Abstract: Methods, systems and apparatuses are described herein to provide adaptive severity functions for alerts, particularly security alerts. The adaptive severity functions may be aligned with an existing global security situation to upgrade or downgrade the severity of new and existing alerts. By taking into consideration the time factor along with other parameters, the alerts may be prioritized or reprioritized appropriately. The modification of the severity level for the alerts may be made based on rules and/or one or more triggering events or by using severity functions with or without the aid of artificial intelligence based on best-practice preferences.

Abstract: A method enabling recovery of a terminated client-to-cloud processing sessions includes writing at least some data of cloud-based processing session between a cloud based server and a client device to the client device. Responsive to satisfaction of a session termination condition, the stored data is encrypted such that it can be recovered using suitable decryption techniques when the client-to-cloud-connection is subsequently re-established.

Abstract: A computing system includes a touch-sensitive display and one or more processors. The touch-sensitive display is configured to detect a run-time touch input from a user. The one or more processors are configured to execute instructions using portions of associated memory to implement a touch driver of the touch-sensitive display and an artificial intelligence model. The touch driver is configured to process the run-time touch input based on a plurality of calibration parameters and output a touch event and a plurality of run-time touch input parameters associated with the touch input event. The artificial intelligence model is configured to receive, as input, the run-time touch input parameters. Responsive to receiving the run-time touch input parameters, the artificial intelligence model is configured to output a personalized user touch driver profile including a plurality of updated calibration parameters for the touch driver.

Abstract: Unauthorized use of user credentials in a network is detected. Data indicative of text strings being used to access resources in the network is accessed. Regex models are determined for the text strings. Troupings of the regex models are determined based on an optimization of a cumulative weighted function. A regex model having a cumulative weighted function that exceeds a predetermined threshold is identified. An alert is generated when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.

Abstract: Methods, systems and apparatuses are described herein to provide adaptive severity functions for alerts, particularly security alerts. The adaptive severity functions may be aligned with an existing global security situation to upgrade or downgrade the severity of new and existing alerts. By taking into consideration the time factor along with other parameters, the alerts may be prioritized or reprioritized appropriately. The modification of the severity level for the alerts may be made based on rules and/or one or more triggering events or by using severity functions with or without the aid of artificial intelligence based on best-practice preferences.

Abstract: An apparatus and method for improving signal quality of a sensor signal, wherein an AI-based anomaly detector is configured to recognize an anomaly in a sensor output data stream. This approach can be used to predict and identify rare anomaly signals that are not handled properly by noise removal algorithms and help subsequent algorithms to get better decisions on the fly to better handle anomalous samples.

Abstract: A method comprising, by first computer equipment: obtaining an input data point comprising a set of values, each being a value of a different element of an input feature vector; inputting the input data point to a first machine learning model on the first computer equipment to generate at least one associated output label based on the input data point; sending a partial data point to second computer equipment, the partial data point comprising the values of only part of the feature vector; and sending the associated label to the second computer equipment in association with the partial data point, thereby causing the second computer equipment to train a second machine learning model on the second computer equipment based on the sent part and the associated label.

Abstract: The method disclosed herein includes determining a user interaction pattern with respect to a digital marker, the user interaction pattern based at least in part on user interaction with a capacitive sensor of a computing device, determining a geometric characteristic of the digital marker, and generating a predicted digital marking position of the digital marker on a digital medium of the computing device based at least in part on the determined geometric characteristic of the digital marker and the determined user interaction pattern.

Abstract: Methods, systems and apparatuses are described herein to provide adaptive severity functions for alerts, particularly security alerts. The adaptive severity functions may be aligned with an existing global security situation to upgrade or downgrade the severity of new and existing alerts. By taking into consideration the time factor along with other parameters, the alerts may be prioritized or reprioritized appropriately. The modification of the severity level for the alerts may be made based on rules and/or one or more triggering events or by using severity functions with or without the aid of artificial intelligence based on best-practice preferences.

Abstract: An indication of a security alert and a context for the security alert is received. The context includes one or more entities related to the context and a timestamp for the security alert. Data sources for the one or more entities are searched during a time window around the timestamp. One or more anomaly detection models are executed to identify anomalies that are related to the security alert based on the context. Identified anomalies for investigation of the security alert are output.

Abstract: A computing system includes a touch-sensitive display and one or more processors. The touch-sensitive display is configured to detect a run-time touch input from a user. The one or more processors are configured to execute instructions using portions of associated memory to implement a touch driver of the touch-sensitive display and an artificial intelligence model. The touch driver is configured to process the run-time touch input based on a plurality of calibration parameters and output a touch event and a plurality of run-time touch input parameters associated with the touch input event. The artificial intelligence model is configured to receive, as input, the run-time touch input parameters. Responsive to receiving the run-time touch input parameters, the artificial intelligence model is configured to output a personalized user touch driver profile including a plurality of updated calibration parameters for the touch driver.

Abstract: Unauthorized use of user credentials in a network is detected. Data indicative of text strings being used to access resources in the network is accessed. Regex models are determined for the text strings. Troupings of the regex models are determined based on an optimization of a cumulative weighted function. A regex model having a cumulative weighted function that exceeds a predetermined threshold is identified. An alert is generated when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.

Abstract: A computing system includes a touch-sensitive display and one or more processors. The touch-sensitive display is configured to detect a run-time touch input from a user. The one or more processors are configured to execute instructions using portions of associated memory to implement a touch driver of the touch-sensitive display and an artificial intelligence model. The touch driver is configured to process the run-time touch input based on a plurality of calibration parameters and output a touch event and a plurality of run-time touch input parameters associated with the touch input event. The artificial intelligence model is configured to receive, as input, the run-time touch input parameters. Responsive to receiving the run-time touch input parameters, the artificial intelligence model is configured to output a personalized user touch driver profile including a plurality of updated calibration parameters for the touch driver.

Abstract: Examples are disclosed that relate to interpreting user input at a computing device. One example provides a method comprising recording a plurality of interactions between a user and a computing device conducted using an input device, and extracting, from the plurality of interactions, one or more performance indicators. The method further comprises accessing a data store to obtain a predetermined profile that corresponds to the one or more performance indicators, the predetermined profile including one or more driver parameters, and implementing, at one or both of the computing device and the input device, at least one of the one or more driver parameters so as to at least affect how user input is interpreted at the computing device.

Abstract: The method disclosed herein includes determining a user interaction pattern with respect to a digital marker, the user interaction pattern based at least in part on user interaction with a capacitive sensor of a computing device, determining a geometric characteristic of the digital marker, and generating a predicted digital marking position of the digital marker on a digital medium of the computing device based at least in part on the determined geometric characteristic of the digital marker and the determined user interaction pattern.

Abstract: A computing system includes a touch-sensitive display and one or more processors. The touch-sensitive display is configured to detect a run-time touch input from a user. The one or more processors are configured to execute instructions using portions of associated memory to implement a touch driver of the touch-sensitive display and an artificial intelligence model. The touch driver is configured to process the run-time touch input based on a plurality of calibration parameters and output a touch event and a plurality of run-time touch input parameters associated with the touch input event. The artificial intelligence model is configured to receive, as input, the run-time touch input parameters. Responsive to receiving the run-time touch input parameters, the artificial intelligence model is configured to output a personalized user touch driver profile including a plurality of updated calibration parameters for the touch driver.

Abstract: A method enabling recovery of a terminated client-to-cloud processing sessions includes writing at least some data of cloud-based processing session between a cloud based server and a client device to the client device. Responsive to satisfaction of a session termination condition, the stored data is encrypted such that it can be recovered using suitable decryption techniques when the client-to-cloud-connection is subsequently re-established.

Abstract: Disclosed herein is a system for predicting, given a pattern of triggered alerts, a next alert in order to identify malicious activity that is about to occur on resource(s) being monitored by a security operations center. A resource can include a server, a storage device, a user device (e.g., a personal computer, a tablet computer, a smartphone, etc.), a virtual machine, networking equipment, etc. Accordingly, the next alert is speculatively triggered in advance and a security analyst can be notified of a pattern of activity that is likely to be malicious. The security analyst can then investigate the pattern of triggered alerts and the speculatively triggered alert to determine whether steps to mitigate the malicious activity before it occurs should be taken.

Abstract: Methods, systems, and apparatuses are provided for inferring security incidents from observational data. For example, alerts generated with respect to a set of entities by a first alert generator are received, association scores are calculated for pairs of alerts, the alerts are formed into clusters based on the association scores, and a security incident model is formed based on the clusters. The security incident model may define sequences of alerts corresponding to security incidents. Furthermore, the security incident model may be used to determine a match between additional alerts and a sequence of alerts in the security incident model and identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model.

Abstract: Unauthorized use of user credentials in a network is detected. Data indicative of text strings being used to access resources in the network is accessed. Regex models are determined for the text strings. Groupings of the regex models are determined based on an optimization of a cumulative weighted function. A regex model having a cumulative weighted function that exceeds a predetermined threshold is identified. An alert is generated when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.