Abstract: Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for collecting parking fees. One of the methods includes: obtaining information of a vehicle parked in a parking space, where the information is associated with a user account of a payment platform. In response to determining that a time period that the vehicle parked in the parking space reaches a predetermined time period, a payment collection request is initiated for the vehicle to the payment platform to collect a parking fee for the predetermined time period.

Abstract: Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for collecting parking fees. One of the computer-implemented methods includes obtaining information associated with a vehicle parked in a parking space, where the information is associated with a user account of a payment platform. A parking record is recorded for the vehicle and to a blockchain by using a blockchain node corresponding to a parking fee charging system in a blockchain network, where the parking record comprises a duration that the vehicle is parked in the parking space. A parking fee is collected through the payment platform in response to determining that the duration that the vehicle parked in the parking space reaches a predetermined time period.

Abstract: Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for toll fee charging. One of the computer-implemented methods includes obtaining information of a vehicle traveling on a toll road, where the vehicle is associated with a user account on a payment platform. For the vehicle and to a blockchain, recording a travel history by using a blockchain node corresponding to the tolling system in a blockchain network, where the travel history comprises a distance the vehicle is driven on the toll road. In response to determining that the distance the vehicle is driven reaches a predetermined distance, charging a toll fee using the payment platform.

Abstract: A computer-implemented method, computer program product, and computer processing system are provided. The method includes preprocessing, by a processor, a set of heterogeneous logs by splitting each of the logs into tokens to obtain preprocessed logs. Each of the logs in the set is associated with a timestamp and textual content in one or more fields. The method further includes generating, by the processor, a set of regular expressions from the preprocessed logs. The method also includes performing, by the processor, an unsupervised parsing operation by applying the regular expressions to the preprocessed logs to obtain a set of parsed logs and a set of unparsed logs, if any. The method additionally includes storing, by the processor, the set of parsed logs in a log analytics database and the set of unparsed logs in a debugging database.

Abstract: A method for processing a consensus request in a computer network comprises: determining a pending request set, the pending request set including one or more pending consensus requests; determining a number of subsets that are in a consensus stage, wherein the subsets comprise the pending consensus requests that are obtained from the pending request set; and when the number of subsets that are in the consensus stage is less than a preset concurrent number of the computer network, issuing a consensus proposal for a new subset to the computer network to cause the new subset to enter the consensus stage to process the pending consensus requests, wherein the preset concurrent number is an upper limit of the number of subsets that are permitted to be simultaneously in the consensus stage in the computer network.

Abstract: A method for processing a consensus request in a computer network comprises: determining a pending request set, the pending request set including one or more pending consensus requests; determining a number of subsets that are in a consensus stage, wherein the subsets comprise the pending consensus requests that are obtained from the pending request set; and when the number of subsets that are in the consensus stage is less than a preset concurrent number of the computer network, issuing a consensus proposal for a new subset to the computer network to cause the new subset to enter the consensus stage to process the pending consensus requests, wherein the preset concurrent number is an upper limit of the number of subsets that are permitted to be simultaneously in the consensus stage in the computer network.

Abstract: A method for processing a consensus request in a computer network comprises: determining a pending request set, the pending request set including one or more pending consensus requests; determining a number of subsets that are in a consensus stage, wherein the subsets comprise the pending consensus requests that are obtained from the pending request set; and when the number of subsets that are in the consensus stage is less than a preset concurrent number of the computer network, issuing a consensus proposal for a new subset to the computer network to cause the new subset to enter the consensus stage to process the pending consensus requests, wherein the preset concurrent number is an upper limit of the number of subsets that are permitted to be simultaneously in the consensus stage in the computer network.

Abstract: Systems and methods are disclosed for detecting periodic event behaviors from machine generated logging by: capturing heterogeneous log messages, each log message including a time stamp and text content with one or more fields; recognizing log formats from log messages; transforming the text content into a set of time series data, one time series for each log format; during a training phase, analyzing the set of time series data and building a category model for each periodic event type in heterogeneous logs; and during live operation, applying the category model to a stream of time series data from live heterogeneous log messages and generating a flag on a time series data point violating the category model and generating an alarm report for the corresponding log message.

Abstract: A method for processing a consensus request in a computer network comprises: determining a pending request set, the pending request set including one or more pending consensus requests; determining a number of subsets that are in a consensus stage, wherein the subsets comprise the pending consensus requests that are obtained from the pending request set; and when the number of subsets that are in the consensus stage is less than a preset concurrent number of the computer network, issuing a consensus proposal for a new subset to the computer network to cause the new subset to enter the consensus stage to process the pending consensus requests, wherein the preset concurrent number is an upper limit of the number of subsets that are permitted to be simultaneously in the consensus stage in the computer network.

Abstract: A method for processing a consensus request in a computer network comprises: determining a pending request set, the pending request set including one or more pending consensus requests; determining a number of subsets that are in a consensus stage, wherein the subsets comprise the pending consensus requests that are obtained from the pending request set; and when the number of subsets that are in the consensus stage is less than a preset concurrent number of the computer network, issuing a consensus proposal for a new subset to the computer network to cause the new subset to enter the consensus stage to process the pending consensus requests, wherein the preset concurrent number is an upper limit of the number of subsets that are permitted to be simultaneously in the consensus stage in the computer network.

Abstract: Methods and systems for detecting a system fault include determining a network of broken correlations for a current timestamp, relative to a predicted set of correlations, based on a current set of sensor data. The network of broken correlations for the current timestamp is compared to networks of broken correlations for previous timestamps to determine a fault propagation pattern. It is determined whether a fault has occurred based on the fault propagation pattern. A system management action is performed if a fault has occurred.

Abstract: A system and computer-implemented method are provided for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts. The system includes a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries. The system further includes a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs.

Abstract: Methods and systems for security analysis include determining whether a process has an origin internal to a system or external to the system using a processor based on monitored behavior events associated with the process. A security analysis is performed on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.

Abstract: A computer-implemented method for performing privilege flow analysis is presented. The computer-implemented method includes monitoring at least one program operating system (OS) event handled by a program, generating a privilege flow graph, determining an inferred program behavior context, and generating, based on a combination of the privilege flow graph and the inferred program behavior context, an inferred behavior context-aware privilege flow graph to distinguish different roles of processes and/or threads within the program.

Abstract: Systems and methods are provided for acquiring data from an input signal using multitask regression. The method includes: receiving the input signal, the input signal including data that includes a plurality of features; determining at least two computational tasks to analyze within the input signal; regularizing all of the at least two tasks using shared adaptive weights; performing a multitask regression on the input signal to create a solution path for all of the at least two tasks, wherein the multitask regression includes updating a model coefficient and a regularization weight together under an equality norm constraint until convergence is reached, and updating the model coefficient and regularization weight together under an updated equality norm constraint that has a greater l1-penalty than the previous equality norm constraint until convergence is reached; selecting a sparse model from the solution path; constructing an image using the sparse model; and displaying the image.

Abstract: Methods and systems for log management include pre-processing heterogeneous logs and performing a log management action on the pre-processed plurality of heterogeneous logs. Pre-processing the logs includes performing a fixed tokenization of the heterogeneous logs based on a predefined set of symbols, performing a flexible tokenization of the heterogeneous logs based on a user-defined set of rules, converting timestamps in the heterogeneous logs to a single target timestamp format, and performing structural log tokenization of the heterogeneous logs based on user-defined structural information.

Abstract: Methods and systems for reporting anomalous events include intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network. Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters. Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.

Abstract: Methods and systems for reporting anomalous events include building a process graph that models states of process-level events in a network. A topology graph is built that models source and destination relationships between connection events in the network. A set of alerts is clustered based on the process graph and the topology graph. Clustered alerts that exceed a threshold level of trustworthiness are reported.

Abstract: A method is provided that includes transforming training data into a neural network based learning model using a set of temporal graphs derived from the training data. The method includes performing model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The method includes transforming testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The method includes performing model inference by applying the inference and learning models to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts based on the extracted context features. Top-ranked alerts are identified as critical alerts. Each alert represents an anomaly in the test data.

Abstract: Systems and methods for managing components of physical systems, including decomposing raw time series by extracting an aging trend and a fluctuation term from the time series using an objective function of an optimization problem, the objective function minimizing reconstruction error and ensuring flatness of the fluctuation term over time. The optimization problem is transformed into a Quadratic Programming (QP) formulation including a monotonicity constraint and a non-negativity constraint, the constraints being merged together to reduce computational costs. An aging score and a confidence score are generated for the extracted aging trend to determine a severeness of aging for one or more components of the physical system, and the aging score and confidence score are fused to provide a fused ranking for the extracted aging trend for predicting future failures of the components.