Abstract: Applying a local-adapted minority oversampling strategy technique to an imbalanced dataset including positive samples belonging to a minority class and negative samples belonging to a majority class, the minority class being less prevalent than the majority class, wherein each sample from the dataset includes a plurality of features. The local-adapted minority oversampling strategy includes determining a local imbalance for each positive sample from the minority class corresponding to a number of other positive samples and/or negative samples within a neighborhood of each positive sample. The local-adapted minority oversampling strategy also includes calculating a local-adapted oversampling ratio based on the local imbalance estimated for each positive sample and replicating each positive sample using the local-adapted oversampling ratio to generate a new dataset.

Abstract: Applying a local-adapted minority oversampling strategy technique to an imbalanced dataset including positive samples belonging to a minority class and negative samples belonging to a majority class, the minority class being less prevalent than the majority class, wherein each sample from the dataset includes a plurality of features. The local-adapted minority oversampling strategy includes determining a local imbalance for each positive sample from the minority class corresponding to a number of other positive samples and/or negative samples within a neighborhood of each positive sample. The local-adapted minority oversampling strategy also includes calculating a local-adapted oversampling ratio based on the local imbalance estimated for each positive sample and replicating each positive sample using the local-adapted oversampling ratio to generate a new dataset.

Abstract: Access to web services is managed. Metrics associated with accesses to a service are collected, and the metrics include activities associated with a user. A profile associated with the user is generated and updated. One or more metrics of an incoming access request to the service are compared against the profile using a statistical measure and a corresponding threshold for detecting an anomaly. The threshold is determined based on associations between a distribution of the metrics of the profile and a subset of other profile metric distributions. There is a determination of whether the incoming access request is an anomaly based on the comparison.

Abstract: Security is managed on a collaboration of plural computers that together define a trusted network environment. Each computer presents one or more real services and one or more spoof services which spoof real services on a subset of ports. At any one computer of the plural computers, unauthorized or suspicious activity from a device is detected at the subset of ports. A message is transmitted from the one computer to the plural computers on the network informing of the activity. In response to receiving one or more messages pertaining to the device, each computer individually changes its access rules to block the device.