Abstract: Methods, systems, apparatus, including computer programs encoded on computer storage media for using multiple data structures to correlate information from multiple distributed data sources. The method can include receiving a request to create a report data structure, generating first data representing a digital report template the generated first data including (i) a first digital template defining multiple keyed data fields that are configured to be dynamically populated and (ii) a second digital template defining one or more instances of static data that can each be selectively activated or deactivated based on the request, extracting keyed data and natural language data from files in one or more of the data sources, mapping the extracted data to the multiple keyed data fields of the report template, and generating a report data structure based on (i) the mapped data and (ii) static data that has been selectively activated based on the request.

Abstract: Systems and methods are described for a scalable approach to build a knowledge database of clinical trial data by extracting, aligning, and synthesizing information from a variety of sources including clinical trial registries, abstracts of papers, and full-text medical journal articles, as well as external gazetteers, dictionaries, and lexicons. For examples, a system may implement a flexible and repeatable workflow that extracts both structured and semi-structured elements from unstructured data such as journal articles using a ‘back off strategy’ in which specialized rules are used to extract structured, clinical trial design parameters as well as information retrieval techniques that exploit regularities in language used in the medical literature to discover semi-structured trial outcomes.

Abstract: Methods, systems, apparatus, including computer programs encoded on computer storage media for using multiple data structures to correlate information from multiple distributed data sources. The method can include receiving a request to create a report data structure, generating first data representing a digital report template the generated first data including (i) a first digital template defining multiple keyed data fields that are configured to be dynamically populated and (ii) a second digital template defining one or more instances of static data that can each be selectively activated or deactivated based on the request, extracting keyed data and natural language data from files in one or more of the data sources, mapping the extracted data to the multiple keyed data fields of the report template, and generating a report data structure based on (i) the mapped data and (ii) static data that has been selectively activated based on the request.

Abstract: An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

Abstract: A communication node operable to estimate faults in a mobile ad hoc network and method of performing the same. In one embodiment, the communication node includes a processor and memory including computer program code configured to, with the processor, cause the communication node to monitor a set of observable parameters at the communication node, produce a fault estimate at the communication node from the set of observable parameters, and provide the fault estimate to a global fault detector at another communication node.

Abstract: A method for active learning using privileged information is disclosed. A processing device receives a set of labeled examples and a set of unlabeled examples. For each unlabeled example in the set of unlabeled examples, the processing device determines whether to query at least one of an oracle to obtain a label for the unlabeled example or a teacher to obtain privileged information about the unlabeled example. The processing device outputs a decision rule based on minimizing a number of queries to the oracle for a label and the teacher for privileged information. Minimizing the number of queries to the teacher and the oracle is based on a cost of querying the teacher or the oracle.

Abstract: A communication node operable to estimate faults in a mobile ad hoc network and method of performing the same. In one embodiment, the communication node includes a processor and memory including computer program code configured to, with the processor, cause the communication node to monitor a set of observable parameters at the communication node, produce a fault estimate at the communication node from the set of observable parameters, and provide the fault estimate to a global fault detector at another communication node.

Abstract: A system and method for secure data management is presented. The method comprises receiving a query, performing the query and obtaining answers to it, creating certain formulas representing the answers; and determining whether there is a minimum number of distinct models of these formulas conjoined with the relevant anonymity predicates along with previous answers and general background knowledge, and when that number of models does not exist, suppressing the answers. In one aspect, the method further comprises creating formulas encoding the information conveyed by the answer; and combining the formulas encoding the information with prior information.

Abstract: A system and method for spammer host detection from network flow data profiles comprises constructing one or more cluster profiles and detecting spammer hosts. Construction cluster profiles comprises observing network flow data from one or more hosts; for each host, representing the network flow data associated with the host as a multidimensional vector; clustering the vectors of the hosts into the plurality of cluster profiles; annotating each cluster profile using at least one of black lists and white lists; and calculating a confidence in each cluster profile annotation. Detecting spammer hosts comprises observing the network flow data from a new host; representing the network flow data associated with the new host as a multidimensional vector, and placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.

Abstract: An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

Abstract: A system and method for spammer host detection from network flow data profiles comprises constructing one or more cluster profiles and detecting spammer hosts. Construction cluster profiles comprises observing network flow data from one or more hosts; for each host, representing the network flow data associated with the host as a multidimensional vector; clustering the vectors of the hosts into the plurality of cluster profiles; annotating each cluster profile using at least one of black lists and white lists; and calculating a confidence in each cluster profile annotation. Detecting spammer hosts comprises observing the network flow data from a new host; representing the network flow data associated with the new host as a multidimensional vector, and placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.

Abstract: Methods and systems are provided for developing decision information relating to a single system based on data received from a plurality of sensors. The method includes receiving first data from a first sensor that defines first information of a first type that is related to a system, receiving second data from a second sensor that defines second information of a second type that is related to said system, wherein the first type is different from the second type, generating a first decision model, a second decision model, and a third decision model, determining whether data is available from only the first sensor, only the second sensor, or both the first and second sensors, and selecting based on the determination of availability an additional model to apply the available data, wherein the additional model is selected from a plurality of additional decision models including the third decision model.

Abstract: A system and method for secure data management is presented. The method comprises receiving a query, performing the query and obtaining answers to it, creating certain formulas representing the answers; and determining whether there is a minimum number of distinct models of these formulas conjoined with the relevant anonymity predicates along with previous answers and general background knowledge, and when that number of models does not exist, suppressing the answers. In one aspect, the method further comprises creating formulas encoding the information conveyed by the answer; and combining the formulas encoding the information with prior information.

Abstract: A method and system for use in describing a phenomenon of interest. The method and system computes a decision rule for use in describing the phenomenon of interest using training data relating to the phenomenon of interest, labels for labeling the training data, and hidden information about the training data or directed distances obtained from the hidden information, as inputs.

Abstract: A system and method for nexting is presented. The method comprises computing an expected event, observing a new event, when the expected event matches the new event, processing the new event and performing action in accordance with given concepts, when the expected event does not match the new event and the new event can be explained based on the given concepts, processing the new event and performing action in accordance with the given concepts, and when the expected event does not match the new event and the new event cannot be explained based on the given concepts, employing learning mechanism and performing action decided on by the learning mechanism. In one aspect, the method comprises generating new concepts using reasoning or learning. In one aspect, the method comprises converting sensed numerical data into events of interest via the application of learned functions operating on the numerical data.

Abstract: Methods and systems are provided for developing decision information relating to a single system based on data received from a plurality of sensors. The method includes receiving first data from a first sensor that defines first information of a first type that is related to a system, receiving second data from a second sensor that defines second information of a second type that is related to said system, wherein the first type is different from the second type, generating a first decision model, a second decision model, and a third decision model, determining whether data is available from only the first sensor, only the second sensor, or both the first and second sensors, and selecting based on the determination of availability an additional model to apply the available data, wherein the additional model is selected from a plurality of additional decision models including the third decision model.

Abstract: Loads for a wireless network having a plurality of end nodes are predicted by constructing a computer data set of end-to-end pairs of the end nodes included in the network using a computer model of the network; constructing a computerized set of observables from social information about users of the network; developing a computerized learned model of predicted traffic using at least the data set and the observables; and using the computerized learned model to predict future end-to-end network traffic.

Abstract: A system and method for support vector machine plus (SVM+) computations include selecting a set of indexes for a target function to create a quadratic function depending on a number of variables, and reducing the number of variables to two in the quadratic function using linear constraints. An extreme point is computed for the quadratic function in closed form. A two-dimensional set is defined where the indexes determine whether a data point is in the two-dimensional set or not. A determination is made of whether the extreme point belongs to the two-dimensional set. If the extreme point belongs to the two-dimensional set, the extreme point defines a maximum and defines a new set of parameters for a next iteration. Otherwise, the quadratic function is restricted on at least one boundary of the two-dimensional set to create a one-dimensional quadratic function. The steps are repeated until the maximum is determined.

Abstract: A method and system for use in describing a phenomenon of interest. The method and system computes a decision rule for use in describing the phenomenon of interest using training data relating to the phenomenon of interest, labels for labeling the training data, and hidden information about the training data or directed distances obtained from the hidden information, as inputs.

Abstract: A system and method for support vector machine plus (SVM+) computations include selecting a set of indexes for a target function to create a quadratic function depending on a number of variables, and reducing the number of variables to two in the quadratic function using linear constraints. An extreme point is computed for the quadratic function in closed form. A two-dimensional set is defined where the indexes determine whether a data point is in the two-dimensional set or not. A determination is made of whether the extreme point belongs to the two-dimensional set. If the extreme point belongs to the two-dimensional set, the extreme point defines a maximum and defines a new set of parameters for a next iteration. Otherwise, the quadratic function is restricted on at least one boundary of the two-dimensional set to create a one-dimensional quadratic function. The steps are repeated until the maximum is determined.