Abstract: A method for system metric prediction and influential events identification by concurrently employing metric logs and event logs is presented. The method includes concurrently modeling multivariate metric series and individual events in event series by a multi-stream recurrent neural network (RNN) to improve prediction of future metrics, where the multi-stream RNN includes a series of RNNs, one RNN for each metric and one RNN for each event sequence and modeling causality relations between the multivariate metric series and the individual events in the event series by employing an attention mechanism to identify target events most responsible for fluctuations of one or more target metrics.

Abstract: Methods and systems of training and using a neural network model include training a time series embedding model and a text embedding model with unsupervised clustering to translate time series and text, respectively, to a shared latent space. The time series embedding model and the text embedding model are further trained using semi-supervised clustering that samples training data pairs of time series information and associated text for annotation.

Abstract: Systems and methods for updating a classification model of a neural network. The methods include selecting, as a set of landmarks, a limited number of data from a set of historical data used to train a classification model. Additionally, the methods generate new training data from recently collected data. Further, the methods update the classification model with the new training data and the set of landmarks to obtain an updated classification model having a loss function configured to capture similarities in the new training data and remember similarities in the historical data represented by the set of landmarks within a predefined tolerance.

Abstract: Methods and systems for detecting and correcting anomalies includes generating historical binary codes from historical time series segments. The historical time series segments are each made up of measurements from respective sensors. A latest binary code is generated from a latest time series segment. It is determined that the latest time series segment represents anomalous behavior, based on a comparison of the latest binary code to the historical binary codes. The sensors are ranked, based on a comparison of time series data of the sensors in the latest time series segment to respective time series data of the historical time series, to generate a sensor ranking. A corrective action is performed responsive to the detected anomaly, prioritized according to the sensor ranking.

Abstract: A system for cross-modal data retrieval is provided that includes a neural network having a time series encoder and text encoder which are jointly trained using an unsupervised training method which is based on a loss function. The loss function jointly evaluates a similarity of feature vectors of training sets of two different modalities of time series and free-form text comments and a compatibility of the time series and the free-form text comments with a word-overlap-based spectral clustering method configured to compute pseudo labels for the unsupervised training method. The computer processing system further includes a database for storing the training sets with feature vectors extracted from encodings of the training sets. The encodings are obtained by encoding a training set of the time series using the time series encoder and encoding a training set of the free-form text comments using the text encoder.

Abstract: A method for explaining sensor time series data in natural language is presented. The method includes training a neural network model with text-annotated time series data, the neural network model including a time series encoder and a text generator, allowing a human operator to select a time series segment from the text-annotated time series data, the time series segment processed by the time series encoder, outputting, from the time series encoder, a sequence of hidden state vectors, one for each timestep, and generating readable explanatory texts for the human operator based on the selected time series segment, the readable explanatory texts being a set of comment texts explaining and interpreting the selected time series segment in a plurality of different ways.

Abstract: Methods and systems for training a model include training a feature extraction model to extract a feature vector from a multivariate time series segment, based on a set of training data corresponding to measurements of a system in a first domain. Adapting the feature extraction model to a second domain, based on prototypes of the training data in the first domain and new time series data corresponding to measurements of the system in a second domain.

Abstract: Methods and systems for training a neural network include collecting model exemplar information from edge devices, each model exemplar having been trained using information local to the respective edge devices. The collected model exemplar information is aggregated together using federated averaging. Global model exemplars are trained using federated constrained clustering. The trained global exemplars are transmitted to respective edge devices.

Abstract: A method is provided. Intermediate audio features are generated from respective segments of an input acoustic time series for a same scene. Using a nearest neighbor search, respective segments of the input acoustic time series are classified based on the intermediate audio features to generate a final intermediate feature as a classification for the input acoustic time series. Each respective segment corresponds to a respective different acoustic window. The generating step includes learning the intermediate audio features from Multi-Frequency Cepstral Component (MFCC) features extracted from the input acoustic time series, dividing the same scene into the different windows having varying MFCC features, and feeding the MFCC features of each window into respective LSTM units such that a hidden state of each respective LSTM unit is passed through an attention layer to identify feature correlations between hidden states at different time steps corresponding to different ones of the different windows.

Abstract: A method for system metric prediction and influential events identification by concurrently employing metric logs and event logs is presented. The method includes concurrently modeling multivariate metric series and individual events in event series by a multi-stream recurrent neural network (RNN) to improve prediction of future metrics, where the multi-stream RNN includes a series of RNNs, one RNN for each metric and one RNN for each event sequence and modeling causality relations between the multivariate metric series and the individual events in the event series by employing an attention mechanism to identify target events most responsible for fluctuations of one or more target metrics.

Abstract: A method classifies missing labels. The method computes, using a neural network model trained on training data, rank-based statistics of a feature of a time series segment to attempt to select two candidate labels from the training data that the segment most likely belongs to. The method classifies the segment using k-NN-based classification applied to the training data, responsive to the two candidate labels being present in the training data. The method classifies the segment by hypothesis testing, responsive to only one candidate label being present in the training data. The method classifies the segment into a class with higher values of the rank-based statistics from among a plurality of classes with different values of the rank-based statistics, responsive to no candidate labels being present in the training data. The method corrects a prediction by an applicable one of the classifying steps by majority voting with time windows.

Abstract: Methods and systems for training a neural network include collecting model exemplar information from edge devices, each model exemplar having been trained using information local to the respective edge devices. The collected model exemplar information is aggregated together using federated averaging. Global model exemplars are trained using federated constrained clustering. The trained global exemplars are transmitted to respective edge devices.

Abstract: Systems and methods for retrieving similar multivariate time series segments are provided. The systems and methods include extracting a long feature vector and a short feature vector from a time series segment, converting the long feature vector into a long binary code, and converting the short feature vector into a short binary code. The systems and methods further include obtaining a subset of long binary codes from a binary dictionary storing dictionary long codes based on the short binary codes, and calculating similarity measure for each pair of the long feature vector with each dictionary long code. The systems and methods further include identifying a predetermined number of dictionary long codes having the similarity measures indicting a closest relationship between the long binary codes and dictionary long codes, and retrieving a predetermined number of time series segments associated with the predetermined number of dictionary long codes.

Abstract: Methods and systems of training and using a neural network model include training a time series embedding model and a text embedding model with unsupervised clustering to translate time series and text, respectively, to a shared latent space. The time series embedding model and the text embedding model are further trained using semi-supervised clustering that samples training data pairs of time series information and associated text for annotation.

Abstract: Methods and systems for anomaly detection and correction include generating original signature matrices that represent a state of a system of multiple time series. The original signature matrices are encoded using convolutional neural networks. Temporal patterns in the encoded signature matrices are modeled using convolutional long-short term memory neural networks for each respective convolutional neural network. The modeled signature matrices using deconvolutional neural networks. An occurrence of an anomaly is determined using a loss function based on a difference between the decoded signature matrices and the original signature matrices. A corrective action is performed responsive to the determination of the occurrence of the anomaly.

Abstract: Methods and systems for detecting and correcting anomalies includes generating historical binary codes from historical time series segments. The historical time series segments are each made up of measurements from respective sensors. A latest binary code is generated from a latest time series segment. It is determined that the latest time series segment represents anomalous behavior, based on a comparison of the latest binary code to the historical binary codes. The sensors are ranked, based on a comparison of time series data of the sensors in the latest time series segment to respective time series data of the historical time series, to generate a sensor ranking. A corrective action is performed responsive to the detected anomaly, prioritized according to the sensor ranking.

Abstract: Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by a network gateway system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the network gateway system responsive to the determination that the received packet has a spoofed source IP address.

Abstract: Systems and methods for preventing cyberattacks using a Density Estimation Network (DEN) for unsupervised anomaly detection, including constructing the DEN using acquired network traffic data by performing end-to-end training. The training includes generating low-dimensional vector representations of the network traffic data by performing dimensionality reduction of the network traffic data, predicting mixture membership distribution parameters for each of the low-dimensional representations by performing density estimation using a Gaussian Mixture Model (GMM) framework, and formulating an objective function to estimate an energy and determine a density level of the low-dimensional representations for anomaly detection, with an anomaly being identified when the energy exceeds a pre-defined threshold. Cyberattacks are prevented by blocking transmission of network flows with identified anomalies by directly filtering out the flows using a network traffic monitor.

Abstract: A computer-implemented method for monitoring computing system status by implementing a deep unsupervised binary coding network includes receiving multivariate time series data from one or more sensors associated with a system, implementing a long short-term memory (LSTM) encoder-decoder framework to capture temporal information of different time steps within the multivariate time series data and perform binary coding, the LSTM encoder-decoder framework including a temporal encoding mechanism, a clustering loss and an adversarial loss, computing a minimal distance from the binary code to historical data, and obtaining a status determination of the system based on a similar pattern analysis using the minimal distance.

Abstract: A method is provided. Intermediate audio features are generated from an input acoustic sequence. Using a nearest neighbor search, segments of the input acoustic sequence are classified based on the intermediate audio features to generate a final intermediate feature as a classification for the input acoustic sequence. Each segment corresponds to a respective different acoustic window. The generating step includes learning the intermediate audio features from Multi-Frequency Cepstral Component (MFCC) features extracted from the input acoustic sequence. The generating step includes dividing the same scene into the different acoustic windows having varying MFCC features.