Abstract: A method of identifying a user as an authorized user from free test text typed by that user into an input device. From the received test text, features associated with the typed text are extracted, such as timing data associated with alphanumeric letter pairs. These extracted features are compared to previously stored series of authorized user profiles, where the authorized user profiles were generated from a trial typing sample of alphanumeric data from each associated authorized user. The comparison identifies one of the authorized users with the user, and a score is derived to measure the strength of the comparison. If the score exceeds a threshold level, the user is identified as that authorized user.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is abounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: A method of identifying a user as an authorized user from free test text typed by that user into an input device. From the received test text, features associated with the typed text are extracted, such as timing data associated with alphanumeric letter pairs. These extracted features are compared to previously stored series of authorized user profiles, where the authorized user profiles were generated from a trial typing sample of alphanumeric data from each associated authorized user. The comparison identifies one of the authorized users with the user, and a score is derived to measure the strength of the comparison. If the score exceeds a threshold level, the user is identified as that authorized user.

Abstract: Hidden Markov Models (“HMMs”) are used to analyze keystroke dynamics measurements collected as a user types a predetermined string on a keyboard. A user enrolls by typing the predetermined string several times; the enrollment samples are used to train a HMM to identify the user. A candidate who claims to be the user provides a typing sample, and the HMM produces a probability to estimate the likelihood that the candidate is the user he claims to be. A computationally-efficient method for preparing HMMs to analyze certain types of processes is also described.

Abstract: A method of predicting a SYN flooding attack on a server. The method tracks the number of SYN signals received (or SYN+ACK signals sent) over the communications port of the server in a specified time interval, the arrival estimation window. The invention then predicts the number of anticipated ACK, RST or ACK+RST signals to be received over the communication port within a predetermined time length prediction window. The prediction may be made at multiple points within the prediction window. The prediction window is offset in time from the arrival estimation window. The prediction of ACK signals to be received is based upon the number of SYN signals received or SYN+ACK signals sent in the arrival estimation window. In one embodiment, a polynomial is fit to the data in the Arrival estimation window and extrapolated to the prediction window.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is abounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: The invention is a method of predicting a SYN flooding attack on a server. The method tracks the number of SYN signals received (or SYN+ACK signals sent) over the communications port of the server in a specified time interval, the arrival estimation window. The invention then predicts the number of anticipated ACK signals to be received over the communication port within a predetermined time length prediction window. The prediction may be made at multiple points within the prediction window. The prediction window is offset in time from the arrival estimation window. The prediction of ACK signals to be received is based upon the number of SYN signals received or SYN+ACK signals sent in the arrival estimation window. In one embodiment, a polynomial is fit to the data in the Arrival estimation window and extrapolated to the prediction window.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: The invention is a computer implemented technique for id entifying anomalous data in a data set. The method uses cascaded k-Means clustering and the ID3 decision tree learning methods to characterize a training data set having data points with known characterization. The k-Means clustering method first partitions the training instances into k clusters using Euclidean distance similarity. On each training cluster, representing a density region of normal or anomaly instances, the invention builds an ID3 decision tree. The decision tree on each cluster refines the decision boundaries by learning the sub-groups within the cluster. A test data point is then subjected to the clustering and decision trees constructed form the training instances. To obtain a final decision on classification, the decisions of the k-Means and ID3 methods are combined using rules: (1) the Nearest-neighbor rule, and (2) the Nearest-consensus rule.

Abstract: A method of allocation a computer to service a request for a data set in a system having a plurality of computers. The method is implemented on a neural network having only an input layer having input nodes and an output layer having output nodes, where each output node is associated with a specific computer. Connecting the input nodes to the output nodes are weights w(j,k). The method includes the steps of receiving a request for data set “I” and inputting to the input layer a vector R(I) dependent upon the number of requests for the requested data over a predetermined period of time and selecting a computer assignment associated with of one of the output nodes to service the data request, where the output node selected is associated with a specific weight selected to minimize a predetermined metric measuring the distance between the vector entry R(I) and the weights(I,k).

Abstract: Hidden Markov Models (“HMMs”) are used to analyze keystroke dynamics measurements collected as a user types a predetermined string on a keyboard. A user enrolls by typing the predetermined string several times; the enrollment samples are used to train a HMM to identify the user. A candidate who claims to be the user provides a typing sample, and the HMM produces a probability to estimate the likelihood that the candidate is the user he claims to be. A computationally-efficient method for preparing HMMs to analyze certain types of processes is also described.

Abstract: We develop a system consisting of a neural architecture resulting in classifying regions corresponding to users' keystroke patterns. We extend the adaptation properties to classification phase resulting in learning of changes over time. Classification results on login attempts of 43 users (216 valid, 657 impersonation samples) show considerable improvements over existing methods.

Abstract: At least two biometric measurements of a person are collected, then a statistical measure based on the measurements is computed. The statistical measure is a bounded estimate of the discriminative power of a test based on the measurements. While the discriminative power is less than a target value, additional biometric measurements are collected. When enough measurements have been collected, a biometric template is constructed from the measurements and stored for use in future identifications. Systems and software to implement similar methods are also described and claimed.

Abstract: The invention is a method of allocating a computer to service a request for a data set in a system having a plurality of computers. The method is implemented on a neural having at an input layer having input nodes and an output layer having output nodes, where each output node is associated with a specific computer. Connecting the input nodes to the output nodes are weights w(j,k). Each output node is associated with a computer in the system, and the inputs to the input nodes are dependent upon the number of requests for specific pages.