Abstract: According to examples, an apparatus may include a memory on which is stored instructions that when executed by a processor, cause the processor to cluster a set of data points into a hierarchy of a plurality of clusters, in which each level of the hierarchy includes a different number of the plurality of clusters. The processor may also select a number of the plurality of clusters to be used in modeling behaviors of the plurality of clusters and for each cluster of the selected number of the plurality of clusters, determine a distribution type of the cluster. The processor may further merge the distribution types of the clusters to generate a mixture model, identify an event, evaluate the event based on the generated mixture model to determine whether the event is likely anomalous, and based on a determination that the event is likely anomalous, execute a response action.

Abstract: According to examples, an apparatus may include a memory on which is stored instructions that when executed by a processor, cause the processor to cluster a set of data points into a hierarchy of a plurality of clusters, in which each level of the hierarchy includes a different number of the plurality of clusters. The processor may also select a number of the plurality of clusters to be used in modeling behaviors of the plurality of clusters and for each cluster of the selected number of the plurality of clusters, determine a distribution type of the cluster. The processor may further merge the distribution types of the clusters to generate a mixture model, identify an event, evaluate the event based on the generated mixture model to determine whether the event is likely anomalous, and based on a determination that the event is likely anomalous, execute a response action.

Abstract: For a given file type, an optimal number of threads to use to copy files of each of a number of different discrete file sizes is determined, using a temporal difference learning, reinforcement learning approach in which file copy time is used as feedback reward reinforcement. A continuous function corresponding to the given file type and outputting the number of threads to use to copy files having this given file type and that are of any input file size is fitted onto the optimal numbers of threads determined for the discrete file sizes.