Abstract: Machine learning techniques can be used to train a classifier, in some embodiments, to accurately detect similarities between different records of user activity for a same user. When more recent data is received, newer data can be analyzed by selectively removing particular sub-groups of data to see if there is any particular data that accounts for a large difference (e.g. when run through a classifier that has been trained to produce similar results for known activity data from a same user). If a sub-group of data is identified as being significantly different from other user data, this may indicate an account breach. Advanced machine learning techniques described herein may be applicable to a variety of different environments.

Abstract: Aspects of the present disclosure involve a system and method for malware detection. The system and method introduce a probabilistic model that can observe user transaction data over a predetermined window of time. Then, using posterior probability, the system can determine whether multiple users where present during the window observed.

Abstract: A system for discovering programming variants. The system analyzes system calls from executing a program to generate programming code or executable for a particular OS and/or CPU that would perform the same or similar actions as the program. The code that is generated is then mutated, augmented, and/or changed to create variations of the program which still functions and/or obtains the same objectives as the original code.

Abstract: A system for predicting that a user session will be fraudulent. The system can analyze an incomplete session and determine the likelihood that the session is fraudulent or not by generating completed sessions based on the incomplete session.

Abstract: The systems and methods that detect malware from count vectors are provided. A count vector having multiple components is generated. The count vector tracks a number and types of system calls generated by a process. Each component in the count vector is mapped to a type of a system call that exists in an operating system. Multiple system calls generated by the process are received over a first time interval. Each system call is mapped to a component in the count vector. The count vectors are aggregated according to a second time interval into a vector packet. The vector packet is transmitted over a network to a malware detection system that uses the count vectors in the vector packet to determine whether the process is a malware process.

Abstract: A system for discovering programming variants. The system analyzes system calls from executing a program to generate programming code or executable for a particular OS and/or CPU that would perform the same or similar actions as the program. The code that is generated is then mutated, augmented, and/or changed to create variations of the program which still functions and/or obtains the same objectives as the original code.

Abstract: Techniques are provided for rendering media as layers. Logical units of media form a media stream. The media stream as a whole is processed to divide components within the units into assigned layers. The layers are then formatted to a desired output format in parallel with one another when dependencies permit. Next, each unit of media is rendered to the output format by superimposing or merging multiple layers to reconstruct each unit of media in the output format.

Abstract: Techniques are provided for rendering media as layers. Logical units of media form a media stream. The media stream as a whole is processed to divide components within the units into assigned layers. The layers are then formatted to a desired output format in parallel with one another when dependencies permit. Next, each unit of media is rendered to the output format by superimposing or merging multiple layers to reconstruct each unit of media in the output format.

Abstract: Methods and a system are provided to receive electronic data in their native format and to deliver automatically revised electronic data in a new format and new layout. The received data are decomposed into their constituent parts including text and floating objects, geometric rectangles are generated to house the objects where like object rectangles are linked together creating a path for object insertion onto the rendered page. Moreover, a method of electronically providing for a footnote body on an electronic page is provided wherein page objects are received having reference and body objects. A body area is generated at the bottom of a page to house the body objects while a reference area is generated above the body area to house the reference objects. The areas are represented as geometric rectangles, and the body area is expanded to accommodate an additional body object while the reference are is correspondingly decreased maintaining the overall area associated with the page.

Abstract: Methods and a system are provided to receive electronic data in their native format and to deliver automatically revised electronic data in a new format and new layout. The received data are decomposed into their constituent parts including text and floating objects, geometric rectangles are generated to house the objects where like object rectangles are linked together creating a path for object insertion onto the rendered page. Moreover, a method of electronically providing for a footnote body on an electronic page is provided wherein page objects are received having reference and body objects. A body area is generated at the bottom of a page to house the body objects while a reference area is generated above the body area to house the reference objects. The areas are represented as geometric rectangles, and the body area is expanded to accommodate an additional body object while the reference are is correspondingly decreased maintaining the overall area associated with the page.

Abstract: Methods are provided for rendering footnotes to a variety of media. Footnote citations and non footnote data are received and inserted into a unit of media at a beginning location within the unit of media. If a footnote citation is detected, insertion into the unit of media is interrupted and the area associated with receiving the non footnote data and the footnote citation is inverted within the unit of media such that the footnote bodies are received and inserted into the unit of media at the beginning location. After insertion of the footnote bodies is complete, the area associated with receiving the non footnote data and the footnotes citation is restored such that the non footnote data and the footnote citations are located at the beginning location within the unit of media.