Patents by Inventor Manel Fernandez
Manel Fernandez has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 11372868Abstract: Herein are techniques for training a parser by categorizing and generalizing messages and abstracting message templates for parsing after training. In an embodiment, a computer generates a message signature based on a message sequence of tokens that were extracted from a training message. The message signature is matched to a cluster signature that represents messages of one of many clusters that have distinct signatures. The training message is added to the cluster. Based on a data type of the cluster signature, a value is extracted from a second message, such as a live message after training. Fuzzy signatures may be probabilistically matched to select a best matching cluster for a message. The value range of a token may be broadened or narrowed by adding or removing candidate data types, by adding or removing literals to a data type, and/or by promoting a narrow data type to a broader data type.Type: GrantFiled: January 14, 2019Date of Patent: June 28, 2022Assignee: Oracle International CorporationInventors: Rod Reddekopp, Andrew Brownsword, Manel Fernandez Gomez, Juan Fernandez Peinador
-
Patent number: 11082438Abstract: Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.Type: GrantFiled: September 5, 2018Date of Patent: August 3, 2021Assignee: Oracle International CorporationInventors: Juan Fernandez Peinador, Manel Fernandez Gomez, Guang-Tong Zhou, Hossein Hajimirsadeghi, Andrew Brownsword, Onur Kocberber, Felix Schmidt, Craig Schelp
-
Patent number: 11036561Abstract: Embodiments monitor statistics from groups of devices and generate an alarm upon detecting a utilization imbalance that is beyond a threshold. Particular balance statistics are periodically sampled, over a timeframe, for a group of devices configured to have balanced utilization. The devices are ranked at every data collection timestamp based on the gathered device statistics. The numbers of times each device appears within each rank over the timeframe are tallied. The device/rank summations are collectively used as a probability distribution representing the probability of each device being ranked at each of the rankings in the future. Based on this probability distribution, an entropy value that represents a summary of the imbalance of the group of devices over the timeframe is derived. An imbalance alert is generated when one or more entropy values for a group of devices shows an imbalanced utilization of the devices going beyond an identified imbalance threshold.Type: GrantFiled: July 24, 2018Date of Patent: June 15, 2021Assignee: Oracle International CorporationInventors: Stuart Wray, Felix Schmidt, Craig Robert Schelp, Manel Fernandez Gomez, Nipun Agarwal
-
Publication number: 20200364585Abstract: Herein are techniques for efficient and modular transcoding of message fields into features for inclusion within a feature vector. In an embodiment, a computer receives message signatures. Each signature has fields. Each field has a name and type. A feature map is generated that associates a field name and field type with transcoder(s). A message is received from a parser as field tuples. Each tuple has a type, name, and value of a field. Each tuple is processed as follows. The field name and field type of the tuple is used as a lookup key into the feature map to retrieve respective transcoder(s) that each generate a respective encoded feature from the field value of the tuple. An encoded feature from at least one relevant transcoder is written into a respective distinct location within a feature vector to encode the message. An inference is made based on the feature vector.Type: ApplicationFiled: May 17, 2019Publication date: November 19, 2020Inventors: PAVAN CHANDRASHEKAR, ANDREW BROWNSWORD, MANEL FERNANDEZ GOMEZ, JUAN FERNANDEZ PEINADOR, ROD REDDEKOPP
-
Patent number: 10768982Abstract: Herein are techniques for analysis of data streams. In an embodiment, a computer associates each software actor with data streams. Each software actor has its own backlog queue of data to analyze. In response to receiving some stream content and based on the received stream content, data is distributed to some software actors. In response to determining that the data satisfies completeness criteria of a particular software actor, an indication of the data is appended onto the backlog queue of the particular software actor. The particular software actor is reset to an initial state by loading an execution snapshot of a previous initial execution of an embedded virtual machine. Based on the particular software actor, execution of the execution snapshot of the previous initial execution is resumed to dequeue and process the indication of the data from the backlog queue of the particular software actor to generate a result.Type: GrantFiled: September 19, 2018Date of Patent: September 8, 2020Assignee: Oracle International CorporationInventors: Andrew Brownsword, Tayler Hetherington, Pavan Chandrashekar, Akhilesh Singhania, Stuart Wray, Pravin Shinde, Felix Schmidt, Craig Schelp, Onur Kocberber, Juan Fernandez Peinador, Rod Reddekopp, Manel Fernandez Gomez, Nipun Agarwal
-
Publication number: 20200226214Abstract: Herein are techniques for training a parser by categorizing and generalizing messages and abstracting message templates for parsing after training. In an embodiment, a computer generates a message signature based on a message sequence of tokens that were extracted from a training message. The message signature is matched to a cluster signature that represents messages of one of many clusters that have distinct signatures. The training message is added to the cluster. Based on a data type of the cluster signature, a value is extracted from a second message, such as a live message after training. Fuzzy signatures may be probabilistically matched to select a best matching cluster for a message. The value range of a token may be broadened or narrowed by adding or removing candidate data types, by adding or removing literals to a data type, and/or by promoting a narrow data type to a broader data type.Type: ApplicationFiled: January 14, 2019Publication date: July 16, 2020Inventors: ROD REDDEKOPP, ANDREW BROWNSWORD, MANEL FERNANDEZ GOMEZ, JUAN FERNANDEZ PEINADOR
-
Publication number: 20200089529Abstract: Herein are techniques for analysis of data streams. In an embodiment, a computer associates each software actor with data streams. Each software actor has its own backlog queue of data to analyze. In response to receiving some stream content and based on the received stream content, data is distributed to some software actors. In response to determining that the data satisfies completeness criteria of a particular software actor, an indication of the data is appended onto the backlog queue of the particular software actor. The particular software actor is reset to an initial state by loading an execution snapshot of a previous initial execution of an embedded virtual machine. Based on the particular software actor, execution of the execution snapshot of the previous initial execution is resumed to dequeue and process the indication of the data from the backlog queue of the particular software actor to generate a result.Type: ApplicationFiled: September 19, 2018Publication date: March 19, 2020Inventors: ANDREW BROWNSWORD, TAYLER HETHERINGTON, PAVAN CHANDRASHEKAR, AKHILESH SINGHANIA, STUART WRAY, PRAVIN SHINDE, FELIX SCHMIDT, CRAIG SCHELP, ONUR KOCBERBER, JUAN FERNANDEZ PEINADOR, ROD REDDEKOPP, MANEL FERNANDEZ GOMEZ, NIPUN AGARWAL
-
Publication number: 20200076840Abstract: Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.Type: ApplicationFiled: September 5, 2018Publication date: March 5, 2020Inventors: JUAN FERNANDEZ PEINADOR, MANEL FERNANDEZ GOMEZ, GUANG-TONG ZHOU, HOSSEIN HAJIMIRSADEGHI, ANDREW BROWNSWORD, ONUR KOCBERBER, FELIX SCHMIDT, CRAIG SCHELP
-
Publication number: 20200034208Abstract: Embodiments monitor statistics from groups of devices and generate an alarm upon detecting a utilization imbalance that is beyond a threshold. Particular balance statistics are periodically sampled, over a timeframe, for a group of devices configured to have balanced utilization. The devices are ranked at every data collection timestamp based on the gathered device statistics. The numbers of times each device appears within each rank over the timeframe are tallied. The device/rank summations are collectively used as a probability distribution representing the probability of each device being ranked at each of the rankings in the future. Based on this probability distribution, an entropy value that represents a summary of the imbalance of the group of devices over the timeframe is derived. An imbalance alert is generated when one or more entropy values for a group of devices shows an imbalanced utilization of the devices going beyond an identified imbalance threshold.Type: ApplicationFiled: July 24, 2018Publication date: January 30, 2020Inventors: Stuart Wray, Felix Schmidt, Craig Robert Schelp, Manel Fernandez Gomez, Nipun Agarwal
-
Publication number: 20180032332Abstract: A processor of an aspect includes a decode unit to decode a three source floating point addition instruction indicating a first source operand having a first floating point data element, a second source operand having a second floating point data element, and a third source operand having a third floating point data element. An execution unit is coupled with the decode unit. The execution unit, in response to the instruction, stores a result in a destination operand indicated by the instruction. The result includes a result floating point data element that includes a first floating point rounded sum. The first floating point rounded sum represents an additive combination of a second floating point rounded sum and the third floating point data element. The second floating point rounded sum represents an additive combination of the first floating point data element and the second floating point data element.Type: ApplicationFiled: October 9, 2017Publication date: February 1, 2018Applicant: Intel CorporationInventors: Roger Espasa, Guillem Sole, Manel Fernandez
-
Patent number: 9785433Abstract: A processor includes a decode unit to decode a three source floating point addition instruction indicating a first source operand having a first floating point data element, a second source operand having a second floating point data element, and a third source operand having a third floating point data element. An execution unit is coupled with the decode unit. The execution unit, in response to the instruction, stores a result in a destination operand indicated by the instruction. The result includes a result floating point data element that includes a first floating point rounded sum. The first floating point rounded sum represents an additive combination of a second floating point rounded sum and the third floating point data element. The second floating point rounded sum represents an additive combination of the first floating point data element and the second floating point data element.Type: GrantFiled: March 12, 2015Date of Patent: October 10, 2017Assignee: Intel CorporationInventors: Roger Espasa, Guillem Sole, Manel Fernandez
-
Patent number: 9733935Abstract: A method of processing an instruction is described that includes fetching and decoding the instruction. The instruction has separate destination address, first operand source address and second operand source address components. The first operand source address identifies a location of a first mask pattern in mask register space. The second operand source address identifies a location of a second mask pattern in the mask register space. The method further includes fetching the first mask pattern from the mask register space; fetching the second mask pattern from the mask register space; merging the first and second mask patterns into a merged mask pattern; and, storing the merged mask pattern at a storage location identified by the destination address.Type: GrantFiled: December 23, 2011Date of Patent: August 15, 2017Assignee: Intel CorporationInventors: Jesus Corbal, Andrew T. Forsyth, Roger Espasa, Manel Fernandez, Thomas D. Fletcher
-
Publication number: 20160188327Abstract: In one embodiment of the invention, a processor device including a storage location configured to store a set of source packed-data operands, each of the operands having a plurality of packed-data elements that are positive or negative according to an immediate bit value within one of the operands. The processor also including: a decoder to decode an instruction requiring an input of a plurality of source operands, and an execution unit to receive the decoded instructions and to generate a result that is a product of the source operands. In one embodiment, the result is stored back into one of the source operands or the result is stored into an operand that is independent of the source operands.Type: ApplicationFiled: December 24, 2014Publication date: June 30, 2016Inventors: Elmoustapha OULD-AHMED-VALL, Robert VALENTINE, Jesus CORBAL, Mark CHARNEY, Roger ESPASA, Guillem SOLE, Manel FERNANDEZ, Brian J. HICKMANN
-
Publication number: 20160188341Abstract: In one embodiment of the invention, a processor including a storage location configured to store a set of source packed-data operands, each of the operands having a plurality of packed-data elements that are positive or negative according to an immediate bit value within one of the operands. The processor also including: a decoder to decode an instruction requiring an input of a plurality of source operands, and an execution unit to receive the decoded instructions and to generate a result that is a sum of the source operands. In one embodiment, the result is stored back into one of the source operands or the result is stored into an operand that is independent of the source operands.Type: ApplicationFiled: December 24, 2014Publication date: June 30, 2016Inventors: Elmoustapha OULD-AHMED-VALL, Robert Valentine, Jesus Corbal, Mark Charney, Roger Espasa, Guillem Sole, Manel Fernandez, Brian J. Hickmann
-
Publication number: 20150286482Abstract: A processor of an aspect includes a decode unit to decode a three source floating point addition instruction indicating a first source operand having a first floating point data element, a second source operand having a second floating point data element, and a third source operand having a third floating point data element. An execution unit is coupled with the decode unit. The execution unit, in response to the instruction, stores a result in a destination operand indicated by the instruction. The result includes a result floating point data element that includes a first floating point rounded sum. The first floating point rounded sum represents an additive combination of a second floating point rounded sum and the third floating point data element. The second floating point rounded sum represents an additive combination of the first floating point data element and the second floating point data element.Type: ApplicationFiled: March 12, 2015Publication date: October 8, 2015Applicant: INTEL CORPORATIONInventors: Roger Espasa, Guillem Sole, Manel Fernandez
-
Publication number: 20150277904Abstract: An apparatus and method are described for performing a plurality of multiplication operations. For example, one embodiment of a processor comprises an instruction fetch unit to fetch a double-multiplication instruction from a memory subsystem, the double-multiplication instruction having three source operand values; a decode unit to decode the double-multiplication instruction to generate at least one uop; and an execution unit to execute the uop a first time to multiply a first and a second of the three source operand values to generate a first intermediate result and to execute the uop a second time to multiply the intermediate result with a third of the three source operand values to generate a final result.Type: ApplicationFiled: March 28, 2014Publication date: October 1, 2015Inventors: ROGER ESPASA, GUILLEM SOLE, MANEL FERNANDEZ
-
Publication number: 20140052968Abstract: A method of processing an instruction is described that includes fetching and decoding the instruction. The instruction has separate destination address, first operand source address and second operand source address components. The first operand source address identifies a location of a first mask pattern in mask register space. The second operand source address identifies a location of a second mask pattern in the mask register space. The method further includes fetching the first mask pattern from the mask register space; fetching the second mask pattern from the mask register space; merging the first and second mask patterns into a merged mask pattern; and, storing the merged mask pattern at a storage location identified by the destination address.Type: ApplicationFiled: December 23, 2011Publication date: February 20, 2014Applicant: Intel CorporationInventors: Jesus Corbal, Andrew T. Forsyth, Roger Espasa, Manel Fernandez, Thomas D. Fletcher