Abstract: A method and apparatus for identifying similar and coordinated communications between computers connected by a network are described. Communications between a plurality of pairs of computers are monitored to obtain respective flow metrics for a first and second pair of computers. The flow metric represents at least one property of the data flow between the pair of computers. Representations of the evolution of the data flows between the pairs of computers are updated using the flow metrics. The representations of the evolution of the data flows are compared to determine the similarity of the data flows between the pairs of computers. The first pair of computers and the second pair of computers are identified as exhibiting similar and coordinated communication if their data flows are determined to be similar.

Abstract: A real-time method and data processing apparatus for identifying an anomalous state of a system are described. The system includes a sensor outputting time series data items relating to a property of the system. A current data item is received from the sensor. An estimate of a current data density for the time series data items is recursively estimated using the current data item. At least one statistical property of the estimate of the current data density is recursively calculated. It is determined, from the at least one statistical property, whether the current data item indicates an anomalous state of the system. A signal is output if it is determined that the current data item indicates an anomalous state of the system.

Abstract: A method and apparatus for identifying similar and coordinated communications between computers connected by a network are described. Communications between a plurality of pairs of computers are monitored to obtain respective flow metrics for a first and second pair of computers. The flow metric represents at least one property of the data flow between the pair of computers. Representations of the evolution of the data flows between the pairs of computers are updated using the flow metrics. The representations of the evolution of the data flows are compared to determine the similarity of the data flows between the pairs of computers. The first pair of computers and the second pair of computers are identified as exhibiting similar and coordinated communication if their data flows are determined to be similar.

Abstract: A method and apparatus for classifying the state of a system are described. The state of the system can be in one of a plurality of different classes and the system can have at least one property represented by a set of data items. A current data item representing a property of the system is received. The system is classified as being in one of a plurality of different classes based on the probability that the system is in any one of the plurality of classes calculated using the current data item, a recursively calculated mean value for the set of data items representing the property of the system and at least one recursively calculated statistical parameter for the set of data items representing the property. It is determined whether to output a signal based on the class in which the system is classified.

Abstract: A real-time method and data processing apparatus for identifying an anomalous state of a system are described. The system includes a sensor outputting time series data items relating to a property of the system. A current data item is received from the sensor. An estimate of a current data density for the time series data items is recursively estimated using the current data item. At least one statistical property of the estimate of the current data density is recursively calculated. It is determined, from the at least one statistical property, whether the current data item indicates an anomalous state of the system. A signal is output if it is determined that the current data item indicates an anomalous state of the system.

Abstract: Computer implemented machine learning methods are described. A co-operative learning method involves a first rule based system and a second rule based system. A rule base is generated from input data and recursion data is used to recursively update the rule base as a result of newly received input data. Rule data defining at least one rule and associated data are sent to the second system which determines whether to update its rule base using the transmitted rule data, and if so the recursion data is used to recursively determine the updated rules for its rule base. A father machine learning method for a rule based system, involves receiving time series data, determining whether the data increases or decreases the spatial density for previously existing rules, and if so then creating a new cluster and associated rule, otherwise a new cluster is not created.

Abstract: Computer implemented machine learning methods are described. A co-operative learning method involves a first rule based system and a second rule based system. A rule base is generated from input data and recursion data is used to recursively update the rule base as a result of newly received input data. Rule data defining at least one rule and associated data are sent to the second system which determines whether to update its rule base using the transmitted rule data, and if so the recursion data is used to recursively determine the updated rules for its rule base. A father machine learning method for a rule based system, involves receiving time series data, determining whether the data increases or decreases the spatial density for previously existing rules, and if so then creating a new cluster and associated rule, otherwise a new cluster is not created.