Abstract: An intrusion detection system includes a computer readable datastore containing a double Markov model for modeling events in system log files of a computer system by looking at multiple log files and correlations among different log files. An intrusion detection module performs intrusion detection by using the double Markov model to assess probability that a new event is an intrusion, including routinely scanning the system logging data and processing the data periodically. A countermeasures module takes countermeasures when an intrusion is detected.

Abstract: A method for binarizing an image that includes initializing, for each column of the image, a first set of variables representing a local column low pixel value and a local column high pixel value, and, for each row of the image, a second set of variables representing a local row low pixel value and a local row high pixel value. The following steps are iterated for each pixel: determining a threshold value dependent upon the first and second sets of variables at the current pixel location, comparing a value representative of an image pixel at the current pixel location with the determined threshold value, and setting a binarization pixel for the current pixel location to one of two values, dependent upon results of the comparison, and adjusting values included in the first set of variables and the second set of variables dependent upon the results of the comparison.

Abstract: A document processing system for use in identifying a segmented document includes a data store of layout graph models that are classified and/or labeled. A matching module makes a determination of a match between a layout graph sample for the segmented document and a particular layout graph model. The matching module uses a correlator to generate an identified, segmented document that is classified and/or labeled based on the segmented document, the layout graph model, and the determination of a match.

Abstract: A method for binarizing an image that includes initializing, for each column of the image, a first set of variables representing a local column low pixel value and a local column high pixel value, and, for each row of the image, a second set of variables representing a local row low pixel value and a local row high pixel value. The following steps are iterated for each pixel: determining a threshold value dependent upon the first and second sets of variables at the current pixel location, comparing a value representative of an image pixel at the current pixel location with the determined threshold value, and setting a binarization pixel for the current pixel location to one of two values, dependent upon results of the comparison, and adjusting values included in the first set of variables and the second set of variables dependent upon the results of the comparison.

Abstract: Connected components and contour following identifying contours within pixel-based image data. The image data is expressed as a grid of columns and rows. A scan order is established over the grid to define a parent-child relationship between contiguous pixels in adjacent rows and to define a sibling relationship among non-contiguous pixels in the same row. A run data structure is established in computer-readable memory that defines a run member by its row position and by its starting and ending column positions. The run data structure further defining parent, child and sibling structures for storing information about the parent-child relationships and sibling relationships of pixels associated with the run member. Image data is scanned according to the scan order to identify contiguous pixels of a predetermined state as identified run members. Parent-child and sibling relationships of the identified run members are determined.