Abstract: Techniques are disclosed for analyzing a scene depicted in an input stream of video frames captured by a video camera. The techniques include receiving data for an object within the scene and determining whether the object has remained substantially stationary within the scene for at least a threshold period. If the object is determined to have remained stationary for at least the threshold period, a rareness score is calculated for the object to indicate a likelihood of the object being stationary to the observed degree at the observed location. The rareness score may use a learning model to take into account previous stationary and/or non-stationary behavior of objects within the scene. In general, the learning model may be updated based on observed stationary and/or non-stationary behaviors of the objects. If the rareness score meets reporting conditions, the stationary object event may be reported.

Abstract: Techniques are disclosed for extracting micro-features at a pixel-level based on characteristics of one or more images. Importantly, the extraction is unsupervised, i.e., performed independent of any training data that defines particularly objects, allowing a behavior-recognition system to forgo a training phase and for object classification to proceed without being constrained by specify object definitions. A micro-feature extractor that does not require training data is adaptive and self-trains while performing the extraction. The extracted micro-features are represented as a micro-feature vector that may be input to a micro-classifier which groups object into object type clusters based on the micro-feature vectors.

Abstract: Techniques are disclosed for creating a background model of a scene using both a pixel based approach and a context based approach. The combined approach provides an effective technique for segmenting scene foreground from background in frames of a video stream. Further, this approach can scale to process large numbers of camera feeds simultaneously, e.g., using parallel processing architectures, while still generating an accurate background model. Further, using both a pixel based approach and context based approach ensures that the video analytics system can effectively and efficiently respond to changes in a scene, without overly increasing computational complexity. In addition, techniques are disclosed for updating the background model, from frame-to-frame, by absorbing foreground pixels into the background model via an absorption window, and dynamically updating background/foreground thresholds.

Abstract: Techniques are disclosed for generating anomaly scores for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating anomaly scores includes receiving a stream of symbols generated from an ordered stream of normalized vectors generated from input data received from one or more sensor devices during a first time period. Upon receiving the stream of symbols, generating a set of words based on an occurrence of groups of symbols from the stream of symbols, determining a number of previous occurrences of a first word of the set of words, determining a number of previous occurrences of words of a same length as the first word, and determining a first anomaly score based on the number of previous occurrences of the first word and the number of previous occurrences of words of the same length as the first word.

Abstract: Embodiments presented herein describe a method for processing streams of data of one or more networked computer systems. According to one embodiment of the present disclosure, an ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network is received. A neuro-linguistic model of the information security data is generated by clustering the ordered stream of vectors and assigning a letter to each cluster, outputting an ordered sequence of letters based on a mapping of the ordered stream of normalized vectors to the clusters, building a dictionary of words from of the ordered output of letters, outputting an ordered stream of words based on the ordered output of letters, and generating a plurality of phrases based on the ordered output of words.

Abstract: Techniques are disclosed for analyzing and learning behaviors based on acquired sensor data. A neuro-linguistic cognitive engine performs learning and analysis on linguistic content (e.g., identified alpha symbols, betas, and gammas) obtained by a linguistic model that clusters observations to generate the linguistic content. The neuro-linguistic cognitive engine compares new data to learned patterns stored in short and longer-term memories and determines whether to issue special event notifications indicating anomalous behavior. In one embodiment, condition(s) may be generated for new data and checked against inference nodes of an inference network. Inference nodes matching the condition(s) are executed to, e.g., compare the new data with the learned patterns, with output from the inference nodes being used to generate additional condition(s) that are again matched to inference nodes which may be executed.

Abstract: Techniques are disclosed for creating a background model of a scene using both a pixel based approach and a context based approach. The combined approach provides an effective technique for segmenting scene foreground from background in frames of a video stream. Further, this approach can scale to process large numbers of camera feeds simultaneously, e.g., using parallel processing architectures, while still generating an accurate background model. Further, using both a pixel based approach and context based approach ensures that the video analytics system can effectively and efficiently respond to changes in a scene, without overly increasing computational complexity. In addition, techniques are disclosed for updating the background model, from frame-to-frame, by absorbing foreground pixels into the background model via an absorption window, and dynamically updating background/foreground thresholds.

Abstract: Techniques are disclosed for processing data collected from network components for analysis by a machine learning engine of a Cognitive AI System. A network data processing driver receives a stream of data from a data collector which obtains data from one or more network data sources. The driver normalizes the stream of data to one or more feature values each corresponding to the network data sources and generates a sample vector from the feature values. The sample vector is formatted to be analyzed by the machine learning engine.

Abstract: Techniques are disclosed to optimize feature selection in generating betas for a feature dictionary of a neuro-linguistic Cognitive AI System. A machine learning engine receives a sample vector of input data to be analyzed by the neuro-linguistic Cognitive AI System. The neuro-linguistic Cognitive AI System is configured to generate multiple betas for each of a plurality of sensors. The machine learning engine identifies a sensor specified in the sample vector and selects optimization parameters for generating betas based on the identified sensor.

Abstract: Techniques are disclosed for generating a low-dimensional representation of an image. An image driver receives an image captured by a camera. The image includes features based on pixel values in the image, and each feature describes the image in one or more image regions. The image driver generates, for each of the plurality of features, a feature vector that includes values for that feature corresponding to at least one of the image regions. Each value indicates a degree that the feature is present in the image region. The image driver generates a sample vector from each of the feature vectors. The sample vector includes each of the values included in the generated feature vectors.

Abstract: Techniques are disclosed for analyzing a scene depicted in an input stream of video frames captured by a video camera. The techniques include receiving data for an object within the scene and determining whether the object has remained substantially stationary within the scene for at least a threshold period. If the object is determined to have remained stationary for at least the threshold period, a rareness score is calculated for the object to indicate a likelihood of the object being stationary to an observed degree at an observed location. The rareness score may use a learning model to take into account previous stationary and/or non-stationary behavior of objects within the scene. In general, the learning model may be updated based on observed stationary and/or non-stationary behaviors of the objects. If the rareness score meets reporting conditions, the stationary object event may be reported.

Abstract: A behavioral recognition system may include both a computer vision engine and a machine learning engine configured to observe and learn patterns of behavior in video data. Certain embodiments may provide image stabilization of a video stream obtained from a camera. An image stabilization module in the behavioral recognition system obtains a reference image from the video stream. The image stabilization module identifies alignment regions within the reference image based on the regions of the image that are dense with features. Upon determining that the tracked features of a current image is out of alignment with the reference image, the image stabilization module uses the most feature dense alignment region to estimate an affine transformation matrix to apply to the entire current image to warp the image into proper alignment.

Abstract: Techniques are disclosed for matching a current background scene of an image received by a surveillance system with a gallery of scene presets that each represent a previously captured background scene. A quadtree decomposition analysis is used to improve the robustness of the matching operation when the scene lighting changes (including portions containing over-saturation/under-saturation) or a portion of the content changes. The current background scene is processed to generate a quadtree decomposition including a plurality of window portions. Each of the window portions is processed to generate a plurality of phase spectra. The phase spectra are then projected onto a corresponding plurality of scene preset image matrices of one or more scene preset. When a match between the current background scene and one of the scene presets is identified, the matched scene preset is updated. Otherwise a new scene preset is created based on the current background scene.

Abstract: Techniques are disclosed for extracting micro-features at a pixel-level based on characteristics of one or more images. Importantly, the extraction is unsupervised, i.e., performed independent of any training data that defines particular objects, allowing a behavior-recognition system to forgo a training phase and for object classification to proceed without being constrained by specific object definitions. A micro-feature extractor that does not require training data is adaptive and self-trains while performing the extraction. The extracted micro-features are represented as a micro-feature vector that may be input to a micro-classifier which groups objects into object type clusters based on the micro-feature vectors.

Abstract: Techniques are disclosed for generating an anomaly score for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating an anomaly score comprises receiving a score indicating how often a characteristic is observed in the input data. Upon receiving the score, comparing the score with an unusual score model to determine an unusualness score and comparing the unusualness score with an anomaly score model based on one or more unusual score models to generate the anomaly score indicating an overall unusualness for the input data.

Abstract: Embodiments presented herein describe a method for processing streams of data of one or more networked computer systems. According to one embodiment of the present disclosure, an ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network is received. A neuro-linguistic model of the information security data is generated by clustering the ordered stream of vectors and assigning a letter to each cluster, outputting an ordered sequence of letters based on a mapping of the ordered stream of normalized vectors to the clusters, building a dictionary of words from of the ordered output of letters, outputting an ordered stream of words based on the ordered output of letters, and generating a plurality of phrases based on the ordered output of words.

Abstract: Techniques are disclosed for processing data collected from network components for analysis by a machine learning engine of a Cognitive AI System. A network data processing driver receives a stream of data from a data collector which obtains data from one or more network data sources. The driver normalizes the stream of data to one or more feature values each corresponding to the network data sources and generates a sample vector from the feature values. The sample vector is formatted to be analyzed by the machine learning engine.

Abstract: Techniques are disclosed for generating logical sensors for an image driver. The image driver monitors values corresponding to at least a first feature in one or more regions of a first image in a stream of images received by a first sensor. The image driver identifies at least a first correlation between at least a first and second value of the monitored values. The image driver generates a logical sensor based on the identified correlations. The logical sensor samples one or more features corresponding to the identified correlation from a second image in the stream of images.

Abstract: Techniques are disclosed which provide a detected object tracker for a video analytics system. As disclosed, the detected object tracker provides a robust foreground object tracking component for a video analytics system which allow other components of the video analytics system to more accurately evaluate the behavior of a given object (as well as to learn to identify different instances or occurrences of the same object) over time. More generally, techniques are disclosed for identifying what pixels of successive video frames depict the same foreground object. Logic implementing certain functions of the detected object tracker can be executed on either a conventional processor (e.g., a CPU) or a hardware acceleration processing device (e.g., a GPU), allowing multiple camera feeds to be evaluated in parallel.

Abstract: Techniques are disclosed for generating an anomaly score for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating an anomaly score comprises receiving a score indicating how often a characteristic is observed in the input data. Upon receiving the score, comparing the score with an unusual score model to determine an unusualness score and comparing the unusualness score with an anomaly score model based on one or more unusual score models to generate the anomaly score indicating an overall unusualness for the input data.