Abstract: A method of detecting anomalous user behavior in a cloud environment includes calculating a first vector that is representative of actions taken during a plurality of previous time intervals; calculating a similarity between the first vector and a second vector that comprises counts of actions taken by the user during a current time interval; comparing the similarity to a baseline threshold to determine whether one or more anomalous actions have occurred; and generating an alert based at least in part on a determination that the one or more anomalous actions have occurred in the cloud environment.

Abstract: A method of detecting anomalous user behavior in a cloud environment includes receiving a vector that comprises counts of actions taken by the user during a current time interval; determining whether an action count in the vector is greater than a global mean; building a scale table by combining new action skills that are above a threshold and original action skills if below the threshold; and identifying outliers when the action count is greater than the global mean multiplied by a corresponding action scale from the scale table.

Abstract: A method of distinguishing between human and computer actions in a cloud environment includes receiving one or more actions from a monitored cloud environment; identifying a text string associated with the one or more actions; calculating an entropy value for the text string; determining whether the text string is bot-generated based at least in part on the entropy value; and determining whether to generate an alert based at least in part on a result of determining whether the text string is bot-generated.

Abstract: A method of detecting anomalous user behavior in a cloud environment includes calculating a first vector that is representative of actions taken during a plurality of previous time intervals; calculating a similarity between the first vector and a second vector that comprises counts of actions taken by the user during a current time interval; comparing the similarity to a baseline threshold to determine whether one or more anomalous actions have occurred; and generating an alert based at least in part on a determination that the one or more anomalous actions have occurred in the cloud environment.

Abstract: A method of distinguishing between human and computer actions in a cloud environment includes receiving one or more actions from a monitored cloud environment; identifying a text string associated with the one or more actions; calculating an entropy value for the text string; determining whether the text string is bot-generated based at least in part on the entropy value; and determining whether to generate an alert based at least in part on a result of determining whether the text string is bot-generated.

Abstract: A method of detecting anomalous user behavior in a cloud environment includes receiving a vector that comprises counts of actions taken by the user during a current time interval; determining whether an action count in the vector is greater than a global mean; building a scale table by combining new action skills that are above a threshold and original action skills if below the threshold; and identifying outliers when the action count is greater than the global mean multiplied by a corresponding action scale from the scale table.

Abstract: Methods and systems are provided for recording natural conversation of a user of a vehicle. In one embodiment, a method includes: recognizing speech from the recording; processing the recognized speech to determine a meaning associated with the speech; identifying a category of the speech based on the meaning; and generating a maintenance report to be used by a maintainer of the vehicle based on the category and the speech.

Abstract: Embodiments include methods for analyzing information performed by a data analysis system. The method includes parsing data from one or more data sources, resulting in parsed data, forming a plurality of chains of terms from the parsed data, and determining a significance score for an entity identified in one or more of the chains based, at least in part, on one or more positions of the entity within the one or more chains. Embodiments of the method may be used to identify entities of significance (e.g., in a group, organization or social network).

Abstract: Embodiments include methods for analyzing information performed by a data analysis system. The method includes parsing data from one or more data sources, resulting in parsed data, forming a plurality of chains of terms from the parsed data, and determining a significance score for an entity identified in one or more of the chains based, at least in part, on one or more positions of the entity within the one or more chains. Embodiments of the method may be used to identify entities of significance (e.g., in a group, organization or social network).