Abstract: A subject can be tracking using a plurality of physical video monitoring or image acquisition devices deployed in a delimited area. A map represents the delimited area. Icons representing the physical monitoring devices can be placed and configured on the map representing the delimited area. Some or all of the placed and configured video monitoring devices can be logically linked together to form scenes. The video feed from the physical video monitoring devices may be recorded in stable storage. A layout for display of the video feeds may be selected. Upon playing the video feed, whether live or recorded, a subject can be tracked through the delimited area by selecting one of the video monitoring devices in one of the available scenes.

Abstract: Embodiments described herein facilitate receipt of image data, by providing apparatus and methods for constructing and/or utilizing a database of networked imaging devices. Communication transmitted over a network is identified as being from an imaging device. One or more identifiers, under which the communication is transmitted, are then extracted from the communication. For example, one or more Internet Protocol (IP) addresses may be extracted. The identifiers are associated in a database with respective physical locations. When a particular area is defined as an area of interest, at least one of the identifiers is selected from the database, the selected identifier being associated with a physical location that is within, or near, the area of interest. Image data transmitted under the selected identifier is then received by the interested parties.

Abstract: Methods and systems for clustering objects using Geohash grids. The clusters are typically displayed on an interactive map. A clustering module receives multiple objects having respective geo-information and derives clusters for the objects in respective grid cells of a given resolution level. The clustering is based on the geo-information of the objects at one or more resolution levels that are finer than the given resolution level. Clustering based on finer-resolution levels provides spatial information at a granularity that is unavailable at the given resolution level and therefore achieves clustering with improved accuracy. The geo-information may comprise a Geohash spatial index that specifies the geographic location in accordance with the Geohash system.

Abstract: Methods and systems for decoding communication protocols having an unknown structure. In the disclosed embodiments, a decoding system analyzes network traffic that uses such a communication protocol, and semi-automatically generates a structured template for decoding the protocol. In an example embodiment, the traffic comprises HTTP transactions used in some unknown variant of a Web-based e-mail or social network application, and the system generates an Extensible Markup Language (XML) template for parsing such transactions. The system enables an analyst to review sample transactions, and identify target components of the protocol that contain target information of interest. The system typically generates a set of rules with the assistance of the analyst.

Abstract: Malware detection techniques that detect malware by identifying the C&C communication between the malware and the remote host, and distinguish between communication transactions that carry C&C communication and transactions of innocent traffic. The system distinguishes between malware transactions and innocent transactions using malware identification models, which it adapts using machine learning algorithms. However, the number and variety of malicious transactions that can be obtained from the protected network are often too limited for effectively training the machine learning algorithms. Therefore, the system obtains additional malicious transactions from another computer network that is known to be relatively rich in malicious activity. The system is thus able to adapt the malware identification models based on a large number of positive examples—The malicious transactions obtained from both the protected network and the infected network.

Abstract: A method for expanding an initial ontology via processing of communication data, wherein the initial ontology is a structural representation of language elements comprising a set of entities, a set of terms, a set of term-entity associations, a set of entity-association rules, a set of abstract relations, and a set of relation instances. A method for extracting a set of significant phrases and a set of significant phrase co-occurrences from an input set of documents further includes utilizing the terms to identify relations within the training set of communication data, wherein a relation is a pair of terms that appear in proximity to one another.

Abstract: Methods and systems for monitoring communication traffic in communication networks, such as Internet Protocol (IP) traffic transferred over the Internet or over a wireless network. The disclosed techniques identify communication traffic that is associated with target individuals, by extracting digital images from the traffic and recognizing target individuals who appear in the images. A correlation system monitors communication sessions that are conducted in a communication network to identify known target individuals who appear in images. Upon recognizing a target individual in an image extracted from a certain session, the system correlates this target user with one or more of the communication identifiers used in the session. The system automatically identifies IP addresses or other identifiers that are used by target individuals, and enable subsequent tracking of such identifiers.

Abstract: Systems and methods to track the respective locations of subjects over time. The system identifies subjects who, over time, were co-located with one another suggesting they are associated with one another, and the pairs are analyzed. For each of the subjects, the system produces a vector that quantifies the subject's location history by including a respective weight for each combination of a time interval with a geographical area. The vectors are compared using a distance metric, and any pair of subjects whose vectors are sufficiently close are flagged as being an associated pair. The respective vector belonging to each subject is normalized to account for the total number of other subjects who were co-located with the subject. For each interval-area pair, the system may compute the frequency of the interval-area pair, and then divide each weight that corresponds to the interval-area pair by the frequency of the interval-area pair.

Abstract: A traffic-monitoring system that monitors encrypted traffic exchanged between IP addresses used by devices and a network, and further receives the user-action details that are passed over the network. By correlating between the times at which the encrypted traffic is exchanged and the times at which the user-action details are received, the system associates the user-action details with the IP addresses. In particular, for each action specified in the user-action details, the system identifies one or more IP addresses that may be the source of the action. Based on the IP addresses, the system may identify one or more users who may have performed the action. The system may correlate between the respective action-times of the encrypted actions and the respective approximate action-times of the indicated actions. The system may hypothesize that the indicated action may correspond to one of the encrypted actions having these action-times.

Abstract: Systems and methods for monitoring voice and SMS communication exchanged over a UMTS network is described wherein a technique for quickly testing different Count-C values, until the correct value is ascertained is used. The Count-C parameter consists of a HyperFrame Number (HFN) and the system iteratively attempts to decrypt the packets using a series of candidate HFNs. For each of these candidate HFNs, and for each of the packets, the system produces a candidate Count-C by appending the sequence number (SN). The system then uses the candidate Count-C to calculate a candidate keystream block. Subsequently, the system uses the candidate keystream blocks to decrypt the packets, and then tests whether the packets were correctly decrypted. If the system deems the decryption successful, the system stops iterating through the candidate HFNs, and uses the candidate HFN that correctly decrypted the packets to decrypt subsequent packets in the communication session.

Abstract: Systems and methods search video data for objects that satisfy a general object description. A database is populated with identified objects and object characteristics detected in video data with at least one identifier that specifies video image data. At least one search parameter is received that presents a general object description. The database is queried based upon the received at least one search parameter. At least one identifier is returned from the database based upon the at least one search parameter.

Abstract: A monitoring system that receives messages that are exchanged with the application server. Relationships between users are posited in response to the times at which the messages are received. A relationship between two users may be posited in response to receiving, at approximately the same time, two messages from the application server that are destined, respectively, for the two users. The near-simultaneous receipt of the two messages indicates that the two messages were sent from the server at approximately the same time, which, in turn, indicates that the two messages may correlate with one another. Further indication of a correlation between the messages, which may increase the level of confidence with which the relationship between the two users is posited, may be found by examining the respective sizes of the messages, which indicate the message types.

Abstract: Systems and methods for passive monitoring of computer communication that does not require performing any decryption. A monitoring system receives the traffic exchanged with each relevant application server, and identifies, in the traffic, sequences of messages—or “n-grams”—that appear to belong to a communication session between a pair of users. Subsequently, based on the numbers and types of identified n-grams, the system identifies each pair of users that are likely to be related to one another via the application, in that these users used the application to communicate (actively and/or passively) with one another. The system may identify those sequences of messages that, by virtue of the sizes of the messages in the sequence, and/or other properties of the messages that are readily discernable, indicate a possible user-pair relationship.

Abstract: A location-tracking system that includes multiple detector units that are deployed in a region of interest. The detector units receive uplink signals from wireless terminals that are active in the region, and measure the strengths of the received uplink signals. The system computes the locations of the terminals based on the measured signal strengths and the known locations of the detector units. The location-tracking system receives and analyzes downlink signals from one or more of the base stations of the wireless network. The detector unit uses the downlink signal to recover and synchronize to the timing of the wireless network's air-interface. Based on the extracted uplink allocations, and having synchronized with the air-interface, the system is able to distinguish between the uplink signal components originating from each terminal, and thus compute the location of each terminal.

Abstract: Systems and methods of diarization using linguistic labeling include receiving a set of diarized textual transcripts. A least one heuristic is automatedly applied to the diarized textual transcripts to select transcripts likely to be associated with an identified group of speakers. The selected transcripts are analyzed to create at least one linguistic model. The linguistic model is applied to transcripted audio data to label a portion of the transcripted audio data as having been spoken by the identified group of speakers. Still further embodiments of diarization using linguistic labeling may serve to label agent speech and customer speech in a recorded and transcripted customer service interaction.

Abstract: Systems and methods of diarization using linguistic labeling include receiving a set of diarized textual transcripts. A least one heuristic is automatedly applied to the diarized textual transcripts to select transcripts likely to be associated with an identified group of speakers. The selected transcripts are analyzed to create at least one linguistic model. The linguistic model is applied to transcripted audio data to label a portion of the transcripted audio data as having been spoken by the identified group of speakers. Still further embodiments of diarization using linguistic labeling may serve to label agent speech and customer speech in a recorded and transcripted customer service interaction.

Abstract: A video system for video surveillance or video monitoring includes a video source, a video control system, and a video management system. The video management system is configured to receive configuration data and generate maps based on the configuration data, wherein at least one of the maps is associated with the video source. The video management system displays the map associated with the video source and displays a graphical symbol on the map which indicates the location of the video source. The video management system then receives a selection of the video source, receives information associated with the selected video source, and displays the received information.

Abstract: Embodiments for generating appropriate data sets for learning to identify user actions. A user uses one or more applications over a suitable period of time. As the user uses the applications, a monitoring device, acting as a “man-in-the-middle,” intermediates the exchange of encrypted communication between the applications and the servers that serve the applications. The monitoring device obtains, for each action performed by the user, two corresponding (bidirectional) flows of communication: an encrypted flow, and an unencrypted flow. Since the unencrypted flow indicates the type of action that was performed by the user, the correspondence between the encrypted flow and the unencrypted flow may be used to automatically label the encrypted flow, without decrypting the encrypted flow. Features of the encrypted communication may then be stored in association with the label to automatically generate appropriately-sized learning set for each application of interest.

Abstract: A faster and more streamlined system for providing summary and analysis of large amounts of communication data is described. System and methods are disclosed that employ an ontology to automatically summarize communication data and present the summary to the user in a form that does not require the user to listen to the communication data. In one embodiment, the summary is presented as written snippets, or short fragments, of relevant communication data that capture the meaning of the data relating to a search performed by the user. Such snippets may be based on theme and meaning unit identification.

Abstract: Automatic forensic investigation techniques to more effectively differentiate false positives from true positives. An incident is automatically investigated by a processor that communicates instructions to a device on a network and analyzes information received from the device in response to the instructions. In response to analyzing, the processor raises or lowers its level of confidence in the incident. If the processor's level of confidence in the incident is sufficiently high, the processor generates an output that indicates that the security of the network has been compromised. Otherwise, the processor ascertains that the incident is a false positive and may modify a criteria for alert generation.