Abstract: A method for identifying a threatening network comprises an asymmetric threat signature (AT-SIG) algorithm comprising a network movement before/after algorithm that provides a graphical plot of changes in network transaction activity from before to after a specified time and further comprising one or more of: a network progression algorithm that provides a graphical plot to analyze behavior in small increments of time without specification or emphasis upon a particular time or event; a statistical network anomaly ranking algorithm that provides as output a ranked list of the networks; and an anomaly trend graphs algorithm that analyzes and visualizes the networks' anomaly scores over time. Also disclosed are an AT-SIG system and a software program product.

Abstract: A system and method for identifying a threatening network is provided. The system comprises a network movement before/after algorithm that provides a graphical plot of changes in networks' communications activity from before to after a key event occurs, so that an analyst is able to identify anomalous behavior; a network progression algorithm that provides a graphical plot to analyze behavior in small increments of time without specification or emphasis upon a particular event, so that the analyst is able to see a trend in behavioral changes; a statistical network anomaly ranking algorithm that provides as output a ranked list of the networks; and an anomaly trend graphs algorithm that analyzes and visualizes the networks' anomaly scores over time, so that the analyst is able to see which networks are consistently suspicious, which networks accumulate more suspiciousness in response to an event, and which networks are trending toward more suspiciousness.

Abstract: A system and method for identifying a threatening network is provided. The system comprises a network movement before/after algorithm that provides a graphical plot of changes in networks' communications activity from before to after a key event occurs, so that an analyst is able to identify anomalous behavior; a network progression algorithm that provides a graphical plot to analyze behavior in small increments of time without specification or emphasis upon a particular event, so that the analyst is able to see a trend in behavioral changes; a statistical network anomaly ranking algorithm that provides as output a ranked list of the networks; and an anomaly trend graphs algorithm that analyzes and visualizes the networks' anomaly scores over time, so that the analyst is able to see which networks are consistently suspicious, which networks accumulate more suspiciousness in response to an event, and which networks are trending toward more suspiciousness.

Abstract: A method, system and apparatus are shown for identifying non-language speech sounds in a speech or audio signal. An audio signal is segmented and feature vectors are extracted from the segments of the audio signal. The segment is classified using a hidden Markov model (HMM) that has been trained on sequences of these feature vectors. Post-processing components can be utilized to enhance classification. An embodiment is described in which the hidden Markov model is used to classify a segment as a language speech sound or one of a variety of non-language speech sounds. Another embodiment is described in which the hidden Markov model is trained using discriminative learning.

Abstract: A stochastic method and system for fast stereoscopic ranging includes selecting a pair of images for stereo processing, in which the pair of images are a frame pair and one of the image is a reference frame, seeding estimated values for a range metric at each pixel of the reference frame, initializing one or more search stage constraints, stochastically computing local influence for each valid pixel in the reference frame, aggregating local influences for each valid pixel in the reference frame, refining the estimated values for the range metric at each valid pixel in the reference frame based on the aggregated local influence, and post-processing range metric data. A valid pixel is a pixel in the reference frame that has a corresponding pixel in the other frame of the frame pair. The method repeats n iterations of the stochastically computing through the post-processing.

Abstract: Disclosed is a method for fusing interaction data, such as intelligence data, comprising, embodying collections of interaction data from different interaction data sources in interaction graphs, defining a plurality of mappings of identifiers to entities, associating each mapping with a fused interaction graph, and identifying an optimal mapping by evaluation of compatibility of identifier attributes, mutual information across interaction data sources, and/or fit with one or more behavior models. Edges in the fused graph can be collapsed. Also claimed are a computer system and a computer-readable medium for fusing interaction data.

Abstract: A stochastic method and system for fast stereoscopic ranging includes selecting a pair of images for stereo processing, in which the pair of images are a frame pair and one of the image is a reference frame, seeding estimated values for a range metric at each pixel of the reference frame, initializing one or more search stage constraints, stochastically computing local influence for each valid pixel in the reference frame, aggregating local influences for each valid pixel in the reference frame, refining the estimated values for the range metric at each valid pixel in the reference frame based on the aggregated local influence, and post-processing range metric data. A valid pixel is a pixel in the reference frame that has a corresponding pixel in the other frame of the frame pair. The method repeats n iterations of the stochastically computing through the post-processing.

Abstract: Described herein are tracking algorithm modifications to handle occlusions when processing a video stream including multiple image frames. Specifically, system and methods for handling both partial and full occlusions while tracking moving and non-moving targets are described. The occlusion handling embodiments described herein may be appropriate for a visual tracking system with supplementary range information.

Abstract: An embodiment of the system and method for optimizing pattern query searches on a graph database uses a pattern query optimizer to optimize execution of the search plan for any sequence of SQL expressions by separating or breaking a pattern query into multiple subpattern queries before converting the subpattern queries into SQL expressions. An embodiment of the pattern query optimizer algorithmically, without intervention by an analyst, decomposes any pattern query into a set of subpattern queries by first identifying branches and cycles within a pattern query and then decomposing each identified branch and cycle into equivalent straight line paths, i.e., straight line nodes joined by edges. Cardinality may be used to improve the performance of pattern searches.

Abstract: A stochastic method and system for fast stereoscopic ranging includes selecting a pair of images for stereo processing, in which the pair of images are a frame pair and one of the image is a reference frame, seeding estimated values for a range metric at each pixel of the reference frame, initializing one or more search stage constraints, stochastically computing local influence for each valid pixel in the reference frame, aggregating local influences for each valid pixel in the reference frame, refining the estimated values for the range metric at each valid pixel in the reference frame based on the aggregated local influence, and post-processing range metric data. A valid pixel is a pixel in the reference frame that has a corresponding pixel in the other frame of the frame pair. The method repeats n iterations of the stochastically computing through the post-processing.

Abstract: An embodiment of the system and method for optimizing pattern query searches on a graph database uses a pattern query optimizer to optimize execution of the search plan for any sequence of SQL expressions by separating or breaking a pattern query into multiple subpattern queries before converting the subpattern queries into SQL expressions. An embodiment of the pattern query optimizer algorithmically, without intervention by an analyst, decomposes any pattern query into a set of subpattern queries by first identifying branches and cycles within a pattern query and then decomposing each identified branch and cycle into equivalent straight line paths, i.e., straight line nodes joined by edges. Cardinality may be used to improve the performance of pattern searches.

Abstract: Embodiments of a system and method are disclosed to provide impact modeling and prediction of attacks on cyber targets (IMPACT). An embodiment of the system and method creates a network model to describe the IT resources of an organization, creates a business model to describe the origination's mission, and creates a correlation model that correlates the network model and the business model to describe how the origination's mission relies on the IT resources. Proper analysis may show which cyber resources are of tactical importance in a cyber attack. Such analysis also reveals which IT resources contribute most to the organization's mission. These results may then be used to formulate IT security strategies and explore their trade-offs, which leads to better incident response.

Abstract: A method and system for solving an optimization problem comprising a plurality of dynamic constraints. A genetic algorithm is used to iteratively generate potential solutions to the problem. A constraint graph is used to model the plurality of dynamic constraints, and any potential solution that does not correspond to a connected subgraph of the constraint graph is infeasible and discarded. Real-time changes in dynamic constraints are incorporated by modification of the constraint graph between iterations of the genetic algorithm. An exemplary embodiment comprising the scheduling of air missions is presented.

Abstract: Observable data points are collected and organized into a link-oriented data set comprising nodes and links. Information is abstracted for use in link analysis by generating links between the collected data points, including deriving links and inducing links. A link can be induced by linking together a pair of nodes that satisfy a distance function. Exemplary distance functions that can be used to induce links include geo spatial proximity, attribute nearness, and name similarity. Paths can be identified between selected nodes of interest through a dataset operation, and nodes and/or links can be selectively included or excluded from the data set operation. The dataset can be augmented with pedigree information or one or more association nodes. Link information, including a trajectory and a connected path that selectively produces or excludes one or more intermediate nodes, can be displayed and/or produced in a specified format.

Abstract: A method, system and apparatus are shown for identifying non-language speech sounds in a speech or audio signal. An audio signal is segmented and feature vectors are extracted from the segments of the audio signal. The segment is classified using a hidden Markov model (HMM) that has been trained on sequences of these feature vectors. Post-processing components can be utilized to enhance classification. An embodiment is described in which the hidden Markov model is used to classify a segment as a language speech sound or one of a variety of non-language speech sounds. Another embodiment is described in which the hidden Markov model is trained using discriminative learning.