Abstract: A computer-implemented method for automatically analyzing log contents received via a network and detecting content-level anomalies is presented. The computer-implemented method includes building a statistical model based on contents of a set of training logs and detecting, based on the set of training logs, content-level anomalies for a set of testing logs. The method further includes maintaining an index and metadata, generating attributes for fields, editing model capability to incorporate user domain knowledge, detecting anomalies using field attributes, and improving anomaly quality by using user feedback.

Abstract: A method is provided that includes transforming training data into a neural network based learning model using a set of temporal graphs derived from the training data. The method includes performing model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The method includes transforming testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The method includes performing model inference by applying the inference and learning models to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts based on the extracted context features. Top-ranked alerts are identified as critical alerts. Each alert represents an anomaly in the test data.

Abstract: A heterogeneous log pattern editing recommendation system and computer-implemented method are provided. The system has a processor configured to identify, from heterogeneous logs, patterns including variable fields and constant fields. The processor is also configured to extract a category feature, a cardinality feature, and a before-after n-gram feature by tokenizing the variable fields in the identified patterns. The processor is additionally configured to generate target similarity scores between target fields to be potentially edited and other fields from among the variable fields in the heterogeneous logs using pattern editing operations based on the extracted category feature, the extracted cardinality feature, and the extracted before-after n-gram feature. The processor is further configured to recommend, to a user, log pattern edits for at least one of the target fields based on the target similarity scores between the target fields in the heterogeneous logs.

Abstract: Methods and systems for detecting anomalous events include detecting anomalous events in monitored system data. An event correlation graph is generated by determining a tendency for a first process to access a system target, including an innate tendency of the first process to access the system target, an influence of previous events from the first process, and an influence of processes other than the first process. Kill chains are generated from the event correlation graph that characterize events in an attack path over time. A security management action is performed based on the kill chains.

Abstract: Methods and systems for detecting anomalous events include detecting anomalous events in monitored system data. An event correlation graph is generated based on the monitored system data that characterizes the tendency of processes to access system targets. Kill chains are generated that connect malicious events over a span of time from the event correlation graph that characterize events in an attack path over time by sorting events according to a maliciousness value and determining at least one sub-graph within the event correlation graph with an above-threshold maliciousness rank. A security management action is performed based on the kill chains.

Abstract: Streaming query resource control is described, for example, to allocate streaming queries to servers in a data center providing a streaming query platform. In various embodiments streaming queries are allocated to servers in a manner seeking to balance load between the servers and also to reduce network traffic costs between data stream sources and the servers. In various examples, query types are taken into account, where a query type is the identity of one or more data stream sources used by the query, and optionally also traffic rates of the data stream sources. In some examples, processes for allocating incoming queries in an online fashion are described and in some examples, processes for allocating queries in an offline fashion are described. In examples, a network traffic cost metric is used which takes into account an incremental network traffic cost of adding a given query at a server.

Abstract: A method is provided that is performed in a network having nodes that generate heterogeneous logs including performance logs and text logs. The method includes performing, during a heterogeneous log training stage, (i) a log-to-time sequence conversion process for transforming clustered ones of training logs, from among the heterogeneous logs, into a set of time sequences that are each formed as a plurality of data pairs of a first configuration and a second configuration based on cluster type, (ii) a time series generation process for synchronizing particular ones of the time sequences in the set based on a set of criteria to output a set of fused time series, and (iii) an invariant model generation process for building invariant models for each time series data pair in the set of fused time series. The method includes controlling an anomaly-initiating one of the plurality of nodes based on the invariant models.

Abstract: First and second positioning devices disposed at first and second stationary locations transmit first and second pilot signals, respectively. Transmission coverages of the first and second pilot signals have an area of overlap. When a mobile robot moves to the area of overlap, the mobile robot determines first angular orientation information between the mobile robot and the first positioning device, and second angular orientation information between the mobile robot and the second positioning device. The mobile robot then determines an initial position of the mobile robot based on the first stationary location, the second stationary location, the first angular orientation information, and the second angular orientation information.

Abstract: A method and system for constructing behavior queries in temporal graphs using discriminative sub-trace mining. The method includes generating system data logs to provide temporal graphs, wherein the temporal graphs include a first temporal graph corresponding to a target behavior and a second temporal graph corresponding to a set of background behaviors, generating temporal graph patterns for each of the first and second temporal graphs to determine whether a pattern exists between a first temporal graph pattern and a second temporal graph pattern, wherein the pattern between the temporal graph patterns is a non-repetitive graph pattern, pruning the pattern between the first and second temporal graph patterns to provide a discriminative temporal graph, and generating behavior queries based on the discriminative temporal graph.

Abstract: Streaming query resource control is described, for example, to allocate streaming queries to servers in a data center providing a streaming query platform. In various embodiments streaming queries are allocated to servers in a manner seeking to balance load between the servers and also to reduce network traffic costs between data stream sources and the servers. In various examples, query types are taken into account, where a query type is the identity of one or more data stream sources used by the query, and optionally also traffic rates of the data stream sources. In some examples, processes for allocating incoming queries in an online fashion are described and in some examples, processes for allocating queries in an offline fashion are described. In examples, a network traffic cost metric is used which takes into account an incremental network traffic cost of adding a given query at a server.

Abstract: First and second positioning devices disposed at first and second stationary locations transmit first and second pilot signals, respectively. Transmission coverages of the first and second pilot signals have an area of overlap. When a mobile robot moves to the area of overlap, the mobile robot determines first angular orientation information between the mobile robot and the first positioning device, and second angular orientation information between the mobile robot and the second positioning device. The mobile robot then determines an initial position of the mobile robot based on the first stationary location, the second stationary location, the first angular orientation information, and the second angular orientation information.

Abstract: A method for controlling the beta-tin crystal orientation in solder joints is provided. The method is suitable for joining metallization pads using a solder containing tin and silver. By adjusting the silver content in the solder within a specific range of equal to or more than 2.5 wt. % and less than 3.2 wt. %, the [001] axes of beta-tin crystals in the solder is aligned to be in the direction parallel with a solder/metallization pad interface substantially. Electromigration-induced solder deformations and metallization pad consumption can be significantly reduced when solder joints have such a microstructure. Additionally, the undesired Ag3Sn plates in the solder matrix can be avoided accordingly.

Abstract: A method for controlling the beta-tin crystal orientation in solder joints is provided. The method is suitable for joining metallization pads using a solder containing tin and silver. By adjusting the silver content in the solder within a specific range of equal to or more than 2.5 wt. % and less than 3.2 wt. %, the [001] axes of beta-tin crystals in the solder is aligned to be in the direction parallel with a solder/metallization pad interface substantially. Electromigration-induced solder deformations and metallization pad consumption can be significantly reduced when solder joints have such a microstructure. Additionally, the undesired Ag3Sn plates in the solder matrix can be avoided accordingly.

Abstract: The present invention discloses a touch-sensitive flickering illuminant, which comprises a soft plastic body and an operation circuit embedded in the body. The body further comprises a plate with a conducting sheet, the plate is deployed in the center inside the body and a lower cover; the operation circuit is embedded in the holding space between the plate and the lower cover, and after the operation circuit is sealed with high frequency wave or glue, the on-off illuminant groupware is formed after an outer press plate touches the operation circuit via the conducting sheet; and the plate of the flickering illuminant can be various vignettes or enterprise identification signs, and can be widely used in business with the combination of various goods in appropriate manner.