Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for providing consistent processing in a machine learning system are disclosed. A real-time processing request may be received and processed by both a preferred machine learning model and a fallback machine learning model. Processing for the preferred machine learning model may include obtaining additional information. A determination may be made regarding whether the processing of the real-time request by the preferred machine learning model has completed as of an expiration of an acceptable latency period. If the preferred model has not completed as of the expiration of an acceptable latency period, the response to the real-time request may be generated from the fallback model output. If the preferred model has completed prior to or by the expiration of the acceptable latency period, the response to the request may be generated from the preferred model output.

Abstract: Computer networks are monitored for usage and security purposes. A network intercept device (NID) monitors network traffic such as conversations between source and destination endpoints in the network. Bandwidth usage statistics may be maintained for each monitored endpoint (e.g. by source IP address). Rather than determining statistics for all active conversations during a particular monitoring period, which comprehensive statistics determining may tax NID processing and storage resources, statistics for a “top” number of conversations (N) may be determined. A lossy approach may be used to gather statistics over the period for up to N conversations of each monitored endpoint. When a new conversation commences during the period for which statistics are not being gathered, each of the monitored endpoint's conversations may be decayed. The new conversation is added for statistics gathering, replacing one of the N conversations, when the one conversation has sufficiently decayed to or below a threshold.

Abstract: System and methods for determining network threats are disclosed. For each entity operating in a network being monitored for network security, an example method obtains an observed metric value for each metric that characterizes actions performed by the entity. Each observed metric value may be input into a machine learning model that is specific to the metric in order to determine an anomaly score for the observed metric value that represents how anomalous the observed metric value is relative to an expected metric value for the metric. A threat score may then be determined for each entity from the anomaly scores for each metric. A security threat presentation that identifies one or more high-scoring entities according to the threat scores may be generated and provided for display on a user device.

Abstract: Systems and methods are provided to reset a TCP connection such as in response to a security policy violation. To address reset conditions under RFC 5961, for example, TCP RST segments may be spoofed and injected into communications between endpoints (e.g. client and server). In one example, three segments may be spoofed with two having respective predicted sequence numbers to invoke a reset and the third having a sequence number to invoke a challenge ACK. If a challenge ACK is received, one or more additional TCP RST segments may be injected using segment information from the challenge ACK to predict new sequence numbers, one to invoke a reset and the other, if used, to invoke a further challenge ACK. Further responsive pairs of additional TCP RST segments may be sent in response to any further challenge ACK observed until the reset is successful.