Abstract: Sequences of computer network log entries indicative of a cause of an event described in a first type of entry are identified by training a long short-term memory (LSTM) neural network to detect computer network log entries of a first type. The network is characterized by a plurality of ordered cells Fi=(xi, ci-1, hi-1) and a final sigmoid layer characterized by a weight vector wT. A sequence of log entries xi is received. An hi for each entry is determined using the trained Fi. A value of gating function Gi(hi, hi-1)=II (wT(hi?hi-1)+b) is determined for each entry. II is an indicator function, b is a bias parameter. A sub-sequence of xi corresponding to Gi(hi, hi-1)=1 is output as a sequence of entries indicative of a cause of an event described in a log entry of the first type.

Abstract: In one embodiment, a computing device scans a plurality of available data sources associated with a profiled identity for an individual, and categorizes instances of the data sources according to recognized terms within the data sources. Once determining whether the profiled identity contributed positively to each categorized instance, categorized instances that have a positive contribution by the profiled identity may be clustered into clusters. The computing device may then rank the clusters based on size of the clusters and frequency of recognized terms within the clusters, and can then infer an expertise of the profiled identity based on one or more best-ranked clusters. The inferred expertise of the profiled identity may then be stored.

Abstract: A network monitor may receive network log events and identify: a first set of network devices that have reported a target network log event, a second set of network devices that have not reported the target network log event, a first set of network log events reported by the first set of network devices, and a second set of network log events reported by the second set of network devices. The network monitor may determine which network log events are legitimate, and filter the legitimate network log events from the first set of network log events or the second set of network log events to produce a group of suspicious network log events that may be correlated with the target network log event. The network monitor may predict future suspicious network log events that may be correlated with the target network log event in order to predict equipment failures.

Abstract: In one embodiment, a device receives sensor data from a plurality of nodes in a computer network. The device uses the sensor data and a graph that represents a topology of the nodes in the network as input to a graph convolutional neural network. The device provides an output of the graph convolutional neural network as input to a convolutional long short-term memory recurrent neural network. The device detects an anomaly in the computer network by comparing a reconstruction error associated with an output of the convolutional long short-term memory recurrent neural network to a defined threshold. The device initiates a mitigation action in the computer network for the detected anomaly.

Abstract: Predicting data throughput with a user device comprises a wireless system supported by wireless access points receiving signals from the user device. A wireless prediction system receives data from the wireless system, where the data comprises characteristics of the wireless access point, characteristics of communications with user computing devices, and data throughput statistics. The prediction system categorizes the received data based on one or more of a set of characteristics and determines a maximum data throughput capacity for each of the one or more wireless access points for each of the one or more set of characteristics. The system receives a request for a prediction of data throughput capacity for a particular wireless access point and, based on the characteristics of the particular wireless access point, determines an estimated data throughput capacity based on data throughputs of wireless access points having similar characteristics.

Abstract: A network monitor may receive network log events and identify: a first set of network devices that have reported a target network log event, a second set of network devices that have not reported the target network log event, a first set of network log events reported by the first set of network devices, and a second set of network log events reported by the second set of network devices. The network monitor may determine which network log events are legitimate, and filter the legitimate network log events from the first set of network log events or the second set of network log events to produce a group of suspicious network log events that may be correlated with the target network log event. The network monitor may predict future suspicious network log events that may be correlated with the target network log event in order to predict equipment failures.

Abstract: A network monitor may receive network log events and identify: a first set of network devices that have reported a target network log event, a second set of network devices that have not reported the target network log event, a first set of network log events reported by the first set of network devices, and a second set of network log events reported by the second set of network devices. The network monitor may determine which network log events are legitimate, and filter the legitimate network log events from the first set of network log events or the second set of network log events to produce a group of suspicious network log events that may be correlated with the target network log event. The network monitor may predict future suspicious network log events that may be correlated with the target network log event in order to predict equipment failures.

Abstract: In one embodiment, a device receives sensor data from a plurality of nodes in a computer network. The device uses the sensor data and a graph that represents a topology of the nodes in the network as input to a graph convolutional neural network. The device provides an output of the graph convolutional neural network as input to a convolutional long short-term memory recurrent neural network. The device detects an anomaly in the computer network by comparing a reconstruction error associated with an output of the convolutional long short-term memory recurrent neural network to a defined threshold. The device initiates a mitigation action in the computer network for the detected anomaly.

Abstract: Predicting data throughput with a user device comprises a wireless system supported by wireless access points receiving signals from the user device. A wireless prediction system receives data from the wireless system, where the data comprises characteristics of the wireless access point, characteristics of communications with user computing devices, and data throughput statistics. The prediction system categorizes the received data based on one or more of a set of characteristics and determines a maximum data throughput capacity for each of the one or more wireless access points for each of the one or more set of characteristics. The system receives a request for a prediction of data throughput capacity for a particular wireless access point and, based on the characteristics of the particular wireless access point, determines an estimated data throughput capacity based on data throughputs of wireless access points having similar characteristics.

Abstract: Sequences of computer network log entries indicative of a cause of an event described in a first type of entry are identified by training a long short-term memory (LSTM) neural network to detect computer network log entries of a first type. The network is characterized by a plurality of ordered cells Fi=(xi, ci-1, hi-1) and a final sigmoid layer characterized by a weight vector wT. A sequence of log entries xi is received. An hi for each entry is determined using the trained Fi. A value of gating function Gi(hi, hi-1)=II (wT(hi?hi-1)+b) is determined for each entry. II is an indicator function, b is a bias parameter. A sub-sequence of xi corresponding to Gi(hi, hi-1)=1 is output as a sequence of entries indicative of a cause of an event described in a log entry of the first type.

Abstract: A network monitor may receive network log events and identify: a first set of network devices that have reported a target network log event, a second set of network devices that have not reported the target network log event, a first set of network log events reported by the first set of network devices, and a second set of network log events reported by the second set of network devices. The network monitor may determine which network log events are legitimate, and filter the legitimate network log events from the first set of network log events or the second set of network log events to produce a group of suspicious network log events that may be correlated with the target network log event. The network monitor may predict future suspicious network log events that may be correlated with the target network log event in order to predict equipment failures.

Abstract: In one embodiment, a computing device scans a plurality of available data sources associated with a profiled identity for an individual, and categorizes instances of the data sources according to recognized terms within the data sources. Once determining whether the profiled identity contributed positively to each categorized instance, categorized instances that have a positive contribution by the profiled identity may be clustered into clusters. The computing device may then rank the clusters based on size of the clusters and frequency of recognized terms within the clusters, and can then infer an expertise of the profiled identity based on one or more best-ranked clusters. The inferred expertise of the profiled identity may then be stored.