Abstract: Alert directives and focused alert directives allow a user to provide feedback to a behavioral recognition system to always or never publish an alert for certain events. Such an approach bypasses the normal publication methods of the behavioral recognition system yet does not obstruct the system's learning procedures.

Abstract: Techniques are disclosed for extracting micro-features at a pixel-level based on characteristics of one or more images. Importantly, the extraction is unsupervised, i.e., performed independent of any training data that defines particular objects, allowing a behavior-recognition system to forgo a training phase and for object classification to proceed without being constrained by specific object definitions. A micro-feature extractor that does not require training data is adaptive and self-trains while performing the extraction. The extracted micro-features are represented as a micro-feature vector that may be input to a micro-classifier which groups objects into object type clusters based on the micro-feature vectors.

Abstract: Techniques are disclosed for analyzing a scene depicted in an input stream of video frames captured by a video camera. Bounding boxes are determined for a set foreground patches identified in a video frame. For each bounding box, the techniques include determining textures for first areas, each including a foreground pixel and surrounding pixels, and determining textures for second areas including pixels of the background model image corresponding to the pixels of the foreground areas. Further, for each foreground pixel in the bounding box area, a correlation score is determined based on the texture of the corresponding first area and second area. Pixels whose correlation scores exceed a threshold are removed from the foreground patch. The size of the bounding box may also be reduced to fit the modified foreground patch.

Abstract: Techniques are disclosed for learning and modeling a background for a complex and/or dynamic scene over a period of observations without supervision. A background/foreground component of a computer vision engine may be configured to model a scene using an array of ART networks. The ART networks learn the regularity and periodicity of the scene by observing the scene over a period of time. Thus, the ART networks allow the computer vision engine to model complex and dynamic scene backgrounds in video.

Abstract: A machine-learning engine is disclosed that is configured to recognize and learn behaviors, as well as to identify and distinguish between normal and abnormal behavior within a scene, by analyzing movements and/or activities (or absence of such) over time. The machine-learning engine may be configured to evaluate a sequence of primitive events and associated kinematic data generated for an object depicted in a sequence of video frames and a related vector representation. The vector representation is generated from a primitive event symbol stream and a phase space symbol stream, and the streams describe actions of the objects depicted in the sequence of video frames.

Abstract: Embodiments presented herein describe a method for processing streams of data of one or more networked computer systems. According to one embodiment of the present disclosure, an ordered stream of normalized vectors corresponding to information security data obtained from one or more sensors monitoring a computer network is received. A neuro-linguistic model of the information security data is generated by clustering the ordered stream of vectors and assigning a letter to each cluster, outputting an ordered sequence of letters based on a mapping of the ordered stream of normalized vectors to the clusters, building a dictionary of words from of the ordered output of letters, outputting an ordered stream of words based on the ordered output of letters, and generating a plurality of phrases based on the ordered output of words.

Abstract: Systems and methods for viewing a scene depicted in a sequence of video frames and identifying and tracking objects between separate frames of the sequence. Each tracked object is classified based on known categories and a stream of context events associated with the object is generated. A sequence of primitive events based on the stream of context events is generated and stored together, along with detailed data and generalized data related to an event. All of the data is then evaluated to learn patterns of behavior that occur within the scene.

Abstract: A machine-learning engine is disclosed that is configured to recognize and learn behaviors, as well as to identify and distinguish between normal and abnormal behavior within a scene, by analyzing movements and/or activities (or absence of such) over time. The machine-learning engine may be configured to evaluate a sequence of primitive events and associated kinematic data generated for an object depicted in a sequence of video frames and a related vector representation. The vector representation is generated from a primitive event symbol stream and a phase space symbol stream, and the streams describe actions of the objects depicted in the sequence of video frames.

Abstract: Embodiments presented herein describe techniques for generating a linguistic model of input data obtained from a data source (e.g., a video camera). According to one embodiment of the present disclosure, a sequence of symbols is generated based on an ordered stream of normalized vectors generated from the input data. A dictionary of words is generated from combinations of the ordered sequence of symbols based on a frequency at which combinations of symbols appear in the ordered sequence of symbols. A plurality of phrases is generated based an ordered sequence of words from the dictionary observed in the ordered sequence of symbols based on a frequency by which combinations of words in ordered sequence of words appear relative to one another.

Abstract: Techniques are disclosed for extracting micro-features at a pixel-level based on characteristics of one or more images. Importantly, the extraction is unsupervised, i.e., performed independent of any training data that defines particular objects, allowing a behavior-recognition system to forgo a training phase and for object classification to proceed without being constrained by specific object definitions. A micro-feature extractor that does not require training data is adaptive and self-trains while performing the extraction. The extracted micro-features are represented as a micro-feature vector that may be input to a micro-classifier which groups objects into object type clusters based on the micro-feature vectors.

Abstract: Techniques are disclosed for processing data collected from network components for analysis by a machine learning engine of a Cognitive AI System. A network data processing driver receives a stream of data from a data collector which obtains data from one or more network data sources. The driver normalizes the stream of data to one or more feature values each corresponding to the network data sources and generates a sample vector from the feature values. The sample vector is formatted to be analyzed by the machine learning engine.

Abstract: Techniques are disclosed for building a logical network topology in a computer network. According to one embodiment of the present disclosure, traffic activity in the computer network is monitored. One or more attributes of the computer network (e.g., patterns of connectivity, intensity, and frequency between network components) is identified based on the monitored traffic activity. The logical network topology is generated from the one or more network traffic attributes.

Abstract: Techniques are disclosed for providing a context-aware description of anomalous behavior in a computer network. According to one embodiment of the present disclosure, a description of an anomaly detected in computer network activity is received. The description includes one or more features of the computer network associated with the anomaly. Contextual information relating to at least one of the features is generated based on a logical network topology. The logical network topology specifies a plurality of network traffic attributes of the computer network. An alert that includes a second description of the anomaly and the contextual information is generated.

Abstract: Techniques are disclosed for generating anomaly scores for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating anomaly scores includes receiving a stream of symbols generated from an ordered stream of normalized vectors generated from input data received from one or more sensor devices during a first time period. Upon receiving the stream of symbols, generating a set of words based on an occurrence of groups of symbols from the stream of symbols, determining a number of previous occurrences of a first word of the set of words, determining a number of previous occurrences of words of a same length as the first word, and determining a first anomaly score based on the number of previous occurrences of the first word and the number of previous occurrences of words of the same length as the first word.

Abstract: Techniques are disclosed for analyzing and learning behaviors based on acquired sensor data. A neuro-linguistic cognitive engine performs learning and analysis on linguistic content (e.g., identified alpha symbols, betas, and gammas) obtained by a linguistic model that clusters observations to generate the linguistic content. The neuro-linguistic cognitive engine compares new data to learned patterns stored in short and longer-term memories and determines whether to issue special event notifications indicating anomalous behavior. In one embodiment, condition(s) may be generated for new data and checked against inference nodes of an inference network. Inference nodes matching the condition(s) are executed to, e.g., compare the new data with the learned patterns, with output from the inference nodes being used to generate additional condition(s) that are again matched to inference nodes which may be executed.

Abstract: Techniques are disclosed to optimize feature selection in generating betas for a feature dictionary of a neuro-linguistic Cognitive AI System. A machine learning engine receives a sample vector of input data to be analyzed by the neuro-linguistic Cognitive AI System. The neuro-linguistic Cognitive AI System is configured to generate multiple feature words for each of a plurality of sensors. The machine learning engine identifies a sensor specified in the sample vector and selects optimization parameters for generating feature words based on the identified sensor.

Abstract: Techniques are disclosed for detecting changes in a neuro-linguistic model.

Abstract: Techniques are disclosed for analyzing and learning behavior in an acquired stream of video frames. In one embodiment, a trajectory analyzer clusters trajectories of objects depicted in video frames and builds a trajectory model including the trajectory clusters, a prior probability of assigning a trajectory to each cluster, and an intra-cluster probability distribution indicating the probability that a trajectory mapping to each cluster is least various distances away from the cluster. Given a new trajectory, a score indicating how unusual the trajectory is may be computed based on the product of the probability of the trajectory mapping to a particular cluster and the intra-cluster probability of the trajectory being a computed distance from the cluster. The distance used to match the trajectory to the cluster and determine intra-cluster probability is computed using a parallel Needleman-Wunsch algorithm, with cells in antidiagonals of a matrix and connected sub-matrices being computed in parallel.

Abstract: Techniques are disclosed for generating an anomaly score for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating an anomaly score comprises receiving a score indicating how often a characteristic is observed in the input data. Upon receiving the score, comparing the score with an unusual score model to determine an unusualness score and comparing the unusualness score with an anomaly score model based on one or more unusual score models to generate the anomaly score indicating an overall unusualness for the input data.

Abstract: A machine-learning engine is disclosed that is configured to recognize and learn behaviors, as well as to identify and distinguish between normal and abnormal behavior within a scene, by analyzing movements and/or activities (or absence of such) over time. The machine-learning engine may be configured to evaluate a sequence of primitive events and associated kinematic data generated for an object depicted in a sequence of video frames and a related vector representation. The vector representation is generated from a primitive event symbol stream and a phase space symbol stream, and the streams describe actions of the objects depicted in the sequence of video frames.