herein. Exemplary methods may include generating a network topology graph of a metanetwork using traffic records obtained from the metanetwork, generating a causal digraph of the metanetwork using the traffic records and the network topology graph, and transmitting one or more of the network topology graph and the causal digraph to a computing system.

Abstract: A computer readable storage medium with instructions executable on a host computer. The instructions record a relationship between a partner site and the host computer, substitute a reference to the partner site with a partner site alias referencing the host computer, deliver the partner site alias to a client, replace the partner site alias for the reference to the partner site in response to receiving the partner site alias from the client and augment the address of the client with an address alias. The address alias is sent to the partner site. A partner action and the address alias are received from the partner site. The address is exchanged for the address alias. The partner action is delivered to the client utilizing the address. These operations are monitored to identify client activity that constitutes a security threat at the host computer or the partner site.

Abstract: A hanger assembly for a garment including a neck opening and a pair of shoulder areas, including: a frame having a pair of lateral ends, each lateral end configured to support one shoulder area of the pair of shoulder areas from inside the garment; and a suspensor, coupled to the frame to transition between a pair of locations along the frame with the pair of locations including a first location generally centered between the pair of ends and a second location closer to a particular lateral end than an other lateral end, the suspensor having a suspending mode wherein the suspensor is located at the first location and an insertion-removal mode in which the suspensor is located at the second location.

Abstract: This invention description details systems and methods for improving human conversations by enhancing conversation participants' ability to: —Distill out and record core ideas of conversations. —Classify and prioritize these key concepts. —Recollect commitments and issues and take appropriate action. —Analyze and uncover new insight from the linkage of these ideas with those from other conversations.

Abstract: A method and system for improving the efficiency of speech transcription by automating the management of a varying pool of human and machine transcribers having diverse qualifications, skills, and reliability for a fluctuating load of speech transcription tasks of diverse requirements such as accuracy, promptness, privacy, and security, from sources of diverse characteristics such as language, dialect, accent, speech style, voice type, vocabulary, audio quality, and duration.

Abstract: A method and system for improving the efficiency of real-time and non-real-time speech transcription by machine speech recognizers, human dictation typists, and human voicewriters using speech recognizers. In particular, the pacing with which recorded speech is presented to transcriptionists is automatically adjusted by monitoring the transcriptionists' output by comparing the output acoustically or phonetically to the presented recorded speech as well as monitoring the resulting transcription, and accordingly adjusting the pacing.

Abstract: A non-transitory computer readable storage medium includes executable instructions to observe the distribution of the frequency of a recurrent behavior to form a histogram. A rehistogram of the histogram is computed to model the distribution of the frequency of the frequency of the recurrent behavior. The rehistogram provides an individual frequency relative to the total frequency of the recurrent behavior. The individual frequency is compared to a predicted frequency to form a difference frequency. An anomaly event is identified when the difference frequency exceeds an anomaly threshold.

Abstract: A computer readable storage medium has instructions for execution on a computer. The instructions monitor transactions between a server and a set of clients. An evaluation of session indicators associated with the transactions is performed. Individual sessions between the server and individual clients of the plurality of clients are isolated in response to the evaluation.

Abstract: A computer readable storage medium with instructions executable on a host computer. The instructions record a relationship between a partner site and the host computer, substitute a reference to the partner site with a partner site alias referencing the host computer, deliver the partner site alias to a client, replace the partner site alias for the reference to the partner site in response to receiving the partner site alias from the client and augment the address of the client with an address alias. The address alias is sent to the partner site. A partner action and the address alias are received from the partner site. The address is exchanged for the address alias. The partner action is delivered to the client utilizing the address. These operations are monitored to identify client activity that constitutes a security threat at the host computer or the partner site.