Abstract: In some examples, a system for decorating network traffic flows with outlier scores includes a processor and a memory device to store traffic flows received from a network. The processor is configured to receive a set of traffic flows from the memory device and generate a tree model to split the traffic flows into clusters of traffic flows. Each cluster corresponds with a leaf of the tree model. The processor is further configured to generate machine learning models for each of the clusters of traffic flows separately. For a new traffic flow, the processor is configured to identify a specific one of the machine learning models that corresponds with the new traffic flow, compute an outlier score for the new traffic flow using the identified specific one of the machine learning models, and decorate the new traffic flow with the outlier score.

Abstract: A computer-based system and method for classifying users of a database including obtaining an activity rate time series describing activity level of a database user versus time, extracting features from the activity rate time series, the features including a measure of repetition in the activity level, mean activity load and a percentage of the time in which the user is active, and determining a type of the database user based on the extracted at least one feature. The measure of repetition in the user activity is calculated by performing a Fourier transform on the activity rate time series to produce a transformed series; detecting spikes in the transformed series; and measuring a percentage of information in the transformed series which is included in the spikes.

Abstract: A computer-based system and method for classifying data in real-time for data streaming may include: capturing a plurality of data packets flowing between a data source machine and a data client; searching at least one of the data packets for tokens associated with sensitive information; if tokens associated with sensitive information are not found in a data packet: allowing the data packet to flow between the data source machine and the data client; and sending the data packet to a comprehensive security analysis; and if tokens associated with sensitive information are found in the data packet: preventing the data packet form flowing between the data source machine and the data client; and sending the data packet to a comprehensive security analysis.

Abstract: A computer-based system and method for classifying data in real-time for data streaming may include: capturing a plurality of data packets flowing between a data source machine and a data client; searching at least one of the data packets for tokens associated with sensitive information; if tokens associated with sensitive information are not found in a data packet: allowing the data packet to flow between the data source machine and the data client; and sending the data packet to a comprehensive security analysis; and if tokens associated with sensitive information are found in the data packet: preventing the data packet form flowing between the data source machine and the data client; and sending the data packet to a comprehensive security analysis.

Abstract: In some examples, a system for decorating network traffic flows with outlier scores includes a processor and a memory device to store traffic flows received from a network. The processor is configured to receive a set of traffic flows from the memory device and generate a tree model to split the traffic flows into clusters of traffic flows. Each cluster corresponds with a leaf of the tree model. The processor is further configured to generate machine learning models for each of the clusters of traffic flows separately. For a new traffic flow, the processor is configured to identify a specific one of the machine learning models that corresponds with the new traffic flow, compute an outlier score for the new traffic flow using the identified specific one of the machine learning models, and decorate the new traffic flow with the outlier score.

Abstract: A computer-based system and method for optimizing execution of regular expression rules, each including one or more sub-rules, may include: testing, by a processor, the sub-rules against a data sample; measuring, by a processor and based on the testing, the probability for every sub-rule that it appears in the data sample, and the processing time of each sub-rule; and finding, by a processor, an order of execution of at least a subset of the sub-rules to shorten the total execution time of validating the regular expression rules, based to the probability and the execution time of each of the sub-rules.

Abstract: In a present invention embodiment, time series data is received including information pertaining to a corresponding attribute of monitored activity on a processing device. An upper bound of the time series data is determined based on a weighted combination of a prior upper bound and a current value derived from the time series data. Greater weight is provided to greater values in the time series data based on an exponent applied to the prior upper bound and the current value and an effect of older values in the time series data decays over time based on a smoothing factor applied to exponential values of the prior upper bound and the current value. The upper bound is applied to a profile of an entity, and abnormal activity on the processing device is detected based on a comparison of the upper bound to a corresponding bound of the profile.

Abstract: An example system includes a processor to monitor activity on a database server to generate an events stream. The processor can convert the events stream into a time series that approximates activity load at the database server using an exponential smoothing. The processor can also send the time series to a streaming analytics engine.

Abstract: A computer-based system and method for classifying users of a database including obtaining an activity rate time series describing activity level of a database user versus time, extracting features from the activity rate time series, the features including a measure of repetition in the activity level, mean activity load and a percentage of the time in which the user is active, and determining a type of the database user based on the extracted at least one feature. The measure of repetition in the user activity is calculated by performing a Fourier transform on the activity rate time series to produce a transformed series; detecting spikes in the transformed series; and measuring a percentage of information in the transformed series which is included in the spikes.

Abstract: A computer-based system and method for classifying data in real-time for data streaming may include: capturing a plurality of data packets flowing between a data source machine and a data client; searching at least one of the data packets for tokens associated with sensitive information; if tokens associated with sensitive information are not found in a data packet: allowing the data packet to flow between the data source machine and the data client; and sending the data packet to a comprehensive security analysis; and if tokens associated with sensitive information are found in the data packet: preventing the data packet form flowing between the data source machine and the data client; and sending the data packet to a comprehensive security analysis.

Abstract: A computer-implemented method, computerized apparatus and computer program product for hierarchical objects linkage data visualization. A visualization of linkage data comprising a plurality of connections between a set of source objects and a set of target objects is obtained with respect to a predetermined level of hierarchy defined over attributes of at least one of the sets, wherein attributes of the objects and connections therebetween are represented in the visualization as nodes and links of a bipartite graph respectively. A spatial layout of links of a node is modified based on a relative position of each neighbor node thereof in an adjacent level, wherein neighboring nodes represent attributes of one or more objects which share in common an attribute represented by the node, wherein the relative position is determined based on a visualization restricted to the neighboring nodes so as to obtain a position preserving layout.

Abstract: A method, system and computer program product, the method comprising: sampling data from a computer network for training a monitoring system, comprising: obtaining information about the computer network to be monitored; obtaining indicators of available resources for collecting training data from the computer network; receiving mandatory objects to be monitored within the computer network; selecting at least one object to be monitored from under-monitored objects within the computer network, said selecting based upon monitoring resources remaining after reducing resources required for monitoring the mandatory objects, from the available resources; and sampling data in accordance with the selection.

Abstract: A computer-implemented method, computerized apparatus and computer program product for hierarchical objects linkage data visualization. A visualization of linkage data comprising a plurality of connections between a set of source objects and a set of target objects is obtained with respect to a predetermined level of hierarchy defined over attributes of at least one of the sets, wherein attributes of the objects and connections therebetween are represented in the visualization as nodes and links of a bipartite graph respectively. A spatial layout of links of a node is modified based on a relative position of each neighbor node thereof in an adjacent level, wherein neighboring nodes represent attributes of one or more objects which share in common an attribute represented by the node, wherein the relative position is determined based on a visualization restricted to the neighboring nodes so as to obtain a position preserving layout.