Abstract: Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a system and method for detecting malware using multi-stage file-typing and, optionally pre-processing, with fall-through options.

Abstract: Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a system and method for detecting malware using multi-stage file-typing and, optionally pre-processing, with fall-through options.

Abstract: Systems and methods are provided for tracking moving objects from a set of measurements. An estimate of a posterior probability distribution for a plurality of track states is determined from an estimate of the posterior probability distribution for a plurality of possible assignments of the set of measurements to a set of tracks representing trajectories of the plurality of moving objects and the set of measurements. A new estimate of the posterior probability distribution for the assignments is determined from the measurements and the estimate of a posterior probability distribution for the track states. A variational lower bound is determined from the new estimate of the posterior probability distribution for the assignments, the estimate of the posterior probability distribution for the track states, and the set of measurements. These steps are iteratively repeated until the variational lower bound is less than a threshold value.

Abstract: Systems and methods are provided for tracking moving objects from a set of measurements. An estimate of a posterior probability distribution for a plurality of track states is determined from an estimate of the posterior probability distribution for a plurality of possible assignments of the set of measurements to a set of tracks representing trajectories of the plurality of moving objects and the set of measurements. A new estimate of the posterior probability distribution for the assignments is determined from the measurements and the estimate of a posterior probability distribution for the track states. A variational lower bound is determined from the new estimate of the posterior probability distribution for the assignments, the estimate of the posterior probability distribution for the track states, and the set of measurements. These steps are iteratively repeated until the variational lower bound is less than a threshold value.

Abstract: Systems and methods are provided for tracking moving objects from a set of measurements. An estimate of a posterior probability distribution for a plurality of track states is determined from an estimate of the posterior probability distribution for a plurality of possible assignments of the set of measurements to a set of tracks representing trajectories of the plurality of moving objects and the set of measurements. A new estimate of the posterior probability distribution for the assignments is determined from the measurements and the estimate of a posterior probability distribution for the track states. A variational lower bound is determined from the new estimate of the posterior probability distribution for the assignments, the estimate of the posterior probability distribution for the track states, and the set of measurements. These steps are iteratively repeated until the variational lower bound is less than a threshold value.

Abstract: A system and method for detecting anomalous activity, the method includes collecting data from a plurality of data sources, wherein each data source generates a data stream; harmonizing each data stream using a computer processor so that the harmonized data is in a common format; generating behavior models based on the harmonized data using the computer processor; analyzing the harmonized data at a first level using the behavior models and the computer processor to generate meta-events, wherein the meta-events represent anomalous behavior; analyzing the meta-events at a second level using the computer processor to determine if an alert should be issued; and when an alert should be issued, displaying the alert is disclosed.

Abstract: A system and method for detecting anomalous activity, the method includes collecting data from a plurality of data sources, wherein each data source generates a data stream; harmonizing each data stream using a computer processor so that the harmonized data is in a common format; generating behavior models based on the harmonized data using the computer processor; analyzing the harmonized data at a first level using the behavior models and the computer processor to generate meta-events, wherein the meta-events represent anomalous behavior; analyzing the meta-events at a second level using the computer processor to determine if an alert should be issued; and when an alert should be issued, displaying the alert is disclosed.

Abstract: Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a method for improved zero-day malware detection that receives a set of training files which are each known to be either malign or benign, partitions the set of training files into a plurality of categories, and trains category-specific classifiers that distinguish between malign and benign files in a category of files. The training may include selecting one of the plurality of categories of training files, identifying features present in the training files in the selected category of training files, evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files, and building a category-specific classifier based on the evaluated features. Embodiments also include by a system and computer-readable medium with instructions for executing the above method.

Abstract: Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a method for improved zero-day malware detection that receives a set of training files which are each known to be either malign or benign, partitions the set of training files into a plurality of categories, and trains category-specific classifiers that distinguish between malign and benign files in a category of files. The training may include selecting one of the plurality of categories of training files, identifying features present in the training files in the selected category of training files, evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files, and building a category-specific classifier based on the evaluated features. Embodiments also include by a system and computer-readable medium with instructions for executing the above method.

Abstract: Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a method for improved zero-day malware detection that receives a set of training files which are each known to be either malign or benign, partitions the set of training files into a plurality of categories, and trains category-specific classifiers that distinguish between malign and benign files in a category of files. The training may include selecting one of the plurality of categories of training files, identifying features present in the training files in the selected category of training files, evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files, and building a category-specific classifier based on the evaluated features. Embodiments also include by a system and computer-readable medium with instructions for executing the above method.

Abstract: Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a method for improved zero-day malware detection that receives a set of training files which are each known to be either malign or benign, partitions the set of training files into a plurality of categories, and trains category-specific classifiers that distinguish between malign and benign files in a category of files. The training may include selecting one of the plurality of categories of training files, identifying features present in the training files in the selected category of training files, evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files, and building a category-specific classifier based on the evaluated features. Embodiments also include by a system and computer-readable medium with instructions for executing the above method.