Abstract: A digital security system can store data associated with entities in resolver trees. If the digital security system determines that two resolver trees are likely representing the same entity, the digital security system can use a merge operation to merge the resolver trees into a single resolver tree that represents the entity. The single resolver tree can include a merge node indicating a merge identifier of the merge operation. Nodes containing information merged into the resolver tree from another resolver tree during the merge operation can be tagged with the corresponding merge identifier. Accordingly, if the merge operation is to be undone, for instance if subsequent information indicates that the entries are likely separate entities, the resolver tree can be unmerged and the nodes tagged with the merge identifier can be restored to a separate resolver tree.

Abstract: An event query host can include an event processor configured to process an event stream indicating events that occurred on a computing device. The event processor can add representations of events to an event graph. If an event added to the event graph is a trigger event associated with a query, the event processor can also add an instance of the query to a query queue. The query queue can be sorted based on scheduled execution times of query instances. At a scheduled execution time of a query instance in the query queue, a query manager of the event query host can execute the query instance and attempt to find a corresponding pattern of one or more events in the event graph.

Abstract: An Automatic Dependent Surveillance Broadcast (ADS-B) system may include a plurality of ADS-B terrestrial stations, with each ADS-B terrestrial station comprising an antenna and wireless circuitry associated therewith defining a station gain pattern. The system may further include a controller including a variational autoencoder (VAE) configured to compress station pattern data from the plurality of ADS-B terrestrial stations, create a normal distribution of the compressed data in a latent space of the VAE, and decompress the compressed station pattern data from the latent space. The controller may also include a processor coupled to the VAE and configured to process the decompressed station pattern data using a probabilistic model selected from among different probabilistic models based upon a game theoretic reward matrix, determine an anomaly from the processed decompressed station pattern data, and generate an alert (e.g., a station specific alert) based upon the determined anomaly.

Abstract: An event query host can include an event processor configured to process an event stream indicating events that occurred on a computing device. The event processor can add representations of events to an event graph. If an event added to the event graph is a trigger event associated with a query, the event processor can also add an instance of the query to a query queue. The query queue can be sorted based on scheduled execution times of query instances. At a scheduled execution time of a query instance in the query queue, a query manager of the event query host can execute the query instance and attempt to find a corresponding pattern of one or more events in the event graph.

Abstract: A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.

Abstract: Systems and methods for detecting anomalies in antenna systems (e.g., air traffic control surveillance systems), include a processor receiving antenna status information. A variational autoencoder receives and optimizes the antenna status information and determines whether it qualifies as an anomaly. Optimized antenna status information is compared to either non-anomalous or anomalous antenna status data in a latent space of the variational autoencoder. The latent space preferably includes an n-D point scatter plot and hidden vector values. The processor optimizes the antenna status information by generating a plurality of probabilistic models of the antenna status information and determining which of the plurality of models is optimal. A game theoretic optimization is applied to the plurality of models, and the best model is used to generate the n-D point scatter plot in latent space. An image gradient sobel edge detector preprocesses the antenna status information prior to optimization.

Abstract: A digital security system can store data associated with entities in resolver trees. If the digital security system determines that two resolver trees are likely representing the same entity, the digital security system can use a merge operation to merge the resolver trees into a single resolver tree that represents the entity. The single resolver tree can include a merge node indicating a merge identifier of the merge operation. Nodes containing information merged into the resolver tree from another resolver tree during the merge operation can be tagged with the corresponding merge identifier. Accordingly, if the merge operation is to be undone, for instance if subsequent information indicates that the entries are likely separate entities, the resolver tree can be unmerged and the nodes tagged with the merge identifier can be restored to a separate resolver tree.

Abstract: A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.

Abstract: An event query host can include an event processor configured to process an event stream indicating events that occurred on a computing device. The event processor can add representations of events to an event graph. If an event added to the event graph is a trigger event associated with a query, the event processor can also add an instance of the query to a query queue. The query queue can be sorted based on scheduled execution times of query instances. At a scheduled execution time of a query instance in the query queue, a query manager of the event query host can execute the query instance and attempt to find a corresponding pattern of one or more events in the event graph.

Abstract: A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.

Abstract: Functionality is disclosed herein for changing a user experience using application events. Events that occur while an application is executing are provided to an application service. The events may be stored on the computing device executing the application before the events are provided to the application service. The application service uses the events to generate a plan that includes data identifying one or more actions for the application to perform. The events used to generate the plan may include events received from other users who also interact with the application. The plan is used by an application to select one or more actions to perform to move the user interacting with the application closer to a goal state. The plan may be periodically updated.

Abstract: A multilayer material with an outside abrasive layer wrapped around a hollow cylindrical tube that may be used for sanding or exfoliating. The multilayer abrasive material is a continuous roll that is inserted inside the hollow cylindrical tube, wherein a leading edge of the material extends from inside the tube to outside the tube via an elongated slot in an upper part of the body of the tube. The lower part of the body of the tube is a knurled handle. The multilayer material is comprised of a sticky side that adheres to the outside of the tube, and an abrasive side that may be used for sanding or exfoliating. A user may hold the handle of the tube, and use the upper portion of the tube, with the multilayer material attached, to sand or exfoliate, as needed.

Abstract: An indication of a portion of a lesson to be viewed by students is received. Computing devices of the students are notified that the portion of the lesson is to be viewed and student interaction information that indicates whether the students are viewing the portion of the lesson plan on the computing devices is received. An amount of the students viewing the portion of the lesson is determined based on the student interaction information and task information that indicates the determined amount of the students that are viewing the portion of the lesson is provided.

Abstract: Functionality is disclosed herein for changing a user experience using application events. Events that occur while an application is executing are provided to an application service. The events may be stored on the computing device executing the application before the events are provided to the application service. The application service uses the events to generate a plan that includes data identifying one or more actions for the application to perform. The events used to generate the plan may include events received from other users who also interact with the application. The plan is used by an application to select one or more actions to perform to move the user interacting with the application closer to a goal state. The plan may be periodically updated.

Abstract: Techniques for real-time observation assessment are provided. The techniques, which are designed for educators, take advantage of handheld computers, desktop/laptop computers and Internet access in order to reduce the paperwork associated with conventional educational assessments. An array of instructional assessment applications are designed to run on handheld computers. The instructional assessment applications may be based on existing and widely used paper methodologies. A common Web-based platform for assessment application distribution, selection, download, data management and reporting is also provided. Users can then periodically synchronize instructional data (assessments, diagnostic results, notes and/or schedules) to the Web site. At the Web site, browser-based reports and analysis can be viewed, administered and shared via electronic mail.

Abstract: Group-based, periodic education intervention that provides a targeted curriculum selected specifically for each period based on current skill assessment data is described. For example, candidates' skill levels in multiple skills are assessed, and groups are formed based on commonality of skill level. A period-specific curriculum is generated for each group to address the specific needs of the individuals of the respective group. After delivery of the period-specific targeted curriculum over the period, re-assessments of the current skill of the group members are made, and a period-specific curriculum for the subsequent period is generated and delivered. Fidelity of an implementation of the curriculum is analyzed, and alerts, reminders, and reports are provided to improve fidelity of an implementation of the curriculum.

Abstract: Techniques for real-time observation assessment are provided. The techniques, which are designed for educators, take advantage of handheld computers, desktop/laptop computers and Internet access in order to reduce the paperwork associated with conventional educational assessments. An array of instructional assessment applications are designed to run on handheld computers. The instructional assessment applications may be based on existing and widely used paper methodologies. A common Web-based platform for assessment application distribution, selection, download, data management and reporting is also provided. Users can then periodically synchronize instructional data (assessments, diagnostic results, notes and/or schedules) to the Web site. At the Web site, browser-based reports and analysis can be viewed, administered and shared via electronic mail.

Abstract: Group-based, periodic education intervention that provides a targeted curriculum selected specifically for each period based on current skill assessment data is described. For example, candidates' skill levels in multiple skills are assessed, and groups are formed based on commonality of skill level. A period-specific curriculum is generated for each group to address the specific needs of the individuals of the respective group. After delivery of the period-specific targeted curriculum over the period, re-assessments of the current skill of the group members are made, and a period-specific curriculum for the subsequent period is generated and delivered. Fidelity of an implementation of the curriculum is analyzed, and alerts, reminders, and reports are provided to improve fidelity of an implementation of the curriculum.

Abstract: Group-based, periodic education intervention that provides a targeted curriculum selected specifically for each period based on current skill assessment data is described. For example, candidates' skill levels in multiple skills are assessed, and groups are formed based on commonality of skill level. A period-specific curriculum is generated for each group to address the specific needs of the individuals of the respective group. After delivery of the period-specific targeted curriculum over the period, re-assessments of the current skill of the group members are made, and a period-specific curriculum for the subsequent period is generated and delivered. Fidelity of an implementation of the curriculum is analyzed, and alerts, reminders, and reports are provided to improve fidelity of an implementation of the curriculum.