Abstract: The disclosed embodiments relate to a system that compactly stores time-series sensor signals. During operation, the system receives original time-series signals comprising sequences of observations obtained from sensors in a monitored system. Next, the system formulizes the original time-series sensor signals to produce a set of equations, which can be used to generate synthetic time-series signals having the same correlation structure and the same stochastic properties as the original time-series signals. Finally, the system stores the formulized time-series sensor signals in place of the original time-series sensor signals.

Abstract: During operation, the system obtains a training dataset during a training mode, wherein the training dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the training dataset to produce corresponding per-action datasets. The system then cleanses the training dataset based on counts of actions in the per-action datasets to produce a cleansed training dataset, and uses the cleansed training dataset to produce corresponding per-user datasets. Next, the system trains per-user models based on the per-user datasets to detect anomalous actions of users. The system then obtains a surveillance dataset during a surveillance mode, wherein the surveillance dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the trained per-user models to detect anomalous actions in the surveillance dataset. Finally, when an anomalous action is detected, the system triggers an alert.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: The disclosed embodiments relate to a system that facilitates development of machine-learning techniques to perform prognostic-surveillance operations on time-series data from a monitored system, such as a power plant and associated power-distribution system. During operation, the system receives original time-series signals comprising sequences of observations obtained from sensors in the monitored system. Next, the system decomposes the original time-series signals into deterministic and stochastic components. The system then uses the deterministic and stochastic components to produce synthetic time-series signals, which are statistically indistinguishable from the original time-series signals. Finally, the system enables a developer to use the synthetic time-series signals to develop machine-learning (ML) techniques to perform prognostic-surveillance operations on subsequently received time-series signals from the monitored system.

Abstract: The system obtains a multimodal dataset containing different types of data gathered during operation of the computer system, wherein the multimodal dataset includes time-series data for different variables associated with operation of the computer system. Next, the system forms a set of feature groups from the multimodal dataset, wherein each feature group comprises variables from the multimodal dataset containing the same type of data. The system then computes a tripoint similarity matrix for each feature group, and aggregates the tripoint similarity matrices for the feature groups to produce a crossmodal tripoint similarity matrix. Next, the system uses the crossmodal tripoint similarity matrix to cluster the multimodal dataset to form a model. The system then performs prognostic-surveillance operations on real-time multimodal data received from the computer system, wherein the prognostic-surveillance operations use the model as a classifier to detect anomalies.

Abstract: The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: During operation, the system obtains a training dataset during a training mode, wherein the training dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the training dataset to produce corresponding per-action datasets. The system then cleanses the training dataset based on counts of actions in the per-action datasets to produce a cleansed training dataset, and uses the cleansed training dataset to produce corresponding per-user datasets. Next, the system trains per-user models based on the per-user datasets to detect anomalous actions of users. The system then obtains a surveillance dataset during a surveillance mode, wherein the surveillance dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the trained per-user models to detect anomalous actions in the surveillance dataset. Finally, when an anomalous action is detected, the system triggers an alert.

Abstract: The system obtains a multimodal dataset containing different types of data gathered during operation of the computer system, wherein the multimodal dataset includes time-series data for different variables associated with operation of the computer system. Next, the system forms a set of feature groups from the multimodal dataset, wherein each feature group comprises variables from the multimodal dataset containing the same type of data. The system then computes a tripoint similarity matrix for each feature group, and aggregates the tripoint similarity matrices for the feature groups to produce a crossmodal tripoint similarity matrix. Next, the system uses the crossmodal tripoint similarity matrix to cluster the multimodal dataset to form a model. The system then performs prognostic-surveillance operations on real-time multimodal data received from the computer system, wherein the prognostic-surveillance operations use the model as a classifier to detect anomalies.

Abstract: The disclosed embodiments provide a system that detects an anomaly in a computer system based on log messages. During operation, the system receives log messages generated by the computer system during operation of the computer system. Next, the system maps each received log message to a cluster in a set of clusters of log messages, wherein each cluster is associated with a specific event. The system then forms events for consecutive log messages into sequences of events. Finally, the system performs anomaly detection based on the sequences of events, wherein if an anomaly is detected, the system triggers an alert.

Abstract: The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

Abstract: The disclosed embodiments provide a system that detects an anomaly in a computer system based on log messages. During operation, the system receives log messages generated by the computer system during operation of the computer system. Next, the system maps each received log message to a cluster in a set of clusters of log messages, wherein each cluster is associated with a specific event. The system then forms events for consecutive log messages into sequences of events. Finally, the system performs anomaly detection based on the sequences of events, wherein if an anomaly is detected, the system triggers an alert.

Abstract: The disclosed embodiments relate to a system for performing prognostic surveillance operations on sensor data. During operation, the system obtains a group of signals from sensors in a monitored system during operation of the monitored system. Next, if possible, the system performs a clustering operation, which divides the group of signals into groups of correlated signals. Then, for one or more groups of signals that exceed a specified size, the system randomly partitions the groups of signals into smaller groups of signals. Next, for each group of signals, the system trains an inferential model for a prognostic pattern-recognition system based on signals in the group of signals. Then, for each group of signals, the system uses a prognostic pattern-recognition system in a surveillance mode and the inferential model to detect incipient anomalies that arise during execution of the monitored system.

Abstract: The disclosed embodiments relate to a system that facilitates development of machine-learning techniques to perform prognostic-surveillance operations on time-series data from a monitored system, such as a power plant and associated power-distribution system. During operation, the system receives original time-series signals comprising sequences of observations obtained from sensors in the monitored system. Next, the system decomposes the original time-series signals into deterministic and stochastic components. The system then uses the deterministic and stochastic components to produce synthetic time-series signals, which are statistically indistinguishable from the original time-series signals. Finally, the system enables a developer to use the synthetic time-series signals to develop machine-learning (ML) techniques to perform prognostic-surveillance operations on subsequently received time-series signals from the monitored system.

Abstract: The disclosed embodiments relate to a system that compactly stores time-series sensor signals. During operation, the system receives original time-series signals comprising sequences of observations obtained from sensors in a monitored system. Next, the system formulizes the original time-series sensor signals to produce a set of equations, which can be used to generate synthetic time-series signals having the same correlation structure and the same stochastic properties as the original time-series signals. Finally, the system stores the formulized time-series sensor signals in place of the original time-series sensor signals.

Abstract: The disclosed embodiments relate to a system for performing prognostic surveillance operations on sensor data. During operation, the system obtains a group of signals from sensors in a monitored system during operation of the monitored system. Next, if possible, the system performs a clustering operation, which divides the group of signals into groups of correlated signals. Then, for one or more groups of signals that exceed a specified size, the system randomly partitions the groups of signals into smaller groups of signals. Next, for each group of signals, the system trains an inferential model for a prognostic pattern-recognition system based on signals in the group of signals. Then, for each group of signals, the system uses a prognostic pattern-recognition system in a surveillance mode and the inferential model to detect incipient anomalies that arise during execution of the monitored system.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: Systems, methods, and other embodiments associated with clustering using tri-point arbitration are described. In one embodiment, a method includes selecting a data point pair and a set of arbiter points. A tri-point arbitration similarity is calculated for data point pairs based, at least in part, on a distance between the first and second data points and the arbiter points. In one embodiment, similar data points are clustered.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.