Abstract: A computerized method, encoded on a computer-readable medium, of detecting anomalies in an event stream. The method comprises at least two acts. In a first act, the method uses a tree structure to extract a grammar having an associated set of rules, from a sample of normal behavior. In a second act, the method checks an event stream against the rules of the grammar to detect anomalies.

Abstract: The building, maintenance, and use of a database is described having a trie-like structure for storing entries and retrieving an at least partial match, preferably the longest partial match, or all partial matches of a search argument (input key) from said entries, said database having nodes (20), with each node containing first link information (21) leading to at least one previous node (parent pointer) and second link information (25,26) leading to at least one following node (child pointer), at least a stored key (entry, 23, 24), or a combination, thereof. The particular structure of the nodes allows a two-step search process, in which segments of a search argument are firstly used to determine a search path through the trie-like database, said search path being backtracked in the second part of the search. During the second part of the search the entire search argument is compared to entries stored in the nodes until a match is found.

Abstract: The present application concerns a multiplexing device (12,14) for a redundant channel bus (13). It comprises two arrays (12,14) of cascaded crosspoint cells, connected to opposite ends of the bus (13). The crosspoint cells of the first (12) of said arrays have means for establishing n data paths from n input data lines to n channels of n+x channels, and the crosspoint cells of the second array (14) have means to establish n corresponding data paths from the n channels to n output data lines. Further, the crosspoint cells comprise means to identically alter data paths in both arrays, said means being controlled by the means to recognize a faulty channel. The multiplexer is designed with a minimum number of gates, thus, providing a fast device for circumventing faulty channels. It is useful for fast and secure data transmission, especially suitable as a backbone bus device between independent central processing units.