Abstract: One example method includes receiving a digital image, receiving an input list that includes a respective hash for each frame in a group of frames, creating new frames on a particular area of the digital image, and the new frames are created and located based on the information in the input list, obtaining a respective hash for content included within each of the new frames, comparing one of the hashes generated for one of the new frames with a hash from the input list and, when the hashes match, continue the comparing for all frames of the particular area, and when all hashes from the input list have been checked, determining whether or not the digital image is an illegal image.

Abstract: A method and system for implementing superseded federated learning. Superseded federated learning may entail a novel, performance-efficient federated learning technique designed to further decouple multiparty dependency on one another, as well as any third-parties, while collaborating in multiparty computations. Specifically, unlike any current federated learning methodology, superseded federated learning eliminates the complex and often inefficient coordination amongst parties, as well as removes third-party participation, during the classification or prediction inference phase of multiparty collaborations.

Abstract: Detection of abnormal node behavior and attacks by a node(s) can be enhancedly performed and managed. A security management component (SMC) of a collective node of a node group can analyze respective groups of residual vectors associated with respective features and associated with and received from respective nodes of the node group. Based on the analysis and defined security management criteria relating to abnormal node behavior and attacks, SMC can determine whether there is abnormal node behavior and/or an attack by one or more nodes. In response to detected abnormal node behavior and/or attack by a node(s), SMC can perform a desired mitigation action. Respective SMCs of the respective nodes of the node group also can perform respective determinations regarding whether an abnormal node behavior and/or attack by a respective node exists based on their respective analysis of their respective groups of residual vectors.

Abstract: One example method includes receiving a digital image, receiving an input list that includes a respective hash for each frame in a group of frames, creating new frames on a particular area of the digital image, and the new frames are created and located based on the information in the input list, obtaining a respective hash for content included within each of the new frames, comparing one of the hashes generated for one of the new frames with a hash from the input list and, when the hashes match, continue the comparing for all frames of the particular area, and when all hashes from the input list have been checked, determining whether or not the digital image is an illegal image.

Abstract: Techniques described herein relate to a method for predicting results using ensemble models. The method may include receiving trained model data sets from a model source nodes, each trained model data set comprising a trained model, an important feature list, and a missing feature generator; receiving a prediction request data set; making a determination that the prediction request data set does not include an input feature for a trained model; generating, based on the determination and using a missing feature generator, a substitute feature to replace the input feature; executing the trained model using the prediction request data set and the substitute feature to obtain a first prediction; executing a second trained model using the prediction request data set to obtain a second prediction; and obtaining a final prediction using the first prediction, the second prediction, and an ensemble model.

Abstract: Detection of abnormal node behavior and attacks by a node(s) can be enhancedly performed and managed. A security management component (SMC) of a collective node of a node group can analyze respective groups of residual vectors associated with respective features and associated with and received from respective nodes of the node group. Based on the analysis and defined security management criteria relating to abnormal node behavior and attacks, SMC can determine whether there is abnormal node behavior and/or an attack by one or more nodes. In response to detected abnormal node behavior and/or attack by a node(s), SMC can perform a desired mitigation action. Respective SMCs of the respective nodes of the node group also can perform respective determinations regarding whether an abnormal node behavior and/or attack by a respective node exists based on their respective analysis of their respective groups of residual vectors.

Abstract: One example method includes data protection operations including cyber security operations, threat detection operations, and other security operations. Normal device behavior is learned based on data collected by an anomaly detection engine operating in a kernel. The normal data is used to train a machine learning model. Threats are detected when the machine learning model indicates that new data points deviate from normal device behavior. Associated processes are stopped. This allows threats to be detected based on normal behavior rather than on unknown threat behavior.

Abstract: One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

Abstract: An example system includes a camera and a display operable to display text to a human. The system is operable to perform a method that includes tracking, with the camera, eye movements of a human as the human reads text presented by the display, collecting eye movement data, analyzing the eye movement data, based on the analyzing, determining whether or not Irlen Syndrome is indicated by the eye movement data, and when Irlen Syndrome is indicated, adjusting a parameter of the display.

Abstract: Techniques are provided for multi-party prediction using feature contribution values. One method comprises obtaining a first set of feature contribution values associated with respective ones of a plurality of machine learning models, wherein each machine learning model is trained using training data of a different party and each feature contribution value indicates a contribution by a corresponding feature to a prediction generated by the associated machine learning model; training an aggregate machine learning model using the obtained first sets of feature contribution values; receiving a second set of feature contribution values generated by applying data of at least one party to at least one machine learning model; and applying the second set of feature contribution values to the trained aggregate machine learning model to obtain a global prediction.

Abstract: A method and system for implementing superseded federated learning. Superseded federated learning may entail a novel, performance-efficient federated learning technique designed to further decouple multiparty dependency on one another, as well as any third-parties, while collaborating in multiparty computations. Specifically, unlike any current federated learning methodology, superseded federated learning eliminates the complex and often inefficient coordination amongst parties, as well as removes third-party participation, during the classification or prediction inference phase of multiparty collaborations.

Abstract: Techniques described herein relate to a method for predicting results using ensemble models. The method may include receiving trained model data sets from a model source nodes, each trained model data set comprising a trained model, an important feature list, and a missing feature generator; receiving a prediction request data set; making a determination that the prediction request data set does not include an input feature for a trained model; generating, based on the determination and using a missing feature generator, a substitute feature to replace the input feature; executing the trained model using the prediction request data set and the substitute feature to obtain a first prediction; executing a second trained model using the prediction request data set to obtain a second prediction; and obtaining a final prediction using the first prediction, the second prediction, and an ensemble model.

Abstract: Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp.

Abstract: One example method includes data protection operations including cyber security operations, threat detection operations, and other security operations. Normal device behavior is learned based on data collected by an anomaly detection engine operating in a kernel. The normal data is used to train a machine learning model. Threats are detected when the machine learning model indicates that new data points deviate from normal device behavior. Associated processes are stopped. This allows threats to be detected based on normal behavior rather than on unknown threat behavior.

Abstract: One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

Abstract: Techniques are provided for multi-party prediction using feature contribution values. One method comprises obtaining a first set of feature contribution values associated with respective ones of a plurality of machine learning models, wherein each machine learning model is trained using training data of a different party and each feature contribution value indicates a contribution by a corresponding feature to a prediction generated by the associated machine learning model; training an aggregate machine learning model using the obtained first sets of feature contribution values; receiving a second set of feature contribution values generated by applying data of at least one party to at least one machine learning model; and applying the second set of feature contribution values to the trained aggregate machine learning model to obtain a global prediction.

Abstract: Techniques are provided for system operational analytics using additional features over time-series counters for health score computation. An exemplary method comprises: obtaining log data from data sources of a monitored system; applying a counting function to the log data to obtain time-series counters for a plurality of distinct features within the log data; applying an additional function to the time-series counters for the plurality of distinct features; and processing an output of the additional function using a machine learning model to obtain a health score for the monitored system based on the output of the additional function.

Abstract: Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp.

Abstract: Techniques are provided for system operational analytics using normalized likelihood scores. In one embodiment, an exemplary method comprises: obtaining data from data sources associated with a monitored system; applying at least one function to the log data to obtain a plurality of time-series counters for a plurality of distinct features within the data; processing the plurality of time-series counters using at least one machine learning model to obtain a plurality of log likelihood values representing a behavior of the monitored system over time; determining a z-score for each of the plurality of log likelihood values over a predefined short-term time window; monitoring a distribution of the z-scores for the plurality of log likelihood values over a predefined long-term time window to map the z-scores to percentile values; and mapping the percentile values to a health score for the monitored system based on predefined percentile ranges and/or a transformation function.

Abstract: Techniques are provided for system operational analytics using normalized likelihood scores. In one embodiment, an exemplary method comprises: obtaining data from data sources associated with a monitored system; applying at least one function to the log data to obtain a plurality of time-series counters for a plurality of distinct features within the data; processing the plurality of time-series counters using at least one machine learning model to obtain a plurality of log likelihood values representing a behavior of the monitored system over time; determining a z-score for each of the plurality of log likelihood values over a predefined short-term time window; monitoring a distribution of the z-scores for the plurality of log likelihood values over a predefined long-term time window to map the z-scores to percentile values; and mapping the percentile values to a health score for the monitored system based on of predefined percentile ranges and a transformation function.