Abstract: According to some embodiments, a model building platform may receive a set of historic industrial plant parameters associated with operation of a plurality of industrial plants over a period of time. The model building platform may automatically create a generative model based on relationships detected within the set of historic industrial plant parameters. A model execution platform may then receive incomplete industrial plant information associated with a particular industrial plant, and automatically generate supplemented industrial plant data based on the received incomplete industrial plant information and the generative model. An indication of the supplemented industrial plant data may then be output.

Abstract: An intrusion detection method, system and computer-readable media are disclosed. The system can include a processor programmed to perform computer network intrusion detection. The intrusion detection can include an identification module and a detection module. The identification module can be adapted to perform semi-supervised machine learning to identify key components of a network attack and develop MDL models representing those attack components. The detection module can cluster the MDL models and use the clustered MDL models to classify network activity and detect polymorphic or zero-day attacks.

Abstract: A method for fault detection includes selecting a measured parameter from a subsurface electrical device and obtaining a plurality of samples for the measured parameter. The method also includes removing at least one invalid sample from the plurality of samples to generate a remaining number of samples. The method further includes computing a diagnostic parameter based on the remaining number of samples, if the remaining number of samples is greater than a predefined threshold number and terminating the method otherwise. The method also includes obtaining a rule from a plurality of rules stored in a database, based on the diagnostic parameter. The rule is indicative of a standard operating condition of the subsurface electrical device. The method further includes evaluating whether the determined diagnostic parameter satisfies the obtained rule, to generate an output and determining a measured operating condition of the subsurface electrical device based on the output.

Abstract: One method for developing a data loss prevention model includes receiving, at a processing device, an event record corresponding to an operation performed on a computing device. The event record includes an event type and event data. The method also includes transforming, using the processing device, the event type to an event number corresponding to the event type. The method includes transforming, using the processing device, the event data to a numerical representation of the event data. The method includes associating an indication of whether the event type and the event data correspond to a data loss event with the event number and the numerical representation. The method also includes determining the data loss prevention model using the indication, the event number, and the numerical representation.

Abstract: A prognostics module includes a systems analysis module and a determination module. The systems analysis module is configured to obtain operational information corresponding to a system-wide operation of a multi-element system. The multi-element system includes multiple elements communicatively coupled by at least one common communication link. The determination module is configured to determine a future health of at least one of the multiple elements of the multi-element system using the operational information corresponding to the system-wide operation of the multi-element system.

Abstract: A system includes a physical analysis module, a cyber analysis module, and a determination module. The physical analysis module is configured to obtain physical diagnostic information, and to determine physical analysis information using the physical diagnostic information. The cyber analysis module is configured to obtain cyber security data of the functional system, and to determine cyber analysis information using the cyber security data. The determination module is configured to obtain the physical analysis information and the cyber analysis information, and to determine a state of the functional system using the physical analysis information and the cyber analysis information. The state determined corresponds to at least one of physical condition or cyber security threat. The determination module is also configured to identify if the state corresponds to one or more of a non-malicious condition or a malicious condition.

Abstract: An intrusion detection system for detecting and defeating unauthorized intrusion within a computer network of an infrastructure element of a high value target, the system including a pre-processor configured to receive data from a computer network of an infrastructure element of a high value target and to output filtered data, a grammar applicator configured to apply grammars produced using a grammar based compression and learning algorithm to the filtered data, a decision making device configured to provide a recommendation based on an input from the grammar applicator as to whether the data in the computer network constitutes an unauthorized intrusion, and an emulator in communication with the decision making device configured to expand a sampling of the filtered data using a polymorphic transformation to allow the decision making device to further analyze the sampled data to determine an unauthorized intrusion. A method and a computer software code are also disclosed.

Abstract: Methods and systems for determining whether a particular individual is to be granted, among other things, access to information, access to a particular room or other space, or permission to perform a given act or transaction are disclosed. For example, disclosed is an exemplary method that includes performing multiple biometrics tests on the individual to retrieve multiple biometrics test results, performing at least a first data fusion operation on the multiple biometrics test results to determine an identity result, performing at least one biological state test to determine one or more biological state test results of the individual, and conditionally granting authority to the individual based on the identity result and the one or more biological state results.

Abstract: A method and system for web mining and clustering is described. The method includes receiving and dividing input data into a plurality of primitive datasets. Additionally, one or more combinations of the plurality of primitive datasets may be created. Further, a model for each primitive dataset in the plurality of primitive datasets and each of the one or more combinations of the plurality of primitive datasets may be generated. Subsequently, a cost associated with a model corresponding to each primitive dataset in the plurality of primitive datasets, and each of the one or more combinations of the plurality of primitive datasets may be computed. Further, a sum of the costs associated with the models corresponding to each primitive dataset in the plurality of primitive datasets may be compared with the cost associated with each model corresponding to each of the one or more combinations of the plurality of primitive datasets.

Abstract: A method and apparatus that provides quality of service in wireless or sensor networks is disclosed. The method may include determining a class of service for transmission of one or more messages, adjusting a maximum packet length based on the determined class of service, allocating message time slots based on the determined class of service, setting a guard band size and frequency of resynchronization, and transmitting one or more messages using the adjusted maximum packet length, the allocated message time slots, and the set guard band size and frequency of resynchronization.

Abstract: An intrusion detection method, system and computer-readable media are disclosed. The system can include a processor programmed to perform computer network intrusion detection. The intrusion detection can include an identification module and a detection module. The identification module can be adapted to perform semi-supervised machine learning to identify key components of a network attack and develop MDL models representing those attack components. The detection module can cluster the MDL models and use the clustered MDL models to classify network activity and detect polymorphic or zero-day attacks.

Abstract: A network activity visualization system can include a minimum description length (MDL) based network intrusion detection system having an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module coupled to the MDL-based intrusion detection system and adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Abstract: A control system for use with a plurality of wind turbines includes a processor and a memory device coupled to the processor. The memory device is configured to store a plurality of program modules that, when executed by the processor, configure the processor to receive data representative of a power generation of a first wind turbine of the plurality of wind turbines, and determine an expected power generation of a second wind turbine of the plurality of wind turbines based on the power generation of the first wind turbine.

Abstract: An intrusion detection system for detecting and defeating unauthorized intrusion within a computer network of an infrastructure element of a high value target, the system including a pre-processor configured to receive data from a computer network of an infrastructure element of a high value target and to output filtered data, a grammar applicator configured to apply grammars produced using a grammar based compression and learning algorithm to the filtered data, a decision making device configured to provide a recommendation based on an input from the grammar applicator as to whether the data in the computer network constitutes an unauthorized intrusion, and an emulator in communication with the decision making device configured to expand a sampling of the filtered data using a polymorphic transformation to allow the decision making device to further analyze the sampled data to determine an unauthorized intrusion. A method and a computer software code are also disclosed.

Abstract: Methods and systems for determining whether a particular individual is to be granted, among other things, access to information, access to a particular room or other space, or permission to perform a given act or transaction are disclosed. For example, disclosed is an exemplary method that includes performing multiple biometrics tests on the individual to retrieve multiple biometrics test results, performing at least a first data fusion operation on the multiple biometrics test results to determine an identity result, performing at least one biological state test to determine one or more biological state test results of the individual, and conditionally granting authority to the individual based on the identity result and the one or more biological state results.

Abstract: A method and system for web mining and clustering is described. The method includes receiving and dividing input data into a plurality of primitive datasets. Additionally, one or more combinations of the plurality of primitive datasets may be created. Further, a model for each primitive dataset in the plurality of primitive datasets and each of the one or more combinations of the plurality of primitive datasets may be generated. Subsequently, a cost associated with a model corresponding to each primitive dataset in the plurality of primitive datasets, and each of the one or more combinations of the plurality of primitive datasets may be computed. Further, a sum of the costs associated with the models corresponding to each primitive dataset in the plurality of primitive datasets may be compared with the cost associated with each model corresponding to each of the one or more combinations of the plurality of primitive datasets.

Abstract: The present technique provides for the analysis of a data series to identify sequences of interest within the series. The analysis may be used to iteratively update a grammar used to analyze the data series or updated versions of the data series. Furthermore, the technique provides for the calculation of a minimum description length heuristic, such as a symbol compression ratio, for each sub-sequence of the analyzed data sequence. The technique may then compare a selected heuristic value against one or more reference conditions to determine if additional iteration is to be performed. The grammar and the data sequence may be updated between iterations to include a symbol representing a string corresponding to the selected heuristic value based upon a non-termination result of the comparison. Alternatively, the string corresponding to the selected heuristic value may be identified as a sequence of interest based upon a termination result of the comparison.

Abstract: A network activity visualization system can include a minimum description length (MDL) based network intrusion detection system having an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module coupled to the MDL-based intrusion detection system and adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Abstract: A system and method a bi-directional wireless information system includes a plurality of sensor nodes spaced along a path of travel of an object, each of the sensor nodes corresponding to a specified location along the path of travel. The system also includes a transceiver associated with the object, the transceiver configured to communicate with the plurality of sensor nodes, such that a location of the object is determinable based on wireless communication between the transceiver and the plurality of sensor nodes. A central database included in the system is configured to receive the location of the object from at least one of the transceiver and the plurality of sensor nodes, receive object-specific data from at least one of the transceiver and the plurality of sensor nodes, and transmit location-specific data to the transceiver.

Abstract: A method and system for routing traffic in a communication network is disclosed that may include assigning each node in a network a first subset of route repository nodes and a second subset of route repository nodes, querying the second subset of route repository nodes in order to obtain route information that is stored in the second subset of route repository nodes, computing route information by applying a route computation algorithm to the first subset of route repository nodes, and routing traffic in the communication network based on the route information obtained from the second subset of route repository nodes and the route information computed using the first subset of route repository nodes.