Abstract: A method is provided for reducing memory consumption by a rule engine. The method includes receiving attack trees, each having nodes and edges. Each node represents a security event and is associated with a detection rule for detecting an occurrence thereof. Each edge connects a respective node pair. The method includes assigning a watchpoint to each leaf node. The method includes moving the watchpoint assigned to any leaf node to a next upstream node, responsive to detecting an occurrence of the security event represented by the leaf node. The method includes erasing the watchpoint assigned to all downstream nodes relative to the next upstream node, responsive to the next upstream node being connected to a next downstream node using an edge having an “OR” join type. Only the rules for nodes currently having the watchpoint assigned are loaded into a memory device during runtime, while excluding rules for remaining nodes.

Abstract: A system and method for estimating document structure of a document which includes extracting one or more candidate elements describing the document structure from the document and grouping the one or more candidate elements into a group and building one or more trees for the group. Each tree has a root node and a leaf node selected from the candidate elements in the group. The method further includes pruning the one or more trees while leaving a path from the root node to the leaf node, based on whether a text corresponding to the path to the leaf node is accommodated in a single group of words.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A system and method for estimating document structure of a document which includes extracting one or more candidate elements describing the document structure from the document and grouping the one or more candidate elements into a group and building one or more trees for the group. Each tree has a root node and a leaf node selected from the candidate elements in the group. The method further includes pruning the one or more trees while leaving a path from the root node to the leaf node, based on whether a text corresponding to the path to the leaf node is accommodated in a single group of words.

Abstract: A computer-implemented method, a computer program product, and a computer system for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

Abstract: A system and method for estimating document structure of a document which includes extracting one or more candidate elements describing the document structure from the document and grouping the one or more candidate elements into a group and building one or more trees for the group. Each tree has a root node and a leaf node selected from the candidate elements in the group. The method further includes pruning the one or more trees while leaving a path from the root node to the leaf node, based on whether a text corresponding to the path to the leaf node is accommodated in a single group of words.

Abstract: A computer-implemented method and computing device are provided for generating a formal specification of a function. The method includes extracting a set of words from requirements of the function. The method further includes translating the set of words to a set of specification fragments. The method also includes converting the set of the specification fragments to a set of production rules. The method additionally includes constructing multiple prospective specifications from the set of production rules taking into account a syntax of the formal specification. The method further includes validating each of the multiple prospective specifications using input-output examples. The method also includes generating the formal specification of the function from validated ones of the multiple prospective specifications.

Abstract: A method is provided for reducing memory consumption by a rule engine. The method includes receiving attack trees, each having nodes and edges. Each node represents a security event and is associated with a detection rule for detecting an occurrence thereof. Each edge connects a respective node pair. The method includes assigning a watchpoint to each leaf node. The method includes moving the watchpoint assigned to any leaf node to a next upstream node, responsive to detecting an occurrence of the security event represented by the leaf node. The method includes erasing the watchpoint assigned to all downstream nodes relative to the next upstream node, responsive to the next upstream node being connected to a next downstream node using an edge having an “OR” join type. Only the rules for nodes currently having the watchpoint assigned are loaded into a memory device during runtime, while excluding rules for remaining nodes.

Abstract: A computer-implemented method, a computer program product, and a computer system for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A computer-implemented method for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

Abstract: A computer-implemented method and computing device are provided for generating a formal specification of a function. The method includes extracting a set of words from requirements of the function. The method further includes translating the set of words to a set of specification fragments. The method also includes converting the set of the specification fragments to a set of production rules. The method additionally includes constructing multiple prospective specifications from the set of production rules taking into account a syntax of the formal specification. The method further includes validating each of the multiple prospective specifications using input-output examples. The method also includes generating the formal specification of the function from validated ones of the multiple prospective specifications.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Abstract: A system and method for estimating document structure of a document which includes extracting one or more candidate elements describing the document structure from the document and grouping the one or more candidate elements into a group and building one or more trees for the group. Each tree has a root node and a leaf node selected from the candidate elements in the group. The method further includes pruning the one or more trees while leaving a path from the root node to the leaf node, based on whether a text corresponding to the path to the leaf node is accommodated in a single group of words.