Abstract: A method for training, on a training set of cybersecurity-incident samples, a boosted ensemble of N decision trees configured to prioritize cybersecurity incidents based on features of the incidents includes training a first k of the decision trees in the ensemble on the cybersecurity-incident samples while excluding a predetermined subset of the features from each of the cybersecurity-incident samples, and subsequently to training the first k of the decision trees, completing the training of the boosted ensemble, by training N-k of the decision trees that follow the first k of the decision trees in the ensemble without excluding the predetermined subset of the features. Other embodiments are also described.

Abstract: Methods, storage systems and computer program products implement embodiments of the present invention that include initially defining a set of protective actions. Upon detecting, by a security server on a network, an incident including one or more alerts indicating malicious activity by one or more computing devices on the network, extracting a set of features indicating measurable characteristics of the incident are extracted from the alerts. Based on the alerts, respective counts for the features for the detected incident are computed and based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident is computed. A given feature having a highest impact on the score is identified, and a given protective action is selected based on the score, the identified feature and its respective count. Finally, the selected protective action is initiated with respect to at least some of the devices.

Abstract: A method, including receiving first files, having respective first labels, and extracting respective first features from the files. A model including a set of decision trees is trained based on the respective features and labels of the files. Some but not all of the trees in the set are removed from the model so as to define an abridged model including an abridged set of the trees. Upon receiving second files, which are different from the first files and have respective second labels, respective second features are extracted from the second files, and respective classification scores are computed for the first and the second files by applying the abridged model. An augmented model is trained by adding further trees to the abridged set based on the respective scores and respective labels and features of the first and the second files, and the augmented model is applied to classify further files.

Abstract: A method for cybersecurity includes receiving a corpus of cyber incidents, each including (i) one or more alerts indicative of suspicious activities in one or more computer systems, and (ii) one or more features characterizing the cyber incident. Binary labels respectively assigned to the cyber incidents of the corpus are further received, each of the binary labels having a first value indicating the cyber incident is benign, or a second value indicating the cyber incident is malicious. Predefined labeling rules that map the binary labels to respective soft labels that are indicative of suspiciousness levels of the cyber incidents are held. The binary labels are mapped to respective soft labels, based at least on the predefined labeling rules. The cyber incidents of the corpus and the respective soft labels are provided for training a machine learning model that, when trained, predicts risk scores for cyber incidents outside the corpus.

Abstract: Methods, storage systems and computer program products implement embodiments of the present invention that include initially defining a set of protective actions. Upon detecting, by a security server on a network, an incident including one or more alerts indicating malicious activity by one or more computing devices on the network, extracting a set of features indicating measurable characteristics of the incident are extracted from the alerts. Based on the alerts, respective counts for the features for the detected incident are computed and based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident is computed. A given feature having a highest impact on the score is identified, and a given protective action is selected based on the score, the identified feature and its respective count. Finally, the selected protective action is initiated with respect to at least some of the devices.

Abstract: A method, including receiving, from multiple sources, respective sets of incidents, and respective suspiciousness labels for the incidents. A set of rules are applied so as to assign training labels to respective incidents in a subset of the incidents in the received sets. For each given incident in the subset, the respective training label is compared to the respective suspiciousness label so as to compute a respective quality score for each given source. Any sources having respective label quality scores meeting a predefined criterion are identified, and a model for computing predicted labels is fit to the incidents received from the identified sources and the respective suspiciousness labels of the incidents. The model is applied to an additional incident received from one of the sources to compute a predicted label for the additional incident, and a notification of the additional incident is prioritized in response to the predicted label.

Abstract: A method, including receiving, from multiple sources, respective sets of incidents, and respective suspiciousness labels for the incidents. A set of rules are applied so as to assign training labels to respective incidents in a subset of the incidents in the received sets. For each given incident in the subset, the respective training label is compared to the respective suspiciousness label so as to compute a respective quality score for each given source. Any sources having respective label quality scores meeting a predefined criterion are identified, and a model for computing predicted labels is fit to the incidents received from the identified sources and the respective suspiciousness labels of the incidents. The model is applied to an additional incident received from one of the sources to compute a predicted label for the additional incident, and a notification of the additional incident is prioritized in response to the predicted label.

Abstract: A gas analyzing module includes a first connector, which includes a connection detection mechanism (CDM), and is connectable to a gas sampling line via a second connector. The gas analyzing module also includes a pump, a pressure sensor and a controller. The controller controls operation of the pump and receives a signal from the CDM. When the pump is on/active, the controller measures the CDM output signal, and if the CDM output signal indicates misconnection between the first connector and the second connector, the controller switches the pump off only if a pressure measured in the gas sampling line corroborates the CDM's misconnection indication, or, if the measured pressure refutes the CDM's misconnection indication, the controller maintains the pump's on state. The gas analyzing module may be a capnography module configured for capnography. Also provided is a gas analyzing system that includes the gas analyzing module and a gas analyzer.

Abstract: A system including at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive, using a first transceiver, a radio-frequency (RF) transmission from an RF device; extract, from said RF transmission, at least one of: (i) noise samples from one or more segments of said RF transmission, and (ii) signal samples from one or more segments of said RF transmission; and determine the presence of a second transceiver in the path of said RF transmission, based, at least in part, on processing said extracted noise samples and signal samples.

Abstract: A system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive, using a first transceiver, a radio-frequency (RF) transmission from an RF device; extract, from said RF transmission, at least one of: (i) noise samples from one or more segments of said RF transmission, and (ii) signal samples from one or more segments of said RF transmission; and determine the presence of a second transceiver in the path of said RF transmission, based, at least in part, on processing said extracted noise samples and signal samples.

Abstract: A method including operating at least one hardware processor for: receiving, using a first transceiver, a radio-frequency (RF) transmission from an RF device; extracting one or more signal samples from said RF transmission, wherein the signal samples are associated with at least one of: (i) a rise transient associated with a data packet of said RF transmission, (ii) a fall transient associated with the data packet, and (iii) a region of the RF transmission occurring between the rise transient and the fall transient; and determining the presence of a second transceiver in the path of the RF transmission, based, at least in part, on processing the signal samples.

Abstract: A method comprising operating at least one hardware processor for: receiving, using a first transceiver, a radio-frequency (RF) transmission from an RF device; extracting one or more signal samples from said RF transmission, wherein said signal samples are associated with at least one of: (i) a rise transient associated with a data packet of said RF transmission, (ii) a fall transient associated with said data packet, and (iii) a region of said RF transmission occurring between said rise transient and said fall transient; and determining the presence of a second transceiver in the path of said RF transmission, based, at least in part, on processing said signal samples.

Abstract: A gas analyzing module includes a first connector, which includes a connection detection mechanism (CDM), and is connectable to a gas sampling line via a second connector. The gas analyzing module also includes a pump, a pressure sensor and a controller. The controller controls operation of the pump and receives a signal from the CDM. When the pump is on/active, the controller measures the CDM output signal, and if the CDM output signal indicates misconnection between the first connector and the second connector, the controller switches the pump off only if a pressure measured in the gas sampling line corroborates the CDM's misconnection indication, or, if the measured pressure refutes the CDM's misconnection indication, the controller maintains the pump's on state. The gas analyzing module may be a capnography module configured for capnography. Also provided is a gas analyzing system that includes the gas analyzing module and a gas analyzer.

Abstract: A silencer device may be positioned in-line with an exhaust tube of a pneumatic pump to reduce a noise generated at the exhaust tube. The silencer devices includes a noise absorbing media and a body section housing the noise absorbing media and radially sealing peripheral walls thereof. The silencer device also includes a fluid inlet section having an inlet tube that directs fluid flow from the exhaust tube into the noise absorbing media and an inlet airflow restrictor fluidly connected to the fluid inlet section to restrict fluid flow therethrough. The silencer device further includes a fluid outlet section having an outlet tube that directs fluid flow from the noise absorbing media and an outlet airflow restrictor fluidly connected to the fluid outlet section to restrict fluid flow therethrough.

Abstract: There is provided a tube connector for connecting between a fluid sampling tube and a fluid analyzer, the tube connector includes an end face adapted to identify the tube connector, said end face comprising a reflecting surface having one or more reflective regions adapted to reflect light at a predetermined range of wavelengths.

Abstract: There is provided a tube connector for connecting between a fluid sampling tube and a fluid analyzer, the tube connector includes an end face adapted to identify the tube connector, said end face comprising a reflecting surface having one or more reflective regions adapted to reflect light at a predetermined range of wavelengths.

Abstract: There is provided a tube connector for connecting between a fluid sampling tube and a fluid analyzer, the tube connector includes an end face adapted to identify the tube connector, said end face comprising a reflecting surface having one or more reflective regions adapted to reflect light at a predetermined range of wavelengths.

Abstract: There is provided a tube connector for connecting between a fluid sampling tube and a fluid analyzer, the tube connector includes an end face adapted to identify the tube connector, said end face comprising a reflecting surface having one or more reflective regions adapted to reflect light at a predetermined range of wavelengths.

Abstract: There is provided a tube connector for connecting between a fluid sampling tube and a fluid analyzer, the tube connector includes an end face adapted to identify the tube connector, said end face comprising a reflecting surface having one or more reflective regions adapted to reflect light at a predetermined range of wavelengths.

Abstract: There is provided a tube connector for connecting between a fluid sampling tube and a fluid analyzer, the tube connector includes an end face adapted to identify the tube connector, said end face comprising a reflecting surface having one or more reflective regions adapted to reflect light at a predetermined range of wavelengths.