Abstract: An apparatus is described.

Abstract: An apparatus is described.

Abstract: A system for identifying extreme behavior in elements of a network comprises a profiler and a collator. The profiler and the collator perform a method of identifying extreme behavior in the network elements. The profiler maintains one or more group profiles of network elements. Each group profile is associated with a plurality of network elements. The profiler accumulates values of a first function of the contents of an input data stream over a first period of time for each group profile. The input data stream includes at least one field containing a network element reference. The accumulated values of each group profile are compared with a corresponding collation threshold. The collator creates a collation instance for each group profile that reaches the collation threshold. Each collation instance creates a plurality of collation profiles.

Abstract: A system for detecting change in a data stream comprising a distribution maintenance engine, a difference determining means and an alert generation engine is disclosed. The system detects change in the alert stream by the distribution maintenance engine maintaining a short term distribution that models the data stream and maintaining a long term distribution that models the data stream. The difference determining means determines the difference between the short term distribution and the long term distribution. The alert generation engine applies a statistical measure to the difference and generates an alert if the measure of the difference exceeds a threshold.

Abstract: A method for analyzing data streams comprises receiving a data stream, conducting a first analysis of the data stream for a possible target activity, and if a possible target activity is indicated generating a first alert. If the first alert is generated, a second analysis for the possible target activity is conducted to determine whether the target activity is indicated in the data stream with a high degree of certainty. If a possible target activity is indicated by the second analysis, a second alert is generated and provided to an external system for action.

Abstract: In one embodiment, a method of configurably profiling data uses system comprising a pre-processor, a profiler, a post-processor and database. The pre-processor receives data and feedback data and performs configurable first calculations thereon to create data relating to profiling features. The profiler summarizes the profiling features data over a length of time by performing configurable second calculations thereon to create summarized data relating to profiled features. The post-processor performs configurable third calculations the profiled features data to create the feedback data and a profiled output data stream for further processing.

Abstract: A neural network comprises trained interconnected neurons. The neural network is configured to constrain the relationship between one or more inputs and one or more outputs of the neural network so the relationships between them are consistent with expectations of the relationships; and/or the neural network is trained by creating a set of data comprising input data and associated outputs that represent archetypal results and providing real exemplary input data and associated output data and the created data to neural network. The real exemplary output data and the created associated output data is compared to the actual output of the neural network, which is adjusted to create a best fit to the real exemplary data and the created data.

Abstract: A system for detecting change in a data stream comprising a distribution maintenance engine, a difference determining means and an alert generation engine is disclosed. The system detects change in the alert stream by the distribution maintenance engine maintaining a short term distribution that models the data stream and maintaining a long term distribution that models the data stream. The difference determining means determines the difference between the short term distribution and the long term distribution. The alert generation engine applies a statistical measure to the difference and generates an alert if the measure of the difference exceeds a threshold.

Abstract: A method and system for classifying a plurality of records associated with an event are disclosed. In one embodiment, the system comprises a receiver configured to receive a plurality of event data records, an extractor configured to extract numeric values from each event data record, and a classifier unit configured to classify the numeric values of each event data record to produce a propensity value associated with each event data record. In use the system receives the event data records. The extractor extracts numeric values from each event data record. The classifier unit classifies the numeric values of each event data record to produce a propensity value associated with each event data record. The propensity value is used as a probability that an event associated with each data records satisfies a criterion.

Abstract: In one embodiment, a method of configurably profiling data uses system comprising a pre-processor, a profiler, a post-processor and database. The pre-processor receives data and feedback data and performs configurable first calculations thereon to create data relating to profiling features. The profiler summarises the profiling features data over a length of time by performing configurable second calculations thereon to create summarised data relating to profiled features. The post-processor performs configurable third calculations the profiled features data to create the feedback data and a profiled output data stream for further processing.

Abstract: A method for analyzing data streams comprises receiving a data stream, conducting a first analysis of the data stream for a possible target activity, and if a possible target activity is indicated generating a first alert. If the first alert is generated, a second analysis for the possible target activity is conducted to determine whether the target activity is indicated in the data stream with a high degree of certainty. If a possible target activity is indicated by the second analysis, a second alert is generated and provided to an external system for action.

Abstract: An event detection system with an automatic performance monitoring and adaptation system is disclosed. The system includes an event detection engine and a performance assessor. The event detection engine generates an alert if the specified event is suspected. An alert investigation team investigates if the alert is real of false. The performance assessor is configured to monitor the rate at which alerts and/or false alerts are generated by the event detection engine and to perform certain actions if the rate of alerts and/or false alerts falls outside a configurable range or crosses a threshold.

Abstract: A neural network comprises trained interconnected neurons. The neural network is configured to constrain the relationship between one or more inputs and one or more outputs of the neural network so the relationships between them are consistent with expectations of the relationships; and/or the neural network is trained by creating a set of data comprising input data and associated outputs that represent archetypal results and providing real exemplary input data and associated output data and the created data to neural network. The real exemplary output data and the created associated output data is compared to the actual output of the neural network, which is adjusted to create a best fit to the real exemplary data and the created data.

Abstract: A system for detecting change in a data stream comprising a distribution maintenance engine, a difference determining means and an alert generation engine is disclosed. The system detects change in the alert stream by the distribution maintenance engine maintaining a short term distribution that models the data stream and maintaining a long term distribution that models the data stream. The difference determining means determines the difference between the short term distribution and the long term distribution. The alert generation engine applies a statistical measure to the difference and generates an alert if the measure of the difference exceeds a threshold.

Abstract: A system for identifying extreme behavior in elements of a network comprises a profiler and a collator. The profiler and the collator perform a method of identifying extreme behavior in the network elements. The profiler maintains one or more group profiles of network elements. Each group profile is associated with a plurality of network elements. The profiler accumulates values of a first function of the contents of an input data stream over a first period of time for each group profile. The input data stream includes at least one field containing a network element reference. The accumulated values of each group profile are compared with a corresponding collation threshold. The collator creates a collation instance for each group profile that reaches the collation threshold. Each collation instance creates a plurality of collation profiles.