Abstract: Analyzing log data, such as security log data and machine data, is disclosed. A baseline is built for a set of machine data. The baseline is built at least in part by determining a plurality of signature profiles for a plurality of respective time slices. An occurrence of an anomaly associated with the source of the machine data is determined. The occurrence is determined at least in part by determining that received machine data does not conform to the baseline within a threshold.

Abstract: Computer-implemented methods, systems and computer program products leveraging blockchain networks to securely store a tamper-proof ledger comprising an audit trail describing the completion or missed data migration tasks, based on a timeline of an end-to-end data migration task schedule. Each of the event logs and alerts from the data migration source, data migration target, and/or migration tools, including network device logs, operating system logs, user-access logs, alerts, migration tool output etc. associated with the end-to-end migration tasks is made a part of the audit trail and stored to the ledger of the blockchain. All event logs, alert or other digital assets recorded to blocks of the blockchain can be timestamped, hashed and distributed across all nodes of the blockchain network and verified as valid by each of the peer nodes. As blocks updating the audit trail are added to the blockchain, the entries cannot be modified or tampered with.

Abstract: An embodiment for dynamic categorization of information technology (IT) service tickets is provided. The embodiment may include logging an IT service ticket when text is entered into a description field. The embodiment may also include creating a filtered description field by processing the text entered into the description field. The embodiment may further include computing a set of exponential weights and assigning the set of exponential weights to each word in the filtered description field. The embodiment may also include multiplying the set of exponential weights by the word's TF-IDF score to determine an IT service ticket category for placement of the IT service ticket into the IT service ticket category. The embodiment may further include generating features for machine learning, utilizing the generated features to build a supervised machine learning model, and evaluating the supervised machine learning model through analyzation of data from historical IT service tickets.

Abstract: Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.

Abstract: Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.

Abstract: Data is an asset to any organization and any breach to the data during task allocation to agents may lead to serious damage to organizations including loss of consumer confidence, trust, reputation, financial penalties and the like. Conventional methods mainly focus on the allocating task to agents based on user satisfaction, overall throughput and maximize revenue and less focus is given to data privacy. The present subject matter overcomes the limitations of the conventional methods for task allocation by utilizing a dynamic data exposure analysis method, which enables seamless upgrading of the data access policy and or control. Here, a data exposure is monitored based on a data exposure score, dynamic identification of conflicting tasks and a dynamic privacy budget. The data exposure score is calculated in two execution points. Finally all the values are updated in the system for utilization in the further privacy enabled task allocation.

Abstract: This disclosure relates generally to selection of cloud service providers in a multi-cloud. The selection of cloud service providers (CSPs) in a multi-cloud environment is challenging as it depends on multiple criteria such as security, usability, latency, and service cost. In an embodiment, for each CSP and multi-CSP combination, two decision problems are solved; namely, a VM selection problem and a cloud region selection problem, taking latency requirement and DR laws constraints into consideration. By solving the VM selection and CC selection problems, the service cost and the user to cloud region mapping are estimated. Using said estimates and other qualitative criteria, a multi-cloud multi-criteria decision problem is solved using MCDM techniques to rank the CSP combinations for each application. Based on the ranks and a constraint on a service cost of the entity one of a CSP and a CSP combination is selected for each application.

Abstract: Obfuscating data is disclosed. A processor identifies structured information in log data. The structured information is transformed in a manner that preserves the structure to form transformed raw data. The transformed raw data is sent to a remote analysis engine. The remote analysis engine receives a query and responds to the query by providing as results at least a portion of the transformed raw data. A processor is configured to de-transform the transformed raw data.

Abstract: The automatic selection and usage of a parser is disclosed. Raw data is obtained from a first remote device. At least a portion of the raw data is evaluated using a plurality of rules. A confidence measure is determined for at least some of the rules. An indication that the raw data pertains to a source is provided as output when the confidence measure exceeds a threshold.

Abstract: The present invention relates to preservation of meat products. In particular new additives are provided for effective inhibition or prevention of bacterial outgrowth in meat products. The present inventors found that a combination of carvacrol and a cationic surfactant was effective in the inhibition or prevention of bacterial outgrowth in meat products. The combinations, more in particular, proved to be effective at levels that do not result in significant effects on the flavor and/or taste of the products. The present inventors furthermore found that treatment of meat products with the combinations of this invention had a favorable effect on the visual appearance (color) of the meat products. The present invention provides preservative compositions, the use of thereof as well as the meat products containing them.

Abstract: Data is an asset to any organization and any breach to the data during task allocation to agents may lead to serious damage to organizations including loss of consumer confidence, trust, reputation, financial penalties and the like. Conventional methods mainly focus on the allocating task to agents based on user satisfaction, overall throughput and maximize revenue and less focus is given to data privacy. The present subject matter overcomes the limitations of the conventional methods for task allocation by utilizing a dynamic data exposure analysis method, which enables seamless upgrading of the data access policy and or control. Here, a data exposure is monitored based on a data exposure score, dynamic identification of conflicting tasks and a dynamic privacy budget. The data exposure score is calculated in two execution points. Finally all the values are updated in the system for utilization in the further privacy enabled task allocation.

Abstract: Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.

Abstract: A system for security intelligence automation using flows is disclosed. In various embodiments, a system includes a processor configured to provide a graphical user interface for at least one visual flow for threat ranking. The processor is further configured to render, in the graphical user interface, a visual flow interface for at least one of generating and configuring the at least one visual flow. The processor is further configured to provide, via the visual flow interface, a drag and drop ranking automation flow.

Abstract: Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.

Abstract: A system for security intelligence automation using flows is disclosed. In various embodiments, a system includes a communications interface configured to receive events. The system includes a processor configured to select event data associated with the events, where the event data is associated with a computer network environment. The processor may be further configured to segment the event data along a plurality of dimensions, score the event data along the plurality of dimensions, and generate a ranking of each of the events based at least in part on the scoring of the event data.

Abstract: Automatically generating a parser is disclosed. Raw data is received from a first remote device. A determination that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules is made. A clustering function is performed on the raw data. At least one parser rule is generated based on the clustering.

Abstract: An individual session border controller in a cluster of SBCs, e.g., in a Cloud, sends a resource utilization reporting message to the current master resource manager for the cluster. In response to the received utilization reporting message from the individual SBC, the master resource manager determines a mode of operation, e.g. one of: normal, critical or overshoot, for the cluster and a resource allocation for the SBC, the resource allocation method used being different for at least two different modes. The master resource manager communicates the determined cluster mode and the determined resource allocation to the individual SBC, e.g., in a response message. The SBC controls its resource utilization reporting rate as a function of the mode. In at least one mode, e.g., normal mode, the SBC is allowed to use more resources, e.g., X % more, than the amount of resources allocated to the SBC by the master resource manager.

Abstract: Obfuscating data is disclosed. A processor identifies structured information in log data. The structured information is transformed in a manner that preserves the structure to form transformed raw data. The transformed raw data is sent to a remote analysis engine. The remote analysis engine receives a query and responds to the query by providing as results at least a portion of the transformed raw data. A processor is configured to de-transform the transformed raw data.

Abstract: Analyzing log data, such as security log data and machine data, is disclosed. A baseline is built for a set of machine data. The baseline is built at least in part by determining a plurality of signature profiles for a plurality of respective time slices. An occurrence of an anomaly associated with the source of the machine data is determined. The occurrence is determined at least in part by determining that received machine data does not conform to the baseline within a threshold.

Abstract: A method may include determining first network data corresponding to a first time period, including alarm data and incident data collected by a set of network devices of a core network during the first time period. The method may include creating, based on the first network data, an incident prediction model. The method may include receiving second network data, associated with the core network, corresponding to a second time period. The second network data may include alarm data and incident data collected by a network device, of the set of network devices, during the second time period. The method may include generating, based on the second network data and the incident prediction model, an incident prediction that includes a prediction whether the network device will experience an incident during a third time period.