Abstract: Systems and methods for enhanced classification of sequences of objects based on clique similarity and metadata associated with the sequences are presented. Sequences are received. Events are detected based on analyzing k-skip-n-grams included in the sequences. For each event of the detected plurality of events, a graph is generated. The graph for a particular event includes z-cliques that correspond to portions of the k-skip-n-grams that are included in the sequences that are associated with the particular event. A first sequence, which is separate from the other sequences, is received. The first sequence includes a first plurality of k-skip-n-grams. A trained classifier is employed to classify the first sequence as being associated with a first event of the detected events. Classifying the first sequence is based on a comparison between the first plurality of k-skip-n-grams and the z-cliques of the graph that is generated for the first event.

Abstract: Technologies are provided for the monitoring, detection, and notification of emerging, related issues within a system, which may indicate a problem. Within a computing-security system, a sudden increase in the frequency of events associated with unauthorized logon attempts signal a real-time and ongoing security risk. A method monitors system-related events and generates a vector representation for each event based on event features. Clusters of related events are determined, and a state automaton is employed to determine a strength of temporal “bursty” activity for each cluster. Hypothesis testing is performed on each cluster to determine a likelihood that the cluster is a temporally emergent cluster. Clusters with a bursting likelihood above a threshold are determined to be an emergent cluster associated with an anomalous issue. A notification regarding the detected anomaly is provided. A remedial action addressing the anomaly is performed.

Abstract: Technologies are provided for the monitoring, detection, and notification of emerging, related issues within a system, which may indicate a problem. Within a computing-security system, a sudden increase in the frequency of events associated with unauthorized logon attempts signal a real-time and ongoing security risk. A method monitors system-related events and generates a vector representation for each event based on event features. Clusters of related events are determined, and a state automaton is employed to determine a strength of temporal “bursty” activity for each cluster. Hypothesis testing is performed on each cluster to determine a likelihood that the cluster is a temporally emergent cluster. Clusters with a bursting likelihood above a threshold are determined to be an emergent cluster associated with an anomalous issue. A notification regarding the detected anomaly is provided. A remedial action addressing the anomaly is performed.

Abstract: Systems and methods for enhanced classification of sequences of objects based on clique similarity and metadata associated with the sequences are presented. Sequences are received. Events are detected based on analyzing k-skip-n-grams included in the sequences. For each event of the detected plurality of events, a graph is generated. The graph for a particular event includes z-cliques that correspond to portions of the k-skip-n-grams that are included in the sequences that are associated with the particular event. A first sequence, which is separate from the other sequences, is received. The first sequence includes a first plurality of k-skip-n-grams. A trained classifier is employed to classify the first sequence as being associated with a first event of the detected events. Classifying the first sequence is based on a comparison between the first plurality of k-skip-n-grams and the z-cliques of the graph that is generated for the first event.