Abstract: A detection dictionary system provides a framework for describing, detecting, and reporting anomalies across multiple operating environments each including multiple computing devices. An anomaly in an operating environment refers to one or more operations or activities in the operating environment that may be indicative of an attack on the operating environment by a malicious user or program. The framework includes guarantees, detections, properties, and detection instances. Guarantees are promises or assertions made to an entity (e.g., a business or other organization) that describes what the detection dictionary system will detect and alert on when a particular trend or anomaly is identified. A detection is a set of metadata describing how to fulfill a given guarantee. A property describes how to map the detection to a particular detection instance. A detection instance is a specific implementation of a detection as applied to a property.

Abstract: A detection dictionary system provides a framework for describing, detecting, and reporting anomalies across multiple operating environments each including multiple computing devices. An anomaly in an operating environment refers to one or more operations or activities in the operating environment that may be indicative of an attack on the operating environment by a malicious user or program. The framework includes guarantees, detections, properties, and detection instances. Guarantees are promises or assertions made to an entity (e.g., a business or other organization) that describes what the detection dictionary system will detect and alert on when a particular trend or anomaly is identified. A detection is a set of metadata describing how to fulfill a given guarantee. A property describes how to map the detection to a particular detection instance. A detection instance is a specific implementation of a detection as applied to a property.

Abstract: A network communication channel can be reserved for emergency notifications. The network communication channel can be a dedicated protocol, port or message identification mechanism that can be recognized by networking software and directed to an emergency notification system that can be operationally associated with an operating system of a computing device. The emergency notification system can cause the computing device to provide appropriate emergency notifications that seek to inform the user without providing detailed, directed instructions that risk being misleading. A centralized emergency notification server can initiate the communications on the reserved communication channel and can direct such communications to computing devices affected by the emergency, which can be selected based on network identifiers associated with affected physical regions.