Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: Systems, methods, and computer-readable media are provided for de-duplicating sensed data packets in a network. As data packets of a particular network flow move through the network, the data packets can be sensed and reported by various sensors across the network. An optimal sensor of the network can be determined based upon data packets reported by the various sensors. Data packets sensed and reported by the optimal sensor can be preserved for network analysis. Duplicative data packets of the particular network flow sensed and reported by other sensors of the network can be discarded to save storage capacity and processing power of network-flow analysis tools. Analysis of the particular network flow can be performed based upon the data packets sensed by the optimal sensor and non-duplicative data packets of the particular network-flow sensed by other sensors of the network.

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Abstract: An example method includes calculating latency bounds for communications from two sensors to a collector (i.e., maximum and minimum latencies). After the collector receives an event report from the first sensor and an event report form the second sensor, the collector can determine, using the latency bounds, whether one event likely preceded the other.

Abstract: Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.

Abstract: Managing a network environment to identify spoofed packets is disclosed. A method includes analyzing, via a first capture agent, packets processed by a first environment in a network associated with a first host, and analyzing, via a second capture agent, packets processed by a second environment in the network associated with a second host. The method includes collecting the first data and the second data at a collector and generating a topological map of the network and a history of network activity associated with the first environment and the second environment. The method includes extracting network data from a packet and comparing the extracted network data with stored network data in the database. When the comparison indicates that the extracted network data does not match the stored network data (i.e., the reported source does not match an expected source for the packet), determining that the packet is a spoofed packet.

Abstract: Systems, methods, and computer-readable media for detecting sensor deployment characteristics in a network. In some embodiments, a system can run a capturing agent deployed on a virtualization environment of the system. The capturing agent can query the virtualization environment for one or more environment parameters, and receive a response from the virtualized environment including the one or more environment parameters. Based on the one or more environment parameters, the capturing agent can determine whether the virtualization environment where the capturing agent is deployed is a hypervisor or a virtual machine. The capturing agent can also determine what type of software switch is running in the virtualized environment.

Abstract: The present disclosure is directed to a parallel face detection and tracking system. In general, embodiments consistent with the present disclosure may be configured to distribute the processing load associated with the detection and tracking of different faces in an image between multiple data processors. If needed, processing load balancing and/or protective features may be implemented to prevent the data processors from becoming overwhelmed. In one embodiment, a device may comprise, for example, a communication module and at least one processing module. The communication module may be configured to receive at least image information that may be processed by a plurality of data processors in the data processing module. For example, each of the data processors may be configured to detect faces in the image information and/or track detected faces in the image information based on at least one criterion.

Abstract: Technologies for improving the accuracy of depth camera images include a computing device to generate a foreground mask and a background mask for an image generated by a depth camera. The computing device identifies areas of a depth image of a depth channel of the generated image having unknown depth values as one of interior depth holes or exterior depth holes based on the foreground and background masks. The computing device fills at least a portion of the interior depth holes of the depth image based on depth values of areas of the depth image within a threshold distance of the corresponding portion of the interior depth holes. Similarly, the computing device fills at least a portion of the exterior depth holes of the depth image based on depth values of areas of the depth image within the threshold distance of the corresponding portion of the exterior depth holes.

Abstract: Measuring audience size for a digital sign comprises generating a plurality of paths, one for each face detected in a first sequence of video frames captured by a camera proximate the digital sign, and generating a zone in the sequence of video frames through which passes a threshold number of the paths. Motion and direction of motion within the zone is then measured in a second sequence of video frames to calculate the audience size that passes through the zone in the second sequence of video frames.

Abstract: A method, computer system and computer program is provided for using a suggestive modeling interface. The method consists of a method of a computer-implemented rendering of sketches, the method comprising the steps of: (1) a user activating a sketching application: (2) in response, the sketching application displaying on a screen a suggestive modeling interface; (3) the sketching application importing a sketch to the suggestive modeling interface; and (4) the sketching application retrieving from a database one or more suggestions based on the sketch. The method is operable to allow a user interactively using the sketching application to create a drawing that is guided by the imported sketch by selectively using one or more image guided drawing tools provided by the sketching application. The present invention is well-suited for three-dimensional modeling applications.

Abstract: Measuring audience size for a digital sign comprises generating a plurality of paths, one for each face detected in a first sequence of video frames captured by a camera proximate the digital sign, and generating a zone in the sequence of video frames through which passes a threshold number of the paths. Motion and direction of motion within the zone is then measured in a second sequence of video frames to calculate the audience size that passes through the zone in the second sequence of video frames.

Abstract: Measuring audience size for a digital sign comprises generating a plurality of paths, one for each face detected in a first sequence of video frames captured by a camera proximate the digital sign, and generating a zone in the sequence of video frames through which passes a threshold number of the paths. Motion and direction of motion within the zone is then measured in a second sequence of video frames to calculate the audience size that passes through the zone in the second sequence of video frames.

Abstract: The present disclosure is directed to a parallel face detection and tracking system. In general, embodiments consistent with the present disclosure may be configured to distribute the processing load associated with the detection and tracking of different faces in an image between multiple data processors. If needed, processing load balancing and/or protective features may be implemented to prevent the data processors from becoming overwhelmed. In one embodiment, a device may comprise, for example, a communication module and at least one processing module. The communication module may be configured to receive at least image information that may be processed by a plurality of data processors in the data processing module. For example, each of the data processors may be configured to detect faces in the image information and/or track detected faces in the image information based on at least one criterion.

Abstract: A digital advertising system includes an advertisements module that provides a number of digital advertisements for display on a digital display device. A digital al sign module including the digital display device displays digital advertisements provided by the advertisements module, and captures video analytics data relating to previous viewers of the digital advertisements displayed by the digital sign module. A data mining module retrieves the video analytics data from the digital sign module and generates trained advertising models based thereon using a data mining algorithm. A content management system module coupled to the advertisements module and the data mining module receives the digital advertisements and the trained advertising models and generates a subset of the advertisements for display based on the trained advertising models.

Abstract: Measuring audience size for a digital sign comprises generating a plurality of paths, one for each face detected in a first sequence of video frames captured by a camera proximate the digital sign, and generating a zone in the sequence of video frames through which passes a threshold number of the paths. Motion and direction of motion within the zone is then measured in a second sequence of video frames to calculate the audience size that passes through the zone in the second sequence of video frames.

Abstract: Various embodiments are directed to a system for testing a video analytics system. In one embodiment, an apparatus comprises a processor circuit executing a sequence of instructions causing the processor circuit to receive a first data specifying boundaries of a first rectangular region indicated as comprising an image of a face in a video frame of a motion video; receive a second data specifying boundaries of a second rectangular region indicated as comprising an image of a face in the video frame of the motion video; measure a distance between corresponding corners of the first and second rectangular regions; compare the distance to a distance threshold; and determine whether the first and second rectangular regions comprise images of a same face based on the comparison. Other embodiments are described and claimed.

Abstract: Selecting when to display one of a plurality of advertisements on a digital sign. An embodiment of the invention gathers video analytics data from a plurality of objects that pass by a sensor, and analyze the gathered video analytics data to determine a type for each of the objects. The embodiment then trains advertising models based on the determined types and selects an advertisement from a plurality of advertisements for display on the digital sign based on the trained advertising models.

Abstract: A method, computer system and computer program is provided for using a suggestive modeling interface. The method consists of a method of a computer-implemented rendering of sketches, the method comprising the steps of: (1) a user activating a sketching application; (2) in response, the sketching application displaying on a screen a suggestive modeling interface; (3) the sketching application importing a sketch to the suggestive modeling interface; and (4) the sketching application retrieving from a database one or more suggestions based on the sketch. The method is operable to allow a user interactively using the sketching application to create a drawing that is guided by the imported sketch by selectively using one or more image guided drawing tools provided by the sketching application. The present invention is well-suited for three-dimensional modeling applications.

Abstract: A method of partitioning a design across a plurality of integrated circuits can include creating a software construct for each one of the plurality of integrated circuits and assigning a plurality of instances to a selected software construct. Each of the plurality of instances can be from a different logic hierarchy. The method further can include automatically adding at least one input/output buffer and port to the selected software construct to accommodate the plurality of instances and creating nets connecting the plurality of instances and the at least one input/output buffer and port within the selected software construct.