Abstract: A system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive a data stream representing events; receive a plurality of complex event patterns (CEPs) comprising (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events; and calculate an optimal multi-pattern evaluation plan corresponding to said CEPs by: (i) generating an initial evaluation plan, (ii) applying a search method to calculate modified versions of said initial evaluation plan, (iii) assigning a score to each of said modified versions based on a cost function, and (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.

Abstract: A method comprising receiving, as input, a data stream representing events; receiving a complex event pattern (CEP) specification representing an occurrence of a CEP in said data stream based on a set of conditions and set of event attributes; applying an algorithm to generate a current CEP plan configured to determine said occurrence of said CEP, wherein said current CEP plan comprises of a series of execution steps; optimize said current CEP plan by, iteratively: (i) executing said current CEP plan, (ii) identifying, with respect to each of said execution steps, one of said conditions whose verification causes said execution step to be included in said current CEP plan, and (iii) performing a re-verification of all of said identified conditions using said updated current values; and re-applying said algorithm when said re-verification fails with respect to at least one of said identified conditions, to generate an updated CEP plan.

Abstract: Disclosed embodiments are a computing system and a computer-implemented method for distributed training of a machine learning model over a plurality of computing nodes, in a plurality of iterations, characterized by gradient gap based mitigation of the gradient staleness problem. The disclosed method evaluates the staleness of the gradient based on the difference in gradients between a central point, for example an iteration's common starting point, and the points reached by the respective computing node during one or more iterations, and aggregates the update steps from the plurality of computing nodes, while giving more weight to computing nodes having a lesser change in the gradient.

Abstract: A method for automatic determining of a state of a heart of a patient based on multiple-lead ECG information of the patient, the method includes (a) receiving the multiple-lead ECG information of the patient, by a computerized system; and (b) applying one or more machine learning processes on the multiple-lead ECG information of the patient to determine the state of a heart of the patient, wherein the state of the heart comprises at least one heart condition of multiple types of heart conditions. One, some or all of the one or more machine learning processes was trained using a dataset that comprises multiple computer generated images, the multiple computer generated images represent images acquired by an image acquisition process of ECG plots, wherein the ECG plots are generated based on digital multiple-lead ECG signals.

Abstract: System and techniques for a hierarchical resource constrained networks are described herein. Device participating in the network are divided into groups. These groups correspond to vertices in a routing graph. A leader is selected amongst the devices in each group to function as a routing node connecting to other vertices of the routing graph. Client devices attach to leaf vertices in the routing graph. To reduce overhead in placing devices into the routing pools, a distributed hash table (DHT) can be used. Here, the routing pools can be given DHT IDs based on, for example, a structure of the routing graph. Device DHT IDs are used to assign them to the routing pools based on a distance metric. Routing, in this arrangement, can use the DHT IDs to efficiently compute routing pool hops when routing messages. This arrangement works well for publication-subscription (pub-sub) services.

Abstract: Disclosed embodiments are a computing system and a computer-implemented method for distributed training of a machine learning model over a plurality of computing nodes, in a plurality of iterations, characterized by gradient gap based mitigation of the gradient staleness problem. The disclosed method evaluates the staleness of the gradient based on the difference in gradients between a central point, for example an iteration's common starting point, and the points reached by the respective computing node during one or more iterations, and aggregates the update steps from the plurality of computing nodes, while giving more weight to computing nodes having a lesser change in the gradient.

Abstract: A system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive a data stream representing events; receive a plurality of complex event patterns (CEPs) comprising (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events; and calculate an optimal multi-pattern evaluation plan corresponding to said CEPs by: (i) generating an initial evaluation plan, (ii) applying a search method to calculate modified versions of said initial evaluation plan, (iii) assigning a score to each of said modified versions based on a cost function, and (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.

Abstract: A method comprising receiving, as input, a data stream representing events; receiving a complex event pattern (CEP) specification representing an occurrence of a CEP in said data stream based on a set of conditions and set of event attributes; applying an algorithm to generate a current CEP plan configured to determine said occurrence of said CEP, wherein said current CEP plan comprises of a series of execution steps; optimize said current CEP plan by, iteratively: (i) executing said current CEP plan, (ii) identifying, with respect to each of said execution steps, one of said conditions whose verification causes said execution step to be included in said current CEP plan, and (iii) performing a re-verification of all of said identified conditions using said updated current values; and re-applying said algorithm when said re-verification fails with respect to at least one of said identified conditions, to generate an updated CEP plan.

Abstract: A method for detecting a pattern of events, comprising: receiving a template defining the pattern of events to detect; producing a join query for a relational database from the template; selecting a cost function for the join query, wherein a computation cost of the join query is equivalent to a computation cost of matching between a plurality of events from a plurality of streams of events and the template; identifying a preferred plan for executing the join query according to a minimal value of the cost function; producing an ordered set of a plurality of patterns, according to the preferred plan, by converting a plurality of database operations of the preferred plan into the ordered set of the plurality of patterns; and using the ordered set as an input for detecting a plurality of matches between the plurality of patterns and the plurality of events.

Abstract: A method for detecting a pattern of events, comprising: receiving a template defining the pattern of events to detect; producing a join query for a relational database from the template; selecting a cost function for the join query, wherein a computation cost of the join query is equivalent to a computation cost of matching between a plurality of events from a plurality of streams of events and the template; identifying a preferred plan for executing the join query according to a minimal value of the cost function; producing an ordered set of a plurality of patterns, according to the preferred plan, by converting a plurality of database operations of the preferred plan into the ordered set of the plurality of patterns; and using the ordered set as an input for detecting a plurality of matches between the plurality of patterns and the plurality of events.

Abstract: Distributed techniques for detecting atypical or malicious wireless communications activity are disclosed. A server can iteratively generate sets of filters based at least in part upon observation data received from one or more Protects. The filters can be used by the Protect(s) to distinguish between sniffed wireless messages that are to be discarded and those that are to be reported to the server. The server can provide the generated sets of filters to the Protect(s) to cause the Protect(s) to process additional sniffed wireless messages utilizing the one or more sets of filters. Updated filters can cause fewer subsequent sniffed wireless messages to be reported than would have been reported by use of previous filters. Limited activity reporting by the Protect(s) enables a reduced communication load compared to full activity reporting without degrading the ability of the server to detect the atypical or malicious wireless communications activity.

Abstract: A multiple-write enabled flash memory system, comprising: a flash memory comprising at least two planes, wherein each plane comprises multiple blocks, and wherein each block comprises multiple pages; an FTL memory manager configured: to reference one or more clean active blocks on each plane for a first write, wherein the first-write comprises writing one logical page of unmodified data to one physical page, and to reference one or more recycled active block on each plane for a second write, wherein each page of each recycled active block stores data from a previous first-write; and an encoder configured to encode a page of data via a write-once-memory (WOM) code to produce WOM-encoded data, wherein a combination of a target page of each recycled active block is configured to store the WOM-encoded data via a second write.

Abstract: A method for reducing disk read rate by managing dataset mapping of virtual machine (VM) guest memory, comprising: monitoring a plurality of disk read write operations of a VM guest; updating a dataset mapping between disk blocks allocated to the VM guest and corresponding physical addresses of memory pages of the VM guest containing replica of data stored in the disk blocks, based on the plurality of disk read write operations; when identifying writing to one of the memory pages, removing a mapping of corresponding disk block and corresponding physical address of memory page; when reclaiming a mapped memory page of the VM guest by a host of the VM guest, discarding data contained in the memory page; and when the data is requested by the VM guest after it was reclaimed by said host, retrieving the data from corresponding disk block according to the mapping.

Abstract: A multiple-write enabled flash memory system, comprising: a flash memory comprising at least two planes, wherein each plane comprises multiple blocks, and wherein each block comprises multiple pages; an FTL memory manager configured: to reference one or more clean active blocks on each plane for a first write, wherein the first-write comprises writing one logical page of unmodified data to one physical page, and to reference one or more recycled active block on each plane for a second write, wherein each page of each recycled active block stores data from a previous first-write; and an encoder configured to encode a page of data via a write-once-memory (WOM) code to produce WOM-encoded data, wherein a combination of a target page of each recycled active block is configured to store the WOM-encoded data via a second write.

Abstract: A method for reducing disk read rate by managing dataset mapping of virtual machine (VM) guest memory, comprising: monitoring a plurality of disk read write operations of a VM guest; updating a dataset mapping between disk blocks allocated to the VM guest and corresponding physical addresses of memory pages of the VM guest containing replica of data stored in the disk blocks, based on the plurality of disk read write operations; when identifying writing to one of the memory pages, removing a mapping of corresponding disk block and corresponding physical address of memory page; when reclaiming a mapped memory page of the VM guest by a host of the VM guest, discarding data contained in the memory page; and when the data is requested by the VM guest after it was reclaimed by said host, retrieving the data from corresponding disk block according to the mapping.

Abstract: A method for reducing disk read rate by managing dataset mapping of virtual machine (VM) guest memory, comprising: monitoring a plurality of disk read write operations of a VM guest; updating a dataset mapping between disk blocks allocated to the VM guest and corresponding physical addresses of memory pages of the VM guest containing replica of data stored in the disk blocks, based on the plurality of disk read write operations; when identifying writing to one of the memory pages, removing a mapping of corresponding disk block and corresponding physical address of memory page; when reclaiming a mapped memory page of the VM guest by a host of the VM guest, discarding data contained in the memory page; and when the data is requested by the VM guest after it was reclaimed by said host, retrieving the data from corresponding disk block according to the mapping.

Abstract: Distributed techniques for detecting atypical or malicious wireless communications activity are disclosed. A server can iteratively generate sets of filters based at least in part upon observation data received from one or more Protects. The filters can be used by the Protect(s) to distinguish between sniffed wireless messages that are to be discarded and those that are to be reported to the server. The server can provide the generated sets of filters to the Protect(s) to cause the Protect(s) to process additional sniffed wireless messages utilizing the one or more sets of filters. Updated filters can cause fewer subsequent sniffed wireless messages to be reported than would have been reported by use of previous filters. Limited activity reporting by the Protect(s) enables a reduced communication load compared to full activity reporting without degrading the ability of the server to detect the atypical or malicious wireless communications activity.

Abstract: A method for reducing disk read rate by managing dataset mapping of virtual machine (VM) guest memory, comprising: monitoring a plurality of disk read write operations of a VM guest; updating a dataset mapping between disk blocks allocated to the VM guest and corresponding physical addresses of memory pages of the VM guest containing replica of data stored in the disk blocks, based on the plurality of disk read write operations; when identifying writing to one of the memory pages, removing a mapping of corresponding disk block and corresponding physical address of memory page; when reclaiming a mapped memory page of the VM guest by a host of the VM guest, discarding data contained in the memory page; and when the data is requested by the VM guest after it was reclaimed by said host, retrieving the data from corresponding disk block according to the mapping.

Abstract: According to some embodiments of the present invention there is provided a computerized device for monitoring of distributed data streams comprising a network interface adapted to send processor instructions to processing nodes. The device comprises a central processor adapted to provide a non-convex function for centralized monitoring of two or more data streams from the processing nodes and compute new processor instructions defining a convex function greater than or equal to the non-convex function over a limited domain. The central processor is adapted to send the new processor instructions to the processing nodes that locally receive at least one data stream and execute the new processor instructions on a local processors. The local processor analyzes the convex function applied to the locally received data streams and forwards an outcome of the analysis to a centralized monitoring unit when the output value complies with a local predetermined criterion.

Abstract: A computer management system may track services on multiple computers executing the same workload. Various performance counters may be retrieved from the computers and analyzed to identify those with low deviations and low mean deviations. Statistical tests may then be used to compare the values of a particular computer to the deviation of the group of computers to identify outliers, which may indicate degraded performance and imminent failure of the computer. The management system may analyze any collectable performance related parameter to identify outlying systems.