Abstract: The invention relates to an edge-based log collecting device for collecting logs from several log sources located in a remote network, called edge-network, and sending the logs to a cloud-based system distant from the edge-network. The device is located in the edge-network, and the device includes several processing nodes for processing logs received from the log sources and sending them to said the system. The device is configured to elect, according to a predetermined election algorithm, one of the processing nodes as a master node configured for receiving the logs from all log sources of the local network, and sharing the logs with the other processing nodes. The invention further relates to a computer program and a device configured to carry out such a method.

Abstract: A method for detecting malicious connections from remote users into a computer network through Remote Desktop protocol via a computer having access to login logs of users. The method includes defining aspects, each divided into bins comprising a day of week aspect comprising n1 bins, a time of day aspect comprising n2 bins, a number of logins in a day aspect comprising n3 bins. The method includes defining a model based on the aspects and providing a score of log for each user; defining a baseline of log; applying the model on each user log to determine a production score of log and comparing the production score of log with respect to the baseline. The model includes calculating a probability density for each bin for each user, determining a weight for each aspect and calculating the score of log from the probability density weighted by the weight for each user.

Abstract: A method for detecting malware penetrating a network by identifying anomalous communication between at least two systems of the network, carried out by a computer. For each unique combination of Source IP address and destination IP address, the method includes considering a past period, considering the network flow logs stored during said past period, calculating values of a metric based on data of the network flow logs within the past period and at a given frequency, calculating a baseline which consists in calculating an IQR of all metric values calculated during the past period, determining an outlier threshold from the baseline, considering a current period, calculating a new IQR of all metric values calculated during the current period, and classifying the communication between the two systems of the unique combination as an anomalous communication if the IQR of the current period is greater than the outlier threshold.

Abstract: The invention relates to an edge-based log collecting device for collecting logs from several log sources located in a remote network, called edge-network, and sending the logs to a cloud-based system distant from the edge-network. The device is located in the edge-network, and the device includes several processing nodes for processing logs received from the log sources and sending them to said the system. The device is configured to elect, according to a predetermined election algorithm, one of the processing nodes as a master node configured for receiving the logs from all log sources of the local network, and sharing the logs with the other processing nodes. The invention further relates to a computer program and a device configured to carry out such a method.

Abstract: The invention relates to a method detecting one or more anomalies regarding logins of a user on an authentication system. The method includes at least one iteration of a monitoring phase that includes collecting a log of successful logins of the user on the authentication system, and calculating, for each monitored parameter, a probability density, in the log, of each predetermined value of the parameter. The method also includes calculating, for each parameter, a weight, as a function of the probability density of each predetermined value of the parameter, calculating an anomaly score for the log as a function of the weights and the probability densities; and comparing the anomaly score to a given threshold in order to determine an anomaly in the daily log for the user. The invention also relates to a computer program product and a device configured to carry out the method.

Abstract: A method for detecting malicious connections from remote users into a computer network through Remote Desktop protocol via a computer having access to login logs of users. The method includes defining aspects, each divided into bins comprising a day of week aspect comprising n1 bins, a time of day aspect comprising n2 bins, a number of logins in a day aspect comprising n3 bins. The method includes defining a model based on the aspects and providing a score of log for each user; defining a baseline of log; applying the model on each user log to determine a production score of log and comparing the production score of log with respect to the baseline. The model includes calculating a probability density for each bin for each user, determining a weight for each aspect and calculating the score of log from the probability density weighted by the weight for each user.

Abstract: A method for detecting malware penetrating a network by identifying anomalous communication between at least two systems of the network, carried out by a computer. For each unique combination of Source IP address and destination IP address, the method includes considering a past period, considering the network flow logs stored during said past period, calculating values of a metric based on data of the network flow logs within the past period and at a given frequency, calculating a baseline which consists in calculating an IQR of all metric values calculated during the past period, determining an outlier threshold from the baseline, considering a current period, calculating a new IQR of all metric values calculated during the current period, and classifying the communication between the two systems of the unique combination as an anomalous communication if the IQR of the current period is greater than the outlier threshold.

Abstract: An implementation of trick mode methodology receives a first request to stream media for presentation at a first normal playback rate; streams a first media stream configured to the first normal playback rate; receives a second request to stream the media for presentation at a second greater playback rate; and performs one of the following responsive to receiving the second request: switching from streaming the first media stream to streaming from an appropriate position in a second media stream that corresponds to the second greater playback rate; or in an event that a second media stream corresponding to the second greater playback rate is not available, then streaming the first media stream at a higher bit rate in an attempt to comply with the second request.

Abstract: An implementation of trick mode methodology receives a first request to stream media for presentation at a first normal playback rate; streams a first media stream configured to the first normal playback rate; receives a second request to stream the media for presentation at a second greater playback rate; and performs one of the following responsive to receiving the second request: switching from streaming the first media stream to streaming from an appropriate position in a second media stream that corresponds to the second greater playback rate; or in an event that a second media stream corresponding to the second greater playback rate is not available, then streaming the first media stream at a higher bit rate in an attempt to comply with the second request.