Abstract: During operation, the system uses N sensors to sample an electromagnetic interference (EMI) signal emitted by a target asset while the target asset is running a periodic workload, wherein each of the N sensors has a sensor sampling frequency f, and wherein the N sensors perform sampling operations in a round-robin ordering with phase offsets between successive samples. During the sampling operations, the system performs phase adjustments among the N sensors to maximize phase offsets between successive sensors in the round-robin ordering. Next, the system combines samples obtained through the N sensors to produce a target EMI signal having an EMI signal sampling frequency F=f×N. The system then generates a target EMI fingerprint from the target EMI signal. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains any unwanted electronic components.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: During operation, the system obtains a training dataset during a training mode, wherein the training dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the training dataset to produce corresponding per-action datasets. The system then cleanses the training dataset based on counts of actions in the per-action datasets to produce a cleansed training dataset, and uses the cleansed training dataset to produce corresponding per-user datasets. Next, the system trains per-user models based on the per-user datasets to detect anomalous actions of users. The system then obtains a surveillance dataset during a surveillance mode, wherein the surveillance dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the trained per-user models to detect anomalous actions in the surveillance dataset. Finally, when an anomalous action is detected, the system triggers an alert.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: During operation, the system uses N sensors to sample an electromagnetic interference (EMI) signal emitted by a target asset while the target asset is running a periodic workload, wherein each of the N sensors has a sensor sampling frequency f, and wherein the N sensors perform sampling operations in a round-robin ordering with phase offsets between successive samples. During the sampling operations, the system performs phase adjustments among the N sensors to maximize phase offsets between successive sensors in the round-robin ordering. Next, the system combines samples obtained through the N sensors to produce a target EMI signal having an EMI signal sampling frequency F=f×N. The system then generates a target EMI fingerprint from the target EMI signal. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains any unwanted electronic components.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: The system obtains a multimodal dataset containing different types of data gathered during operation of the computer system, wherein the multimodal dataset includes time-series data for different variables associated with operation of the computer system. Next, the system forms a set of feature groups from the multimodal dataset, wherein each feature group comprises variables from the multimodal dataset containing the same type of data. The system then computes a tripoint similarity matrix for each feature group, and aggregates the tripoint similarity matrices for the feature groups to produce a crossmodal tripoint similarity matrix. Next, the system uses the crossmodal tripoint similarity matrix to cluster the multimodal dataset to form a model. The system then performs prognostic-surveillance operations on real-time multimodal data received from the computer system, wherein the prognostic-surveillance operations use the model as a classifier to detect anomalies.

Abstract: The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: During operation, the system obtains a training dataset during a training mode, wherein the training dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the training dataset to produce corresponding per-action datasets. The system then cleanses the training dataset based on counts of actions in the per-action datasets to produce a cleansed training dataset, and uses the cleansed training dataset to produce corresponding per-user datasets. Next, the system trains per-user models based on the per-user datasets to detect anomalous actions of users. The system then obtains a surveillance dataset during a surveillance mode, wherein the surveillance dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the trained per-user models to detect anomalous actions in the surveillance dataset. Finally, when an anomalous action is detected, the system triggers an alert.

Abstract: After sensors are placed at three or more non-collinear locations on a surface of the component, the system receives time-series signals from the sensors while the component operates on a representative workload. The system then defines one or more triangles on the surface of the component, wherein each triangle is defined by three vertices, which coincide with different sensor locations on the surface of the component. For each triangle, the system applies a barycentric coordinate technique (BCT) to time-series signals received from sensors located at the vertices of the triangle to determine a candidate location within the triangle to place an additional sensor. The system then compares the candidate locations for each of the one or more triangles to determine a globally optimal location for the additional sensor, and a new sensor is placed at this location. This process is repeated until a desired number of sensors are placed.

Abstract: The system obtains a multimodal dataset containing different types of data gathered during operation of the computer system, wherein the multimodal dataset includes time-series data for different variables associated with operation of the computer system. Next, the system forms a set of feature groups from the multimodal dataset, wherein each feature group comprises variables from the multimodal dataset containing the same type of data. The system then computes a tripoint similarity matrix for each feature group, and aggregates the tripoint similarity matrices for the feature groups to produce a crossmodal tripoint similarity matrix. Next, the system uses the crossmodal tripoint similarity matrix to cluster the multimodal dataset to form a model. The system then performs prognostic-surveillance operations on real-time multimodal data received from the computer system, wherein the prognostic-surveillance operations use the model as a classifier to detect anomalies.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: The disclosed embodiments provide a system that detects an anomaly in a computer system based on log messages. During operation, the system receives log messages generated by the computer system during operation of the computer system. Next, the system maps each received log message to a cluster in a set of clusters of log messages, wherein each cluster is associated with a specific event. The system then forms events for consecutive log messages into sequences of events. Finally, the system performs anomaly detection based on the sequences of events, wherein if an anomaly is detected, the system triggers an alert.

Abstract: The disclosed embodiments relate to a system that reduces bandwidth requirements for transmitting telemetry data from sensors in a computer system. During operation, the system obtains a cross-imputability value for each sensor in a set of sensors that are monitoring the computer system, wherein a cross-imputability value for a sensor indicates how well a sensor value obtained from the sensor can be predicted based on sensor values obtained from other sensors in the set. Next, the system clusters sensors in the set of sensors into two or more groups based on the determined cross-imputability values. Then, while transmitting sensor values from the set of sensors, for a group of sensors having cross-imputability values exceeding a threshold, the system selectively transmits sensor values from some but not all of the sensors in the group to reduce a number of sensor values transmitted.

Abstract: The disclosed embodiments relate to a system that characterizes I/O performance of a computing device in terms of energy consumption across a range of vibrational operating environments. During operation, the system executes a test script on a computing device that is affixed to a programmable vibration table, wherein the test script causes the computing device to perform a predetermined I/O workload. While the test script is executing, the system controls the programmable vibration table to subject the computing device to different vibrational operating environments. At the same time, the system obtains test results by monitoring a progress of the test script and an associated power consumption of the computing device. Finally, the system uses the obtained test results to characterize the I/O performance of the computing device in terms of energy consumption across the range of vibrational operating environments.

Abstract: The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

Abstract: Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for a user authentication attempt to access a secure computer resource, user authentication log data having user attribute values is collected. The user authentication log data is transformed into a tracer data structure. The tracer data structure is augmented with timestamp data to generate an event data structure. It is determined whether the tracer data structure matches an existing tracer data structure stored in a rules database and, if not, a novelty flag is set to generate a new user behavior model filter. If the tracer data structure matches the existing tracer data structure: an existing user behavior model filter is applied, issuance of an alarm message or signal is controlled, and the existing user behavior model filter is updated based, at least in part, on the event data structure.

Abstract: The disclosed embodiments provide a system that detects an anomaly in a computer system based on log messages. During operation, the system receives log messages generated by the computer system during operation of the computer system. Next, the system maps each received log message to a cluster in a set of clusters of log messages, wherein each cluster is associated with a specific event. The system then forms events for consecutive log messages into sequences of events. Finally, the system performs anomaly detection based on the sequences of events, wherein if an anomaly is detected, the system triggers an alert.