Abstract: A method for a cyber threat defense system is provided. The method comprises receiving a first abnormal behavior pattern where the first abnormal behavior pattern represents behavior on a first network deviating from a normal benign behavior of that network; and receiving a second abnormal behavior pattern where the second abnormal behavior pattern representing either behavior on the first network or on a second network deviating from a normal benign behavior of that network. The method further comprises comparing the first and second abnormal behavior patterns to determine a similarity score between the first and second abnormal behavior patterns and determining, based on the comparison, that the first abnormal behavior pattern likely corresponds to malicious behavior when the similarity score is above a threshold. A corresponding non-transitory computer readable medium is also provided.

Abstract: A clustering foundational AI model analyzes for, collects data about, and then outputs the role and/or function of an entity in a network and/or in an organization. The clustering foundational AI model clusters data together so that similar roles and/or functions can be readily identified to supply additional contextual information about the entity involved in the alert and/or event, and then outputs the role and/or function for the entity associated with the alert and/or event to assist in an investigation. The clustering foundational AI model adds the additional contextual information about the role and/or function of the entity upon receiving the alert and/or event. A UI receives the additional contextual information about the role and/or function of the entity in the network and/or organization and then presents both the alert and/or event and the additional contextual information that allows a user to gain contextual information about the alert and/or event.

Abstract: A method for a cyber threat defense system is provided. The method comprises receiving a first abnormal behavior pattern where the first abnormal behavior pattern represents behavior on a first network deviating from a normal benign behavior of that network; and receiving a second abnormal behavior pattern where the second abnormal behavior pattern representing either behavior on the first network or on a second network deviating from a normal benign behavior of that network. The method further comprises comparing the first and second abnormal behavior patterns to determine a similarity score between the first and second abnormal behavior patterns and determining, based on the comparison, that the first abnormal behavior pattern likely corresponds to malicious behavior when the similarity score is above a threshold. A corresponding non-transitory computer readable medium is also provided.

Abstract: A multivariate anomaly detector can detect a cyber-attack using incremental malicious actions distributed across multiple devices in a network. A multivariate anomaly detector can collect input data describing communication connections between devices in the network. The multivariate anomaly detector can group the input data into a graph data batch based on a fixed batch increment of time to identify incremental actions. The multivariate anomaly detector can calculate a multivariate centrality score for two or more devices based on the graph data batch describing device centrality to the network. The multivariate anomaly detector can identify whether the two or more devices are in an anomalous state from normal device network interactions based on the multivariate centrality score to identify malicious activity distributed across multiple devices in the network.

Abstract: A multivariate anomaly detector can detect a cyber-attack using incremental malicious actions distributed across multiple devices in a network. A multivariate anomaly detector can collect input data describing communication connections between devices in the network. The multivariate anomaly detector can group the input data into a graph data batch based on a fixed batch increment of time to identify incremental actions. The multivariate anomaly detector can calculate a multivariate centrality score for two or more devices based on the graph data batch describing device centrality to the network. The multivariate anomaly detector can identify whether the two or more devices are in an anomalous state from normal device network interactions based on the multivariate centrality score to identify malicious activity distributed across multiple devices in the network.

Abstract: An apparatus for inserting planar articles into packages having mouths, the apparatus comprising a bed to support a package; an opener to open the mouth of a package; a pusher to push a planar article along an article path into the package when the opener has operated, The pusher comprises a guide adapted to engage in the package mouth while guiding the article to ensure a free path for the article as it is moved into the package. The guide has a generally V-shaped configuration with side walls splayed out from an apex to an open side, and wherein the guide is mounted with the apex substantially facing the bed and the open side substantially facing the pusher, said open side providing an open slot in the article path for receiving and guiding an article and the apex being configured to enter a package mouth as an article is pushed into a package to assist separation of the leaves of a package as they guide an article.

Abstract: A system for processing an envelope containing contents has stations for opening envelopes, and a checking station for checking contents of envelopes. The opening station comprises a cutter and a drive mechanism to separately cut opposed leaves of the envelope. The cutter comprises a wheel for cutting through each of the leaves, and the drive mechanism rotates the wheel and causes it to traverse across the envelope. There is a separate wheel for each envelope leaf and the drive mechanism simultaneously drives the wheels to cut both leaves simultaneously. The cutter comprises a separator for drawing the leaves away from each other so that they are separated from the contents during cutting. The separator comprises at least one suction cup for engaging the leaf and drawing it away from the plane of the contents; and there are opposed suction cups. The separator simultaneously draws the leaves in opposing directions away from the contents.

Abstract: Diseases of the colon are treated by oral ingestion of a unit dosage form containing a mast cell stabilizer as an active agent. The dosage form is targeted for delivery of the active agent to the colon or when in an immediate release formulation, such as a fast-dissolving tablet, powder or effervescent, the targeted release is upon ingestion. The dosage form comprise at least one mast cell stabilizer such as but not limited to ketotifen, nedocromil sodium, cromolyn sodium, and antihistamines which have mast cell stabilizing properties such as, but not limited, to azestastine hydrochloride and olopatadine hydrochloride, which remains intact until the dosage form reaches the colon or until ingestion.