Abstract: A method of generating relevant security rules for a user includes the steps of: building a first tree data structure from paths within a pool of security rules; collecting process paths for the user; and compiling the relevant security rules for the user by traversing the first tree data structure according to the process paths of the user.

Abstract: The disclosure provides an approach for detecting and preventing attacks in a network. Embodiments include determining a plurality of network behaviors of a process by monitoring the process. Embodiments include generating a plurality of intended states for the process based on subsets of the plurality of network behaviors. Embodiments include determining a plurality of intended state clusters by applying a clustering technique to the plurality of intended states. Embodiments include determining a state of the process. Embodiments include identifying a given cluster of the plurality of intended state clusters that corresponds to the state of the process. Embodiments include selecting a novelty detection technique based on a size of the given cluster. Embodiments include using the novelty detection technique to determine, based on the given cluster and the state of the process, whether to generate a security alert for the process.

Abstract: A method of generating relevant security rules for a user includes the steps of: building a first tree data structure from paths within a pool of security rules; collecting process paths for the user; and compiling the relevant security rules for the user by traversing the first tree data structure according to the process paths of the user.

Abstract: The disclosure provides an approach for detecting and preventing attacks in a network. Embodiments include determining a plurality of network behaviors of a process by monitoring the process. Embodiments include generating a plurality of intended states for the process based on subsets of the plurality of network behaviors. Embodiments include determining a plurality of intended state clusters by applying a clustering technique to the plurality of intended states. Embodiments include determining a state of the process. Embodiments include identifying a given cluster of the plurality of intended state clusters that corresponds to the state of the process. Embodiments include selecting a novelty detection technique based on a size of the given cluster. Embodiments include using the novelty detection technique to determine, based on the given cluster and the state of the process, whether to generate a security alert for the process.

Abstract: Certain embodiments described herein are generally directed to improving performance of one or more machines within a system by clustering multidimensional datasets relating to the performance of the machines using inter-group dissimilarities between groups of the dataset. The method for improving performance of one or more machines within a system, includes forming a multidimensional dataset having a plurality of groups using performance related data associated with one or more machines in the system, clustering the plurality of groups into one or more clusters based on intergroup dissimilarities between the plurality of groups, identifying one or more anomalous clusters from among the one or more clusters, identifying the one or more anomalous groups in the one or more anomalous clusters, and adjusting a configuration of the system to improve the performance of the one or more machines corresponding to the one or more anomalous groups.

Abstract: Certain embodiments described herein are generally directed to improving performance of one or more machines within a system by clustering multidimensional datasets relating to the performance of the machines using inter-group dissimilarities between groups of the dataset. The method for improving performance of one or more machines within a system, includes forming a multidimensional dataset having a plurality of groups using performance related data associated with one or more machines in the system, clustering the plurality of groups into one or more clusters based on intergroup dissimilarities between the plurality of groups, identifying one or more anomalous clusters from among the one or more clusters, identifying the one or more anomalous groups in the one or more anomalous clusters, and adjusting a configuration of the system to improve the performance of the one or more machines corresponding to the one or more anomalous groups.

Abstract: Systems and methods for prioritizing transmission control protocol (TCP) flows for communication devices in a network are described herein. The systems and methods herein may further allocate bandwidth to the flows based on the priority of the flows. Further, the systems and methods herein allow devices to determine whether particular flows share a traffic flow constraint or bottleneck that limits the overall available bandwidth to the flows. Therefore, allocation of bandwidth for one flow may be adjusted based on allocation of bandwidth to another flow if the flows share a traffic flow constraint. Further, the systems and methods herein allow for target data rates to be determined for the flows based on shared traffic flow constraints.

Abstract: Systems and methods for prioritizing transmission control protocol (TCP) flows for communication devices in a network are described herein. The systems and methods herein may further allocate bandwidth to the flows based on the priority of the flows. Further, the systems and methods herein allow devices to determine whether particular flows share a traffic flow constraint or bottleneck that limits the overall available bandwidth to the flows. Therefore, allocation of bandwidth for one flow may be adjusted based on allocation of bandwidth to another flow if the flows share a traffic flow constraint. Further, the systems and methods herein allow for target data rates to be determined for the flows based on shared traffic flow constraints.