Abstract: Disclosed are techniques for use in assessing the risk of electronic communications using logon types. In one embodiment, the techniques comprise a method. The method comprises receiving an electronic communication relating to a login request involving a user and a provider of a computerized resource. The method comprises determining a logon type associated with the logon request. The method comprises determining a first value relating to an amount of logon requests associated with the logon type involving the user and the provider over a first time period and a second value relating to an amount of logon requests associated with the logon type involving the user and the provider over a second time period that is greater than the first time period. The method comprises generating a risk score describing the risk associated with the logon request based on the first and the second values.

Abstract: Improved techniques involve testing periodicity at a given period based on locations of clicks within a sampling window whose duration is a multiple of the given period. Along these lines, when a testing server receives a click stream from a client machine, the testing server assigns a timestamp to each of the clicks in the click stream. The testing server generates a list of candidate periods at which periodicity of the click stream is to be tested. For each of the candidate periods, the testing server forms a sampling window whose duration is a multiple of that candidate period and tests whether the click stream is periodic based on the locations of the clicks within the sampling window. If indeed the testing server finds that the click stream is periodic at any of the candidate periods, the testing server may send an alert to a security entity to indicate that suspect activity has been identified.

Abstract: A processing device comprises a processor coupled to a memory and is configured to obtain data characterizing login events for multiple user identifiers. The data associated with a given one of the user identifiers is processed to generate a login profile for a corresponding user, and likelihood statistics are generated for respective ones of multiple time bins based on the login profile. Data characterizing one or more additional login events for the given user identifier is obtained, and a confidence measure is generated for a given one of the additional login events based on one or more of the likelihood statistics and a time bin associated with the given additional login event. The confidence measure is compared to a threshold and an alert relating to the given additional login event is generated and transmitted to a security agent. The processing device may be implemented in a network security system.

Abstract: Methods and devices for correlative monitoring, analysis, and control of multi-service, multi-network systems are provided herein. Exemplary methods may include generating a network topology graph of a metanetwork using traffic records obtained from the metanetwork, generating a causal digraph of the metanetwork using the traffic records and the network topology graph, and transmitting one or more of the network topology graph and the causal digraph to a computing system.

Abstract: Sequences of discrete events, such as clicks on a website, are evaluated for periodic behavior, a period is calculated, and the sequence is scored to determine the confidence that the sequence really exhibits periodicity. The random variations on the timing of the discrete events due to transmission delays or other factors may be reduced or eliminated from the evaluation. An apparatus for performing the method of evaluation may include a computer programmed to carry out the method.

Abstract: Improved techniques involve flagging anomalous behavior in a current session when there is sufficient difference between an observed distribution of Markov events in the current session and an observed distribution of Markov events in a global session. Here, “Markov events” refer to events such as web page transitions and web page addresses. During a user session, a testing server generates a frequency distribution of a set of Markov events of the user session. The testing server also obtains a frequency distribution of previously observed Markov events of a global session, i.e., sets of sessions of previous user sessions or training sessions. The testing server then computes an anomaly statistic depending on the Markov events that indicates a difference between the user session and the global session. The testing server may produce an alert if the anomaly statistic differs significantly from some nominal value.

Abstract: Methods and devices for correlative monitoring, analysis, and control of multi-service, multi-network systems are provided herein. Exemplary methods may include generating a network topology graph of a metanetwork using traffic records obtained from the metanetwork, generating a causal digraph of the metanetwork using the traffic records and the network topology graph, and transmitting one or more of the network topology graph and the causal digraph to a computing system.

Abstract: Methods, kits and arrays of nucleic acid probes for genotyping large numbers of human SNPs in parallel are provided. A set of more than 100,000 human SNPs, known to be biallelic in at least two populations is provided. Allele specific perfect match probes and genotyping probe sets are provided for each allele of each biallelic SNP in a set of human SNPs that is useful for genetic analysis within and across populations. Probe sets that include perfect match and mismatch probes are provided. The probe sets are suitable for inclusion in an array. The invention provides the SNP and surrounding sequence and provides the sequences in such a way as to make them available for a variety of analyses including genotyping. As such, the invention relates to diverse fields impacted by the nature of genetics, including biology, medicine, and medical diagnostics.

Abstract: Methods, kits and arrays of nucleic acid probes for genotyping large numbers of human SNPs in parallel are provided. A set of more than 100,000 human SNPs, known to be biallelic in at least two populations is provided. Allele specific perfect match probes and genotyping probe sets are provided for each allele of each biallelic SNP in a set of human SNPs that is useful for genetic analysis within and across populations. Probe sets that include perfect match and mismatch probes are provided. The probe sets are suitable for inclusion in an array. The invention provides the SNP and surrounding sequence and provides the sequences in such a way as to make them available for a variety of analyses including genotyping. As such, the invention relates to diverse fields impacted by the nature of genetics, including biology, medicine, and medical diagnostics.

Abstract: A method for calling the genotype of a sample is described comprising the acts of receiving emission data for one or more target sequences each hybridized to a plurality of probe sets, where each of the probe sets comprises a plurality of probe features; calculating a set of values for each of the probe sets associated with each target sequence; selecting one of the set of values for each of the probe sets associated with each target sequence, wherein the value is selected if it is greater than a reference value; determining a significance value from the selected values of all the probe sets associated with each target sequence; and producing a genotype call for each target sequence based upon the significance value.

Abstract: A method for displaying genotype information associated with probe array experiments is described that includes the acts of receiving sets of emission intensity data, wherein each set of emission intensity data includes emission intensity values each associated with a probe disposed upon a probe array; generating genotype calls, wherein each of the genotype calls is based, at least in part, upon the emission intensity values; assembling the genotype calls into one or more genotype data sets; and displaying each of the genotype data sets in one or more panes of a graphical user interface.