Abstract: Techniques for model interpretability for anomaly detection are provided. In one technique, a machine-learned (ML) model is trained based on training data that comprises first input data and first target data. Using the ML model, (1) first output data is generated based on the first input data and (2) second output data is generated based on second input data. For each data item in the second output data, a difference is generated between the data item and a corresponding data item in second target data that corresponds to the second output data. If the difference is greater than a threshold, then the data item, the corresponding data item, and a corresponding data item in the second input data are identified as an anomalous set. Second training data is generated based on the first training data and the identified anomalous sets and is used to train a second ML model.

Abstract: Methods for detecting and mitigating abusive network activity based on versioned browser usage are performed by systems and devices. Usage values for network activity of legacy web browser versions are determined, where the usage values represent benign network activity associated with active instances of the legacy versions over prior time periods. The number of active instances of legacy browser versions is assumed to generally be monotonically decreasing over time, and thus a bound of benign network activity for each of the legacy versions can be estimated by associating an approximate percentage of benign traffic with a minimum past usage value. Current network activity is monitored to determine current usage values for the legacy versions, and network actions are performed based on current usage values deviating from past usage values according to the bound.

Abstract: A site monitoring method uses an electrical socket device to collect current data of an electrical appliance that is electrically connected to the electrical socket device. Based on the current data, a management server can derive a user behavior in connection with using the electrical appliance, and send out a warning message when the user behavior thus derived is abnormal.

Abstract: Methods for detecting and mitigating abusive network activity based on versioned browser usage are performed by systems and devices. Usage values for network activity of legacy web browser versions are determined, where the usage values represent benign network activity associated with active instances of the legacy versions over prior time periods. The number of active instances of legacy browser versions is assumed to generally be monotonically decreasing over time, and thus a bound of benign network activity for each of the legacy versions can be estimated by associating an approximate percentage of benign traffic with a minimum past usage value. Current network activity is monitored to determine current usage values for the legacy versions, and network actions are performed based on current usage values deviating from past usage values according to the bound.

Abstract: A bot traffic detection system detects scripted network traffic. The bot traffic detection system may use a one-sided unsupervised machine learning technique to estimate distributions for human, non-scripted traffic (clean distributions). The clean distributions may be dynamically updated based on the latest traffic patterns. To estimate the clean distributions the bot traffic detection system may identify, for a certain subset of network traffic, feature values of the certain subset of network traffic that do not include bot traffic (clean buckets). Using clean traffic may provide more robust and stable behavior that can be tracked over time. Using the clean distributions, the bot traffic detection system may generate a rules table that indicates a likelihood that network traffic with a given combination of feature values is scripted network traffic. The bot traffic detection system may apply the rules table in real time to identify scripted network traffic.

Abstract: A site monitoring method uses an electrical socket device to collect current data of an electrical appliance that is electrically connected to the electrical socket device. Based on the current data, a management server can derive a user behavior in connection with using the electrical appliance, and send out a warning message when the user behavior thus derived is abnormal.

Abstract: A bot traffic detection system detects scripted network traffic. The bot traffic detection system may use a one-sided unsupervised machine learning technique to estimate distributions for human, non-scripted traffic (clean distributions). The clean distributions may be dynamically updated based on the latest traffic patterns. To estimate the clean distributions the bot traffic detection system may identify, for a certain subset of network traffic, feature values of the certain subset of network traffic that do not include bot traffic (clean buckets). Using clean traffic may provide more robust and stable behavior that can be tracked over time. Using the clean distributions, the bot traffic detection system may generate a rules table that indicates a likelihood that network traffic with a given combination of feature values is scripted network traffic. The bot traffic detection system may apply the rules table in real time to identify scripted network traffic.

Abstract: A method for completing message-playback on an electronic device involves: detection of an unplayed message storage, determining the facial images of the message recipients associated with the unplayed message, capturing facial images of members in front of the electronic device, comparing the facial images associated with the unplayed message with the captured facial image, determining whether there is at least one member who has not received this message who is in front of the electronic device according to the comparison, and if so playing the message.

Abstract: A server includes a communication module, a database and a processor. The communication module receives identification information of a user of a mobile terminal and a movement status and a geographic position of the user from the mobile terminal. The processor determines real time traffic condition of the geographic position of the user according to the real time traffic information of the area where the user is located stored in the database and evaluates a time period to be spent from the geographic position of the user to the display terminal according to the movement status of the user and the real time traffic condition of the area. The communication module further transmits the geographic position of the user, the evaluated time period and the identification information of the user to the display terminal. A system including the server and a method of displaying a user status are also disclosed.

Abstract: A method for displaying video image of a television includes processing video signals corresponding to video images transmitted from an electronic device and determining whether the TV programs are displayed on a full displaying window or on a partial displaying window. The display is controlled to provide a first video image displaying window overlaying the full displaying window if the TV programs are displayed on the full displaying window or provide a second video image displaying window spaced from the partial displaying window if the TV programs are displayed on the partial displaying window. The video image is displayed in the first video image displaying window or the second video image displaying window. Any human faces in the video image displayed in the first video image displaying window cause the video image to be transparent except for the faces. A related TV is also provided.

Abstract: Use of a failure model is disclosed which can be used to probabilistically evaluate possible failure modes in the event of failure of a complex component when no forensic analysis of the failed component is performed. When component failures do occur, contemporaneous sensor and operation data may be used to update and refine the failure model, whether a forensic analysis of the failed component is performed or not. Further, when no component failure is reported, the contemporaneous sensor and operation data may be used to predict component failures.

Abstract: A terminal for recording video message includes an audio capture unit, an image capture unit, a storage unit and a processing unit. The audio capture unit captures audio data. The image capture unit captures image data. The image data is associated with the captured audio data. The storage unit stores identities of recipients. The processing unit determines one or more recipients of a video message. A video message is created and the relationships between the one or more determined recipients and the created message are established. The created message and the established relationships are transmitted to an apparatus for broadcasting the video message.

Abstract: A method for completing message-playback on an electronic device involves: detection of an unplayed message storage, determining the facial images of the message recipients associated with the unplayed message, capturing facial images of members in front of the electronic device, comparing the facial images associated with the unplayed message with the captured facial image, determining whether there is at least one member who has not received this message who is in front of the electronic device according to the comparison, and if so playing the message.

Abstract: A method for broadcasting TV show as used in a smart TV. The smart TV comprises a body, a facial image capturing unit and a storage unit. The storage unit stores facial images of registered users and a mapping relationship between a number of favorite TV show lists and a number of accounts. The method comprises following steps. Capturing the facial images in front of the facial image capturing unit, identifying whether the captured facial images contain one or more facial images of registered users of the smart TV and identify the number of the registered users contained in the captured facial images. In addition, controlling the smart TV to enter a broadcasting mode according to the identified users. Importing TV shows associated with the broadcasting mode of the smart TV and the favorite TV show lists. A smart TV is also provided by the present disclosure.

Abstract: A server includes a communication module, a database and a processor. The communication module receives identification information of a user of a mobile terminal and a movement status and a geographic position of the user from the mobile terminal. The processor determines real time traffic condition of the geographic position of the user according to the real time traffic information of the area where the user is located stored in the database and evaluates a time period to be spent from the geographic position of the user to the display terminal according to the movement status of the user and the real time traffic condition of the area. The communication module further transmits the geographic position of the user, the evaluated time period and the identification information of the user to the display terminal. A system including the server and a method of displaying a user status are also disclosed.

Abstract: A method for displaying video image of a television includes processing video signals corresponding to video images transmitted from an electronic device and determining whether the TV programs are displayed on a full displaying window or on a partial displaying window. The display is controlled to provide a first video image displaying window overlaying the full displaying window if the TV programs are displayed on the full displaying window or provide a second video image displaying window spaced from the partial displaying window if the TV programs are displayed on the partial displaying window. The video image is displayed in the first video image displaying window or the second video image displaying window. Any human faces in the video image displayed in the first video image displaying window cause the video image to be transparent except for the faces. A related TV is also provided.