Abstract: An application activation method includes enabling an activation of one or more applications, including an activation of a first application, on a computing device. A first plurality of interactions of a user with the one or more applications on the computing device are detected. A first offer to renew the activation of the first application is generated based on the first plurality of interactions of the user. The first offer is provided to the user via the computing device. An acceptance of the first offer is received from the user, and the activation of the first application is renewed responsive to receiving the acceptance of the first offer.

Abstract: A method of identifying anomalous traffic in a sequence of commercial transaction data includes preprocessing the commercial transaction data into a sequential time series of commercial transaction data, and providing the time series of commercial transaction data to a recurrent neural network. The recurrent neural network evaluates the provided time series of commercial transaction data to generate and output a predicted next element in the time series of commercial transaction data, which is compared with an observed actual next element in the time series of commercial transaction data. The observed next element in the time series of commercial transaction data is determined to be anomalous if it is sufficiently different from the predicted next element in the time series of commercial transaction data.

Abstract: A method of identifying anomalous traffic in a sequence of computer network traffic includes preprocessing the sequence of computer network traffic into a high-dimensional time series sequence of computer network traffic, and providing the high-dimensional time series to a recurrent neural network. The recurrent neural network evaluates the provided high-dimensional time series to generate and output a predicted next element in the high-dimensional time series, which is compared with an observed actual next element in the high-dimensional time series. The observed next element in the high-dimensional time series is determined to be anomalous if it sufficiently different from the predicted next element in the high-dimensional time series.

Abstract: In one embodiment, a device generates one or more time series of characteristics of client-server communications observed in a network for a particular client in the network. The device partitions the one or more time series into sets of time windows based on patterns present in the characteristics of the client-server communications. The device compares the characteristics of the client-server communications from the partitioned time windows to determine measures of behavioral similarity between the compared time windows. The device provides the measures of behavioral similarity between the compared time windows as input to a machine learning-based malware detector. The device causes performance of a mitigation action in the network when the machine learning-based malware detector determines that the particular client in the network is infected with malware.

Abstract: In one embodiment, a device generates one or more time series of characteristics of client-server communications observed in a network for a particular client in the network. The device partitions the one or more time series into sets of time windows based on patterns present in the characteristics of the client-server communications. The device compares the characteristics of the client-server communications from the partitioned time windows to determine measures of behavioral similarity between the compared time windows. The device provides the measures of behavioral similarity between the compared time windows as input to a machine learning-based malware detector. The device causes performance of a mitigation action in the network when the machine learning-based malware detector determines that the particular client in the network is infected with malware.