Abstract: A surveillance system and methods are disclosed. The system of the invention includes computing means connected to memory means, input means and a plurality of sensors, such as video camera and plurality of display screens. The system is adapted to compute for the sensors a 3D coverage space which considers terrain data and man-made objects and specific features of the sensors such as the 3D location and the pan, tilt and zoom (PTZ) of the camera and to establish a data base indicative of the coverage area. The system and method of the invention are also adapted to support tracking of an object within the coverage space of the sensors, either in automatic or manual mode and to provide a user of the system with data indicative of sensors into the coverage space of which a tracked object is about to enter.

Abstract: A method executed by a computer system for detecting edges comprises receiving an image comprising a plurality of pixels, determining a phase congruency value for a pixel, where the phase congruency value comprises a plurality of phase congruency components, and determining if the phase congruency value satisfies a phase congruency criteria. If the phase congruency value satisfies the phase congruency criteria, the computer system categorizes the pixel as an edge pixel. If the phase congruency value does not satisfy the phase congruency criteria, the computer system compares a first phase congruency component of the plurality of phase congruency components to a phase congruency component criteria. If the first phase congruency component satisfies the phase congruency component criteria, the computer system categorizes the pixel as an edge pixel, and if the first phase congruency component does not satisfy the phase congruency component criteria, categorizes the pixel as a non-edge pixel.

Abstract: People are counted in a segment of video with a video processing system that is configured with a first set of parameters. This produces a first output. Based on this first output, a second set of parameters is chosen. People are then counted in the segment of video using the second set of parameters. This produces a second output. People are counted with a video played forward. People are counted with a video played backwards. The results of these two counts are reconciled to produce a more accurate people count.

Abstract: Methods and systems for filtering communication packets using a multi-stage filtering system that receives a large volume of communication packets from a communication network that filters the packets in two or more successive stages. The system comprises at least one front-end filtering unit and multiple back-end filtering units. Typically although not necessarily, the front-end filtering unit filters the packets based on layer-2 to layer-4 attributes of the packets. The back-end filtering units, on the other hand, filter the packets based on content extracted from the packet payloads. The back-end filtering units may perform filtering, for example, based on keyword spotting, application classification, malware detection and other content-related criteria. The front-end filtering unit typically performs filtering at the individual packet level and/or at the level of request-response transactions.

Abstract: Methods and systems for obtaining reconstructing activities of target users in social networks, such as for decoding and displaying social network sessions held by a target user, or identifying other users who are associated with the target user. This analysis is typically carried out based on passive monitoring of network traffic. A social network decoding system constructs and maintains a replica database, which mimics a portion of the user profile database maintained by the social network servers. The social network decoding system monitors network traffic between users and social network servers. Based on the monitored traffic, the system gradually constructs a replica database that attempts to replicate a portion of the social network user profile database, relating to one or more predefined target users. Using the replica database, the system is able to correlate loosely-coupled information objects, events and interactions between the target users and social network pages.

Abstract: A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.

Abstract: Methods and systems for analyzing network traffic. An analysis system receives network traffic, which complies with a certain protocol. The received network traffic carries a data item, which may be of value to an analyst. In order to access the data item in question, the analysis system automatically identifies the media type of the data item, by processing the network traffic irrespective of the protocol. The analysis system identifies the media type irrespective of the protocol in order to avoid the computational complexity involved in decoding the protocol.

Abstract: The system and method of separating speakers in an audio file including obtaining an audio file. The audio file is transcribed into at least one text file by a transcription server. Homogenous speech segments are identified within the at least one text file. The audio file is segmented into homogenous audio segments that correspond to the identified homogenous speech segments. The homogenous audio segments of the audio file are separated into a first speaker audio file and second speaker audio file the first speaker audio file and the second speaker audio file are transcribed to produce a diarized transcript.

Abstract: A system, method, and software for mobile video display and management includes acquiring a plurality of streams of video data from a plurality of cameras. The plurality of streams of video data are stored and plurality of selected streams of video data that includes at least one stream of recorded video data and at least one stream of live video data are presented in a graphical user interface of a remote device.

Abstract: Methods and systems for identifying network users who communicate with the network (e.g., the Internet) via a given network connection. The disclosed techniques analyze traffic that flows in the network to determine, for example, whether the given network connection serves a single individual or multiple individuals, a single computer or multiple computers. A Profiling System (PS) acquires copies of data traffic that flow through network connections that connect computers to the WAN. The PS analyzes the acquired data, attempting to identify individuals who login to servers.

Abstract: A security method that includes defining rules specifying permitted movements of passengers in a transportation terminal. Passengers entering the terminal may be issued a boarding pass having a Radio Frequency Identification (RFID) tag attached thereto. The location of the RFID tag may be measured and responsive to the measured location of the RFID tag, a violation of at least one of the rules by the passenger may be detected. An action with respect to the detected violation may be taken. The rules may define a region that is forbidden for access, a region in which the passengers are expected to be in motion, a region in which the passengers are expected not to be stationary for more than a given time period, etc.

Abstract: A method executed by a computer system for detecting edges comprises receiving an image comprising a plurality of pixels, determining a phase congruency value for a pixel, where the phase congruency value comprises a plurality of phase congruency components, and determining if the phase congruency value satisfies a phase congruency criteria. If the phase congruency value satisfies the phase congruency criteria, the computer system categorizes the pixel as an edge pixel. If the phase congruency value does not satisfy the phase congruency criteria, the computer system compares a first phase congruency component of the plurality of phase congruency components to a phase congruency component criteria. If the first phase congruency component satisfies the phase congruency component criteria, the computer system categorizes the pixel as an edge pixel, and if the first phase congruency component does not satisfy the phase congruency component criteria, categorizes the pixel as a non-edge pixel.

Abstract: Methods and systems for monitoring communication of mobile communication terminals, such as cellular phones. An off-air monitoring system reconstructs both directions of a call conducted between two mobile terminals by receiving only downlink channels. The off-air monitoring system receives multiple downlink transmissions transmitted by base stations in a wireless communication network. The system uses the received downlink transmissions to reconstruct the bidirectional call content of calls conducted between wireless terminals. In order to reconstruct the bidirectional content of a given call, the system identifies and correlates the two downlink transmissions of that call from among the multiple received downlink transmissions.

Abstract: A subject can be tracking using a plurality of physical video monitoring or image acquisition devices deployed in a delimited area. A map represents the delimited area. Icons representing the physical monitoring devices can be placed and configured on the map representing the delimited area. Some or all of the placed and configured video monitoring devices can be logically linked together to form scenes. The video feed from the physical video monitoring devices may be recorded in stable storage. A layout for display of the video feeds may be selected. Upon playing the video feed, whether live or recorded, a subject can be tracked through the delimited area by selecting one of the video monitoring devices in one of the available scenes.

Abstract: Embodiments that are described herein provide improved methods and systems for predicting threatened POIs. In some embodiments, an automated location tracking system tracks the locations of one or more target individuals. The locations of the target individuals may be tracked, for example, by tracking the cellular phones of the targets, or using various other automated location tracking techniques. Based on the tracked locations, a prediction system anticipates the future locations of the targets. Over time, the system uses this information to progressively narrow down the list of possibly-threatened POIs.

Abstract: Methods and systems for protecting computer systems against intrusion. The disclosed techniques detect intrusions by jointly considering both cyber security events and physical security events. In some embodiments, a correlation subsystem receives information related to the computer system and its physical environment from various information sources in the cyber domain and in the physical domain. The correlation subsystem analyzes the information and identifies both cyber security events and physical security events. The correlation subsystem finds cyber security events and physical security events that are correlative with one another, and uses this correlation to detect intrusions.

Abstract: Methods and systems for identifying one or more rogue devices within a wireless communication network over a particular geographic location. A rogue base station detection system receives air interface transmissions from base stations belonging to a wireless communication network, as well as from one or more rogue base stations that do not belong to the network and are used for monitoring (e.g., hacking or eavesdropping) communication terminals communicating in the network. The system typically searches for signaling channels and converts the RF signal into GSM/UMTS messages including overcoming the different encryption methods used. The system than analyzes the received transmissions so as to identify suspicious transmissions that may be transmitted by the rogue base stations.

Abstract: Systems and methods for malware detection techniques, which detect malware by identifying the C&C communication between the malware and the remote host. In particular, the disclosed techniques distinguish between request-response transactions that carry C&C communication and request-response transactions of innocent traffic. Individual request-response transactions may be analyzed rather than entire flows, and fine-granularity features examined within the transactions. As such, these methods and systems are highly effective in distinguishing between malware C&C communication and innocent traffic, i.e., in detecting malware with high detection probability and few false alarms.

Abstract: A method for extracting line segments from an edge image comprises receiving a digital image comprising a plurality of edge pixels, and processing the plurality of edge pixels using a breadth first search to determine a plurality of breadth first search pixels in a breadth first search order for a connected component. The connected component comprises a plurality of components. The method continues by processing the plurality of breadth first search pixels in an order related to the breadth first search order to determine a plurality of component pixels for at least one component of the plurality of components. Each of the plurality of components comprises a line segment. The method concludes by processing the plurality of component pixels to determine a plurality of line segment pixels for the line segment.

Abstract: A subject can be tracking using a plurality of physical video monitoring or image acquisition devices deployed in a delimited area. A map represents the delimited area. Icons representing the physical monitoring devices can be placed and configured on the map representing the delimited area. Some or all of the placed and configured video monitoring devices can be logically linked together to form scenes. The video feed from the physical video monitoring devices may be recorded in stable storage. A layout for display of the video feeds may be selected. Upon playing the video feed, whether live or recorded, a subject can be tracked through the delimited area by selecting one of the video monitoring devices in one of the available scenes.