Abstract: Methods and systems for monitoring communication of mobile communication terminals, such as cellular phones. An off-air monitoring system reconstructs both directions of a call conducted between two mobile terminals by receiving only downlink channels. The off-air monitoring system receives multiple downlink transmissions transmitted by base stations in a wireless communication network. The system uses the received downlink transmissions to reconstruct the bidirectional call content of calls conducted between wireless terminals. In order to reconstruct the bidirectional content of a given call, the system identifies and correlates the two downlink transmissions of that call from among the multiple received downlink transmissions.

Abstract: Systems and methods for malware detection techniques, which detect malware by identifying the C&C communication between the malware and the remote host. In particular, the disclosed techniques distinguish between request-response transactions that carry C&C communication and request-response transactions of innocent traffic. Individual request-response transactions may be analyzed rather than entire flows, and fine-granularity features examined within the transactions. As such, these methods and systems are highly effective in distinguishing between malware C&C communication and innocent traffic, i.e., in detecting malware with high detection probability and few false alarms.

Abstract: Methods and systems for protecting computer systems against intrusion. The disclosed techniques detect intrusions by jointly considering both cyber security events and physical security events. In some embodiments, a correlation subsystem receives information related to the computer system and its physical environment from various information sources in the cyber domain and in the physical domain. The correlation subsystem analyzes the information and identifies both cyber security events and physical security events. The correlation subsystem finds cyber security events and physical security events that are correlative with one another, and uses this correlation to detect intrusions.

Abstract: Methods and systems for identifying one or more rogue devices within a wireless communication network over a particular geographic location. A rogue base station detection system receives air interface transmissions from base stations belonging to a wireless communication network, as well as from one or more rogue base stations that do not belong to the network and are used for monitoring (e.g., hacking or eavesdropping) communication terminals communicating in the network. The system typically searches for signaling channels and converts the RF signal into GSM/UMTS messages including overcoming the different encryption methods used. The system than analyzes the received transmissions so as to identify suspicious transmissions that may be transmitted by the rogue base stations.

Abstract: Embodiments that are described herein provide improved methods and systems for predicting threatened POIs. In some embodiments, an automated location tracking system tracks the locations of one or more target individuals. The locations of the target individuals may be tracked, for example, by tracking the cellular phones of the targets, or using various other automated location tracking techniques. Based on the tracked locations, a prediction system anticipates the future locations of the targets. Over time, the system uses this information to progressively narrow down the list of possibly-threatened POIs.

Abstract: The disclosed techniques apply automatic prioritization to communication sessions conducted by users of a communication network, and present the sessions to an operator in accordance with the priorities. Each session is assigned an initial priority depending on the user who conducts the session (referred to as “target user”). The priority is then adjusted in accordance with a set of rules defined for that target user, and possibly based on activities of the target user as analyzed using the reconstructed communication. The rules typically consider metadata of the session. The sessions are typically held in a queue and presented to an operator in accordance with their respective priorities.

Abstract: A profile or dossier of a user is constructed based partly on data culled from a data network that reveals indirect, network-mediated relationships with other individuals and groups. The profile is assembled from information, such as properties of a target individual to build an initial social circle of the target individual. References to the target individual can be derived from the direct and indirect associations in order to compile a dossier on the target individual from the references to the target individual. The initial social circle may be expanded by building respective new social circles having new associations by crawling a plurality of web sites, and deriving additional references to the target individual from the new associations in the new social circles. According to a further aspect of the method, compiling a dossier includes extracting metadata from the references.

Abstract: Methods and systems to identify relationships between individuals by analyzing digital images and automatically detecting individuals who appear together in the images. A link analysis system accepts one or more digital images, and automatically recognizes individuals who appear together in the images. The system may recognize the individuals, for example, by applying a suitable face recognition process to the images. Upon identifying individuals who appear together, the system defines a relationship between them and acts upon the relationship.

Abstract: A system, including both an OLTP database and a warehouse database, that is configured to manage the coordination between the OLTP database and the warehouse database. An aspect relates to a combined OLTP and warehouse database which manages duplicate copies, in both the OLTP database and the warehouse database, of data expected to have a relatively high update and query rate. Data which has a low update and query rate is removed from the OLTP database, such that it remains only in the warehouse database. Updates of the duplicate copy data are performed in the OLTP. Periodically, for example every several minutes, data recently changed in the OLTP database is copied to the warehouse database. Queries are optionally primarily handled by the warehouse database, and are supplemented, when necessary, by data from the OLTP database.

Abstract: Methods and systems for monitoring communication traffic in communication networks, such as Internet Protocol (IP) traffic transferred over the Internet or over a wireless network. The disclosed techniques identify communication traffic that is associated with target individuals, by extracting digital images from the traffic and recognizing target individuals who appear in the images. A correlation system monitors communication sessions that are conducted in a communication network to identify known target individuals who appear in images. Upon recognizing a target individual in an image extracted from a certain session, the system correlates this target user with one or more of the communication identifiers used in the session. The system automatically identifies IP addresses or other identifiers that are used by target individuals, and enable subsequent tracking of such identifiers.