Abstract: In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a control module. The control module is to protect information regarding a machine learning model owned by a third party. The information is protected in a memory communicatively coupled to the control module. In response to receiving an indication that a computing device under control of the control module complies with a third party policy associated with the machine learning model, the control module is to release the information to the computing device.

Abstract: In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a control module. The control module determines whether a computing device communicatively coupled to the control module is in a specified state for executing a machine learning model controlled by a third party entity. In response to determining that the computing device is in the specified state, the control module is to send, to an attestation module in a data processing pipeline associated with the computing device, an indication that the computing device is in the specified state.

Abstract: In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a generating module, a signing module and an interfacing module. The generating module is to generate a statement comprising: a control plane indicator to indicate a control plane state of a computing device used to execute a machine learning model. The statement further comprises information regarding the machine learning model. The signing module is to generate a signature for the statement using an attestation key associated with the apparatus. The interfacing module is to send the statement and the signature to a requesting entity.

Abstract: A method is disclosed. The method comprises analyzing, using a processing apparatus, event log entries of a plurality of devices, the plurality of devices forming part of a group of devices sharing a common attribute, wherein event log entries of a device relate to events that have taken place during a first period of interest in respect of that device. The method also comprises determining, using the processing apparatus, for a given device in the group of devices, based on the analysis of event log entries, a predicted entry that is expected to appear in the event log of the given device during the first period of interest. An apparatus and a machine-readable medium are also disclosed.

Abstract: An apparatus and method is described comprising: classifying service ticket data relating to a service request into a service topic, wherein the service ticket data is obtained from the service request relating to a device; determining, for the service request, an extent to which the service topic matches a telemetry data class, wherein the telemetry data class relates to activities at the device; and providing an output according to said determination.

Abstract: In some examples, a system determines a difference between a received time indication and a previous time indication, performs a modular arithmetic operation with respect to a first integer on the difference, and increments a count related to a first set associated with a first result of the modular arithmetic operation. The system compares respective counts associated with respective sets of a plurality of sets including the first set, wherein each set of the plurality of sets is associated with a different result of the modular arithmetic operation, and detects an occurrence of a security intrusion based on the comparison.

Abstract: In an example, a method includes analysing data collected from a service. A value representative of the number of anomalies in the data is generated, this value then being compared with a threshold. Depending on whether the value is greater or less than the threshold, a performance parameter of the monitoring service may be evaluated.

Abstract: Configuring analytics to be performed at an endpoint device, comprising receiving at least one analytic input determined from instrumented processes operated at the endpoint device, performing at least one analytic of a set of analytics stored in the endpoint device, to produce a respective analytic output, transmitting the at least one analytic output to the server, receiving, from the server, at least one analytics configuration update, based on measures indicative of the usefulness of the analytics calculated at the server, to reconfigure at least one of the set of analytics stored in the endpoint device. Based on the received analytics configuration updates, the endpoint device reconfigures at least one of the set of analytics by at least one of: stopping or starting performing the analytic, and tuning how the analytic is performed.

Abstract: In an example there is provided a method to access data records generated by a computing device, the data records specifying at least an event log of in-device code executed by the computing device. The method comprises applying pattern recognition to the data records of the computing device to determine if the computing device needs in-device code maintenance and performing maintenance of the in-device code on the computing device in response to the output of the pattern recognition.

Abstract: A method of operating a service provider server and a computing device to provide anonymous service access. For the service provider server, the method comprises: receiving a service message from a computing device; and determining whether to send a service response message, and if so sending a service response message. The service message includes a pseudonym associated with the computing device, service data and a signature on the pseudonym generated by either the service provider server or an identity manager. The service response message is broadcast by the service provider server or transmitted to the identity manager.

Abstract: In an example, a method includes receiving, at a server device, a record of an event transmitted from a client device which occurred on the client device. At the server device, a record of the event is generated, by a processor. The received record is compared with the record generated at the server device. When at least a portion of the record generated at the server device is not found in the received record, an alert is issued.

Abstract: In an example, a method includes analysing data collected from a service. A value representative of the number of anomalies in the data is generated, this value then being compared with a threshold. Depending on whether the value is greater or less than the threshold, a performance parameter of the monitoring service may be evaluated.

Abstract: Examples disclosed herein relate to detecting an activity based on time difference metrics. In one implementation, a processor determines metrics related to the differences between the sizes of sets. For example, each set may include time indications that result in the particular integer associated with the set when a modular operation is performed on a difference between the respective time indication and a first time indication. The processor may detect a pattern indicative of an activity based on the metrics and output an indication that the activity is detected.

Abstract: In some examples, a system determines a difference between a received time indication and a previous time indication, performs a modular arithmetic operation with respect to a first integer on the difference, and increments a count related to a first set associated with a first result of the modular arithmetic operation. The system compares respective counts associated with respective sets of a plurality of sets including the first set, wherein each set of the plurality of sets is associated with a different result of the modular arithmetic operation, and detects an occurrence of a security intrusion based on the comparison.

Abstract: Examples disclosed herein relate to detecting an activity based on time difference metrics. In one implementation, a processor determines metrics related to the differences between the sizes of sets. For example, each set may include time indications that result in the particular integer associated with the set when a modular operation is performed on a difference between the respective time indication and a first time indication. The processor may detect a pattern indicative of an activity based on the metrics and output an indication that the activity is detected.