Abstract: Techniques described herein relate to a method for predicting results using ensemble models. The method may include receiving trained model data sets from a model source nodes, each trained model data set comprising a trained model, an important feature list, and a missing feature generator; receiving a prediction request data set; making a determination that the prediction request data set does not include an input feature for a trained model; generating, based on the determination and using a missing feature generator, a substitute feature to replace the input feature; executing the trained model using the prediction request data set and the substitute feature to obtain a first prediction; executing a second trained model using the prediction request data set to obtain a second prediction; and obtaining a final prediction using the first prediction, the second prediction, and an ensemble model.

Abstract: Detection of abnormal node behavior and attacks by a node(s) can be enhancedly performed and managed. A security management component (SMC) of a collective node of a node group can analyze respective groups of residual vectors associated with respective features and associated with and received from respective nodes of the node group. Based on the analysis and defined security management criteria relating to abnormal node behavior and attacks, SMC can determine whether there is abnormal node behavior and/or an attack by one or more nodes. In response to detected abnormal node behavior and/or attack by a node(s), SMC can perform a desired mitigation action. Respective SMCs of the respective nodes of the node group also can perform respective determinations regarding whether an abnormal node behavior and/or attack by a respective node exists based on their respective analysis of their respective groups of residual vectors.

Abstract: One example method includes data protection operations including cyber security operations, threat detection operations, and other security operations. Normal device behavior is learned based on data collected by an anomaly detection engine operating in a kernel. The normal data is used to train a machine learning model. Threats are detected when the machine learning model indicates that new data points deviate from normal device behavior. Associated processes are stopped. This allows threats to be detected based on normal behavior rather than on unknown threat behavior.

Abstract: One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

Abstract: An example system includes a camera and a display operable to display text to a human. The system is operable to perform a method that includes tracking, with the camera, eye movements of a human as the human reads text presented by the display, collecting eye movement data, analyzing the eye movement data, based on the analyzing, determining whether or not Irlen Syndrome is indicated by the eye movement data, and when Irlen Syndrome is indicated, adjusting a parameter of the display.

Abstract: A method and system for implementing superseded federated learning. Superseded federated learning may entail a novel, performance-efficient federated learning technique designed to further decouple multiparty dependency on one another, as well as any third-parties, while collaborating in multiparty computations. Specifically, unlike any current federated learning methodology, superseded federated learning eliminates the complex and often inefficient coordination amongst parties, as well as removes third-party participation, during the classification or prediction inference phase of multiparty collaborations.

Abstract: Techniques described herein relate to a method for predicting results using ensemble models. The method may include receiving trained model data sets from a model source nodes, each trained model data set comprising a trained model, an important feature list, and a missing feature generator; receiving a prediction request data set; making a determination that the prediction request data set does not include an input feature for a trained model; generating, based on the determination and using a missing feature generator, a substitute feature to replace the input feature; executing the trained model using the prediction request data set and the substitute feature to obtain a first prediction; executing a second trained model using the prediction request data set to obtain a second prediction; and obtaining a final prediction using the first prediction, the second prediction, and an ensemble model.

Abstract: Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp.

Abstract: One example method includes data protection operations including cyber security operations, threat detection operations, and other security operations. Normal device behavior is learned based on data collected by an anomaly detection engine operating in a kernel. The normal data is used to train a machine learning model. Threats are detected when the machine learning model indicates that new data points deviate from normal device behavior. Associated processes are stopped. This allows threats to be detected based on normal behavior rather than on unknown threat behavior.

Abstract: One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

Abstract: Systems and methods are provided for sharing context of a mobile device among base station nodes for mobility management in mobile communications networks. An active connection is established between a first base station node and a mobile device, within radio access network of a mobile communications network. Other base station nodes in the radio access network within a tracking area of the mobile device are identified, and a state propagation process is performed to share a state of the active connection between the first base station node and the mobile device with at least a second base station node determined to be within the tracking area of the mobile device. The shared state is utilized to enable the mobile device to seamlessly establish an active connection with the second base station node and communicate with the mobile communications network through the active connection with the second base station node.

Abstract: Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp.

Abstract: The present disclosure involves systems, software, and computer implemented methods for correlating critical events to identified log data. An example event log analyzer can identify a set of log messages. One or more occurrences of a first critical event and a time of each of the occurrences are identified. One or more candidate subsets of log messages are identified. Each log message in each candidate subset is associated with a timestamp that is within a predefined time window prior to the time of an occurrence of the first critical event. A candidate subset of log messages is selected as a correlator of the first critical event. A rule is defined using the selected candidate subset of log messages. The rule defines a second critical event that correlates to the first critical event. The rule is associated with one or more actions to perform when the second critical event occurs.

Abstract: Systems and methods are provided for sharing context of a mobile device among base station nodes for mobility management in mobile communications networks. An active connection is established between a first base station node and a mobile device, within radio access network of a mobile communications network. Other base station nodes in the radio access network within a tracking area of the mobile device are identified, and a state propagation process is performed to share a state of the active connection between the first base station node and the mobile device with at least a second base station node determined to be within the tracking area of the mobile device. The shared state is utilized to enable the mobile device to seamlessly establish an active connection with the second base station node and communicate with the mobile communications network through the active connection with the second base station node.

Abstract: The present disclosure involves systems, software, and computer implemented methods for correlating critical events to identified log data. An example event log analyzer can identify a set of log messages. One or more occurrences of a first critical event and a time of each of the occurrences are identified. One or more candidate subsets of log messages are identified. Each log message in each candidate subset is associated with a timestamp that is within a predefined time window prior to the time of an occurrence of the first critical event. A candidate subset of log messages is selected as a correlator of the first critical event. A rule is defined using the selected candidate subset of log messages. The rule defines a second critical event that correlates to the first critical event. The rule is associated with one or more actions to perform when the second critical event occurs.