Abstract: Aspects of the invention include computer-implemented methods, computing systems and computer program products for calculating an active time on a software application with respect to a first work item. A computer-implemented method includes retrieving activity data from a software development application and a plurality of input signals generated by a peripheral device. The method further includes determining a causal relationship between the input data and any events described by the activity data. In response to a determination of a causal relationship, a first time interval is calculated between an initial signal and a final signal of the plurality of input signals. The first time interval is compared to an estimated time interval. A schedule of a second work item is determined based on the comparison, wherein the first time interval relates to a first work item.

Abstract: Aspects of the invention include computer-implemented methods, computing systems and computer program products for calculating an active time on a software application with respect to a first work item. A computer-implemented method includes retrieving activity data from a software development application and a plurality of input signals generated by a peripheral device. The method further includes determining a causal relationship between the input data and any events described by the activity data. In response to a determination of a causal relationship, a first time interval is calculated between an initial signal and a final signal of the plurality of input signals. The first time interval is compared to an estimated time interval. A schedule of a second work item is determined based on the comparison, wherein the first time interval relates to a first work item.

Abstract: An analytics-based security monitoring system adapted to detect a plurality of behavioral characteristics from behavioral data, each representing an action conducted in a computing environment. Furthermore, the system determines, in accordance with a correlation profile, one or more behavioral fragments, each comprising a plurality of the behavioral characteristics. In accordance with the correlation profile, the one or more determined behavioral fragments are correlated against an attack profile comprising a plurality of sets of behavioral fragments where each set of behavioral fragments forms a malicious behavior pattern of a known attack. Thereafter, an attack based on the correlated one or more determined behavioral fragments may be identified, and the correlation profile is updated after an analysis of the identified attack.

Abstract: An analytics-based security monitoring system is adapted to receive data, such as in the form of event logs, from one or more network devices transferred through a computing environment, detect a plurality of behavioral characteristics from the received event logs, identify behavioral fragments composed of related behavioral characteristics, and identify an attack by correlating the behavioral fragments against patterns of known malicious attacks. The analytics-based security monitoring system may then perform a learning process to enhance further detection of attacks and perform one or more remedial actions when an attack is identified.

Abstract: An analytics-based security monitoring system includes instructions that may be executed by a computing system to receive data in the form of event logs from one or more network devices transferred through a computing environment, detect a plurality of behavioral characteristics from the received event logs, identify behavioral fragments composed of related behavioral characteristics, and identify an attack by correlating the behavioral fragments against patterns of known malicious attacks. The analytics-based security monitoring system may then perform a learning process to enhance further detection of attacks and perform one or more remedial actions when an attack is identified.