Abstract: Systems and method of diarization of audio files use an acoustic voiceprint model. A plurality of audio files are analyzed to arrive at an acoustic voiceprint model associated to an identified speaker. Metadata associate with an audio file is used to select an acoustic voiceprint model. The selected acoustic voiceprint model is applied in a diarization to identify audio data of the identified speaker.

Abstract: By formulizing a specific company's internal knowledge and terminology, the ontology programming accounts for linguistic meaning to surface relevant and important content for analysis. The ontology is built on the premise that meaningful terms are detected in the corpus and then classified according to specific semantic concepts, or entities. Once the main terms are defined, direct relations or linkages can be formed between these terms and their associated entities. Then, the relations are grouped into themes, which are groups or abstracts that contain synonymous relations. The disclosed ontology programming adapts to the language used in a specific domain, including linguistic patterns and properties, such as word order, relationships between terms, and syntactical variations. The ontology programming automatically trains itself to understand the domain or environment of the communication data by processing and analyzing a defined corpus of communication data.

Abstract: Systems and method of diarization of audio files use an acoustic voiceprint model. A plurality of audio files are analyzed to arrive at an acoustic voiceprint model associated to an identified speaker. Metadata associate with an audio file is used to select an acoustic voiceprint model. The selected acoustic voiceprint model is applied in a diarization to identify audio data of the identified speaker.

Abstract: Systems and methods of script identification in audio data obtained from audio data. The audio data is segmented into a plurality of utterances. A script model representative of a script text is obtained. The plurality of utterances are decoded with the script model. A determination is made if the script text occurred in the audio data.

Abstract: A packet broker that performs a health-status check of a proxy server while the proxy server processes one or more proxy connections. The packet broker may attempt to exchange a heartbeat signal with the proxy server, and if unsuccessful, the proxy server is assumed to be failing. In such cases, a failover is desirable. Rather than implementing a “hard” failover, in which no further communication packets are directed to the proxy server, a “soft” failover is performed where the packet broker prevents new proxy connections from being processed by the proxy server, but maintains at least one (e.g., all) of the current proxy connections that are being processed by the proxy server.

Abstract: Methods and systems to identify the domain names that can potentially be used for delivering instructions to a bot, before bots on a computer network succeed in obtaining the instructions. The system maintains a device rating for each device that reflects a likelihood that the device is infected by malware. The system also maintains a domain-name rating for each device that reflects a likelihood that the domain name is malicious. When a device attempts to access a particular domain name, the domain-name rating of the domain name is updated in light of the device rating of the device, and/or update the device rating of the device in light of the domain-name rating.

Abstract: An apparatus for monitoring a plurality of devices that use a plurality of networks includes a network interface and a processor. The processor is configured to receive, via the network interface, a plurality of packets that were collectively communicated, from the devices, via all of the networks, to aggregate the packets, using at least one field that is included in respective packet headers of the packets, into a plurality of packet aggregations, such that all of the packets in each one of the packet aggregations were collectively communicated from no more than one of the devices, to group the packet aggregations into a plurality of groups, such that there is a one-to-one correspondence between the groups and the devices, in that all of the packets in each of the groups were collectively communicated from a different respective one of the devices, and to generate an output in response thereto.

Abstract: Web pages may be rendered from a main page data element and a plurality of embedded data elements, which are separately fetched by a browser. Herein is provided a web decoder which includes a learning engine adapted to receive human indications of data elements which are unimportant and accordingly to adjust the web decoder's procedures for determining which data elements are displayed to the user. The learning engine may receive human indications of important data elements and uses both types of indications in its further determinations. Optionally, rule generalizations are performed in a manner which searches for parameters which differentiate between important and unimportant data elements. The rule generalizations optionally concentrate on groups of data elements having at least a predetermined number of parameters having the same values for both important and unimportant data elements, reducing the chances that a generalization rule will find important data elements as unimportant.

Abstract: Methods and systems for creating demographic profiles of mobile communication network users. A demographic classification system analyzes network traffic, so as to estimate the specific combination of application classes installed on a given terminal, and usage patterns of the applications over time. This combination of application classes and their respective usage patterns are a highly personalized choice made by the user, and is therefore used by the system to deduce the user's demographic profile. The demographic classification system operates on monitored network traffic, as opposed to obtaining explicit and accurate information regarding the installed applications from the terminal. The system then deduces the demographic profile of the user from the list of estimated application classes.

Abstract: A video system for video surveillance or video monitoring includes a video source, a video control system, and a video management system. The video management system is configured to receive configuration data and generate maps based on the configuration data, wherein at least one of the maps is associated with the video source. The video management system displays the map associated with the video source and displays a graphical symbol on the map which indicates the location of the video source. The video management system then receives a selection of the video source, receives information associated with the selected video source, and displays the received information.

Abstract: An apparatus and techniques for constructing and utilizing a “dynamic dictionary” that is not a compiled dictionary, and therefore does not need to be recompiled in order to be updated. The dynamic dictionary includes respective data structures that represent (i) a management automaton that includes a plurality of management nodes, and (ii) a runtime automaton that is derived from the management automaton and includes a plurality of runtime nodes. The runtime automaton may be used to search input data, such as communication traffic over a network, for keywords of interest, while the management automaton manages the addition of keywords to the dynamic dictionary. Typically, at least two (e.g., exactly two) such dynamic dictionaries are used in combination with a static dictionary.

Abstract: A monitoring system that receives messages that are exchanged with the application server. Relationships between users are posited in response to the times at which the messages are received. A relationship between two users may be posited in response to receiving, at approximately the same time, two messages from the application server that are destined, respectively, for the two users. The near-simultaneous receipt of the two messages indicates that the two messages were sent from the server at approximately the same time, which, in turn, indicates that the two messages may correlate with one another. Further indication of a correlation between the messages, which may increase the level of confidence with which the relationship between the two users is posited, may be found by examining the respective sizes of the messages, which indicate the message types.

Abstract: A video system for video surveillance or video monitoring includes a video source, a video control system, and a video management system. The video management system is configured to receive configuration data and generate maps based on the configuration data, wherein at least one of the maps is associated with the video source. The video management system displays the map associated with the video source and displays a graphical symbol on the map which indicates the location of the video source. The video management system then receives a selection of the video source, receives information associated with the selected video source, and displays the received information.

Abstract: A subject can be tracking using a plurality of physical video monitoring or image acquisition devices deployed in a delimited area. A map represents the delimited area. Icons representing the physical monitoring devices can be placed and configured on the map representing the delimited area. Some or all of the placed and configured video monitoring devices can be logically linked together to form scenes. The video feed from the physical video monitoring devices may be recorded in stable storage. A layout for display of the video feeds may be selected. Upon playing the video feed, whether live or recorded, a subject can be tracked through the delimited area by selecting one of the video monitoring devices in one of the available scenes.

Abstract: A subject can be tracking using a plurality of physical video monitoring or image acquisition devices deployed in a delimited area. A map represents the delimited area. Icons representing the physical monitoring devices can be placed and configured on the map representing the delimited area. Some or all of the placed and configured video monitoring devices can be logically linked together to form scenes. The video feed from the physical video monitoring devices may be recorded in stable storage. A layout for display of the video feeds may be selected. Upon playing the video feed, whether live or recorded, a subject can be tracked through the delimited area by selecting one of the video monitoring devices in one of the available scenes.

Abstract: A subject can be tracking using a plurality of physical video monitoring or image acquisition devices deployed in a delimited area. A map represents the delimited area. Icons representing the physical monitoring devices can be placed and configured on the map representing the delimited area. Some or all of the placed and configured video monitoring devices can be logically linked together to form scenes. The video feed from the physical video monitoring devices may be recorded in stable storage. A layout for display of the video feeds may be selected. Upon playing the video feed, whether live or recorded, a subject can be tracked through the delimited area by selecting one of the video monitoring devices in one of the available scenes.

Abstract: Embodiments described herein facilitate receipt of image data, by providing apparatus and methods for constructing and/or utilizing a database of networked imaging devices. Communication transmitted over a network is identified as being from an imaging device. One or more identifiers, under which the communication is transmitted, are then extracted from the communication. For example, one or more Internet Protocol (IP) addresses may be extracted. The identifiers are associated in a database with respective physical locations. When a particular area is defined as an area of interest, at least one of the identifiers is selected from the database, the selected identifier being associated with a physical location that is within, or near, the area of interest. Image data transmitted under the selected identifier is then received by the interested parties.

Abstract: Methods and systems for clustering objects using Geohash grids. The clusters are typically displayed on an interactive map. A clustering module receives multiple objects having respective geo-information and derives clusters for the objects in respective grid cells of a given resolution level. The clustering is based on the geo-information of the objects at one or more resolution levels that are finer than the given resolution level. Clustering based on finer-resolution levels provides spatial information at a granularity that is unavailable at the given resolution level and therefore achieves clustering with improved accuracy. The geo-information may comprise a Geohash spatial index that specifies the geographic location in accordance with the Geohash system.

Abstract: Methods and systems for decoding communication protocols having an unknown structure. In the disclosed embodiments, a decoding system analyzes network traffic that uses such a communication protocol, and semi-automatically generates a structured template for decoding the protocol. In an example embodiment, the traffic comprises HTTP transactions used in some unknown variant of a Web-based e-mail or social network application, and the system generates an Extensible Markup Language (XML) template for parsing such transactions. The system enables an analyst to review sample transactions, and identify target components of the protocol that contain target information of interest. The system typically generates a set of rules with the assistance of the analyst.

Abstract: Malware detection techniques that detect malware by identifying the C&C communication between the malware and the remote host, and distinguish between communication transactions that carry C&C communication and transactions of innocent traffic. The system distinguishes between malware transactions and innocent transactions using malware identification models, which it adapts using machine learning algorithms. However, the number and variety of malicious transactions that can be obtained from the protected network are often too limited for effectively training the machine learning algorithms. Therefore, the system obtains additional malicious transactions from another computer network that is known to be relatively rich in malicious activity. The system is thus able to adapt the malware identification models based on a large number of positive examples—The malicious transactions obtained from both the protected network and the infected network.