Abstract: A system for detecting and mitigating application security threats comprises a processor associated with a server. The processor executes a static security model to analyze a group of development code sets for an application to detect threat objects. The processor determines that a number of threat objects in each development code set is lower than a threshold. The processor further executes a run-time security model to analyze the combined code sets to determine a set of threat object measurements of application product releases for the application. The processor generates a set of threat change ratios per application based on a first threat object measurement and the threat object measurements after the first threat object measurement. The processor determines threat change patterns of the threat change ratios associated with the application product releases for the application. The processor determines whether to trigger a development security model for the application.

Abstract: A system and method for generating a series of content areas for presentation at a display screen that are related to an overall machine-related-status of a machine-system, including: providing a status at an input of a first processing unit; accessing a first database-system storing a plurality of series of content areas including a respective position of each of the content areas for presentation at a display screen assigned to the respective overall machine-related-status; determining the series of content areas related to the actual overall machine-related-status for selecting the series of content areas assigned to the actual overall machine-related-status, and generating the selected series of content areas, including a respective position of each of the content areas for presentation the series of content areas related to the actual provided machine-system status at the respective position at the display screen.

Abstract: A system for detecting and mitigating application security threats comprises a processor associated with a server. The processor analyzes a group of code sets of an application and determines a number of the threat objects in each code set. The processor further executes a run-time security model to analyze a combined code sets to determine threat object measurements and false positive measurements of application product releases for the application. The processor determines threat threshold ratios and false positive ratios per application. The processor further generates an array of quartile weights corresponding to a set of quartile ranges of the threat threshold ratios and a set of quartile ranges of the false positive ratios associated with the application. The processor generates an adjusted object measurement for the application based on a corresponding quartile weight in the array. The processor determines whether to trigger a development security model for the application.

Abstract: A mold temperature control system includes: an inference model generating portion configured to, based on a plurality of pieces of thermo image data of a mold acquired at predetermined intervals and pieces of teaching data associated with the plurality of pieces of thermo image data, learn a predetermined number of consecutive pieces of time-series image data extracted from the plurality of pieces of thermo image data as one piece of sample data to generate an inference model for detecting a sign of a temperature anomaly of the mold; a mold temperature anomaly degree inference portion configured to detect occurrence of the sign of the temperature anomaly of the mold the predetermined number ahead, using the inference model, based on the predetermined number of pieces of time-series image data of the mold; and a warning lamp request transmitting portion configured to control lighting-up of a warning lamp.

Abstract: An environmental control system includes a transmitting device for signaling to a receiver to activate an environmental control unit (ECU). The transmitting device includes a connector for removably installing and connecting to electrical power in the vehicle and a transmitter for transmitting a signal to a remote receiver. The ECU comprises of an exterior control panel and microprocessor-based controller for operating environmental devices within a facility or other defined space. When the controller receives an input from any of the receiver and an external environmental device, it activates at least one of the environmental devices. When the controller receives any such input that is outside a predefined range, the controller generates any of a visual or audible alarm and notifies a predetermined recipient.

Abstract: A computer system, non-transitory computer storage medium, and a computer-implemented method of assessing technical risk using visual pattern recognition in an Information Technology (IT) Service Management System. A data visualization engine and a time series generation engine receive the operational data, respectively. A first representation of the data is generated by the data visualization engine, and a second representation of the data is generated by the time series generation engine. Anomaly patterns are identified by a pattern recognition engine configured to perform feature extraction and data transformation. An ensembler is configured to accept the outputs from two AI anomaly engines and make a final decision of whether anomaly patterns are captured. Risk scores based on the identified anomaly patterns are output by a pattern recognition engine to an automated management system. The anomalies includes information regarding vulnerabilities of devices or components of the IT Service Management System.

Abstract: In a transfer control apparatus (100), each function unit (110) specifies a transfer time and a device ID, and makes a transfer request of device data. A first control unit (111), in response to the transfer request from a request source being any of a plurality of function units (110), transfers the device data between a first area (121) corresponding to the request source, and a second area (122) corresponding to a combination of the transfer time and the device ID specified by the request source. A second control unit (112) transfers, when a second area (122) corresponding to a transfer time being same as a time notified by a timer (113) exists, the device data between that second area (122), and a third area (123) corresponding to the same device ID as that second area (122).

Abstract: Devices, methods, and systems for alarm processing are described herein. One computing device for alarm processing, includes a memory and a processor configured to execute executable instructions stored in the memory to generate a first alarm for a first system based on a monitored value for the first system, receive a second alarm generated by a second system based on a monitored value for the second system, send the first alarm and the second alarm to an alarm queue, filter the alarm queue based on the monitored values associated with the first alarm and the second alarm within the alarm queue, and push the first alarm or the second alarm within the alarm queue to an application based on the filtering.

Abstract: Activities within a network environment are monitored (e.g., using agents). At least a portion of the monitored activities are used to generate a logical graph model. The generated logical graph model is used to determine an anomaly. The detected anomaly is recorded and can be used to generate an alert.

Abstract: An abnormality in a manufacturing system is detected without extensive modification to the existing manufacturing systems. The data analysis device includes: a receiver configured to receive a packet transmitted between a manufacture control device and a manufacturing device; an analyzer configured to obtain the type of data included in a payload of the received packet from an IP address and a port number included in a header of the packet; a selector configured to select, based on the type of the data obtained by the analyzer, a syntax or rule corresponding to the type of the data; and a determiner configured to determine that the manufacturing system has an abnormality if the data included in the payload does not follow the syntax or rule corresponding to the type of the data.

Abstract: The disclosure generally describes methods, software, and systems, including a method for providing a suggested view of asset information for presentation. A set of correlated records is identified for a plurality of assets. The set of correlated records includes a correlated set of at least one characteristic of a particular asset and a characteristic of the non-asset-specific signals. The set of correlated records is analyzed to identify a set of anomaly-detection rules. In a presentation of at least a subset of the assets, an indication of assets associated with a potential anomaly identified. A suggested view is identified based on the potential anomaly and at least one characteristic/signal associated with the determination that the potential anomaly exists. The suggested view is provided for presentation in a user interface.

Abstract: An anomaly detection module may include a time-series analyzer that classifies current time-series data into at least one of a plurality of classifications based upon historical data and may construct a statistical model representative of the current time-series data based upon the at least one of the plurality of classifications. An anomaly detector monitors a stream of the current time-series data and identifies statistical outliers of the stream of the current time-series data, based upon the statistical model and may determine an anomalous score for the statistical outliers by tracking a history of the statistical outliers; wherein the anomalous score comprises a representation of a magnitude of deviation between the current time-series data and the statistical model over multiple measurements of the current time-series data, over a particular time interval, or both.

Abstract: Methods, systems, and storage media for image thresholding at a network edge device are disclosed herein. In an embodiment, a network edge device may include a camera to be operated by at least one of the one or more processors to capture a monitoring image of a condition proximal to the device at a location. An image threshold module may be operated by at least one of the one or more processors to determine if the monitoring image exceeds a threshold relating to the condition at the location. A communication module may communicate to a remote network location an indication if the monitoring image exceeds the threshold relating to the condition.

Abstract: An event clustering system includes a processor that generates reports. An extraction engine is in communication with an infrastructure. The extraction engine receives data from the infrastructure, produces events and populates a database with a dictionary of event or graph entropy. An alert engine receives the events and creates alerts mapped into a matrix, M. A signalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The signalizer engine determines one or more common steps from events and produces clusters relating to the alerts and or events. One or more interactive displays provide a collaborative interface a coupled to the extraction and the signalizer engine for decomposing events from the infrastructure.

Abstract: Systems and methods are provided for optimizing system output in production systems, comprising. The method includes separating, by a processor, one or more initial input variables into a plurality of output variables, the output variables including environmental variables and system response variables. The method also includes building, using the processor, a nonparametric estimation that determines a relationship between one or more initial control variables and the system response variables, and estimating a global input-output mapping function, using the determined relationship, and a range of the environmental variables. The method further includes generating one or more optimal control variables from the initial control variables by maximizing the input-output mapping function and the range of the environmental variables. The method additionally includes incorporating one or more of the optimal control variables into a production system to increase production output of the production system.

Abstract: Provided is a method of analyzing audio content. The method includes: extracting a feature value of the audio content; classifying the audio content on a section basis of the audio content based on the extracted feature value; and selecting at least one section for analyzing the audio content, and performing analysis on audio content of the at least one selected section based on a class to which the audio content of each section belongs.

Abstract: An event clustering system is configured to generate reports. An extraction engine is in communication with an infrastructure. The extraction engine in operation receives data from the infrastructure and produces events. An alert engine receives the events and creates alerts mapped into a matrix, M. A sigalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common steps from events and produces clusters relating to the alerts and or events. A reporting engine is configured to be coupled to the event clustering system.

Abstract: An event clustering system is provided. An extraction engine is in communication with an infrastructure. The extraction engine in operation receives data from the infrastructure and produces events. An alert engine receives the events and creates alerts mapped into a matrix, M. A sigalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common steps from events and produces clusters relating to the alerts and or events. A data extraction device is configured to be coupled to the event clustering system.

Abstract: The subject technology provides configurations for propagating information from an initial analytics tracking data communication to subsequent analytics tracking data communications at an analytics server. In one example, the subject technology receives an analytics tracking data communication. The subject technology determines if the received analytics tracking data communication includes state changing information based on analytics tracking data included in the analytics tracking data communication. The subject technology then determines one or more attributes for propagating to subsequent analytics tracking data if the analytics tracking data communication includes state changing information. The state changing information are stored as one or more of the determined one or more attributes. The subject technology stores the analytics tracking data including the determined one or more attributes.

Abstract: A social networking system generates one or more metrics describing user interactions with objects to describe the popularity of the objects among users. Data describing actions performed by social networking system users on objects stored by the social networking system to identify an action, the user performing the action and the object on which the action was performed. Stored actions performed on a selected object are retrieved and a subset of the actions is generated by sampling the stored actions at a sampling rate. A number of unique users included in the subset is determined and used along with the sampling rate to determine the number of unique users included in the retrieved actions, which is used to derive a metric describing user interaction with the selected object.

Abstract: Embodiments presented herein provide task management capabilities for designing a complex data integration workflow in an integrated design environment (IDE). A task management tool of the IDE allows a developer to tag various stages of a data integration workflow in a non-linear manner. When the task management tool receives a tag for a given stage, the task management tool identifies incomplete tasks associated with the stage and generates a task list that includes the incomplete tasks. The developer may return to completing any of the tasks in the workflow in any sequence as desired.

Abstract: Methods and systems for providing destination-specific network management are described. One example method includes determining a normal data movement profile for a computing device based on observed normal data transfer behavior by the computing device; identifying a data movement rule associated with the computing device, the data movement rule including a deviation amount, and one or more actions to take when the computing device deviates from the normal data movement profile by more than the deviation amount; detecting a data movement associated with the computing device; determining that the detected data movement exceeds the deviation amount included in the data movement rule relative to the normal data movement profile for the computing device; and performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule.

Abstract: Method, system and computer software for diagnosing a compressor. The method includes generating a feature vector of the compressor, the feature vector of the compressor including components describing states of various parts of the compressor; determining, based on fuzzy constraints, an aggregated anomaly vector corresponding to the feature vector; defining rules for a preset list of possible faults/failure modes of the compressor; calculating a corroborating measure between the aggregated anomaly vector and the rules; and identifying a fault/failure mode of the compressor based on a result of the corroborating measure.

Abstract: An image forming apparatus includes an original setting part, an original reading device, an opening/closing member, a locking mechanism, a notifying mechanism, an original detecting part, a user detecting part and a controlling part. The opening/closing member is switchable between an opening posture and a closing posture. The locking mechanism holds the opening/closing member in the closing posture. The notifying mechanism notifies a user that the original is left behind on the original setting part. The controlling part operates the locking mechanism and the notifying mechanism on condition that the original detecting part detects the original and the user detecting part does not detect the user in a state where the original reading device has finished reading the original. The controlling part stops operation of the locking mechanism on condition that authentication of a specific user succeeds in a state where the locking mechanism is operated.

Abstract: A social networking system generates one or more metrics describing user interactions with objects to describe the popularity of the objects among users. Data describing actions performed by social networking system users on objects stored by the social networking system to identify an action, the user performing the action and the object on which the action was performed. Stored actions performed on a selected object are retrieved and a subset of the actions is generated by sampling the stored actions at a sampling rate. A number of unique users included in the subset is determined and used along with the sampling rate to determine the number of unique users included in the retrieved actions, which is used to derive a metric describing user interaction with the selected object.

Abstract: A system and method is disclosed for tracking representations of object properties in modified computational objects. A computational object of the subject technology may include an object property having a first value of a first property type. When the object property is set to a second value of a second property type, a new object map is generated for the computational object, the new object map mapping the object property to the second property type, and transition information in a base object map is updated to designate the new object map instead of a first object map. The first object map is then marked as invalid.

Abstract: A method for detecting an abnormal traffic on a control system protocol, includes: checking whether session information exists in a management table; adding a new entry to the management table; checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message; and checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry. Further, the method includes detecting an abnormal traffic; and updating the table entry with packet information of the MODBUS request message.

Abstract: A method for determining whether a defined section of a transportation track is occupied is described. The method includes inducing an audio frequency (AF) signal at a first position on the transportation track and receiving the AF signal at a second position on the transportation track. The defined section of the transportation track is located between the first position and the second position on the transportation track. The method further includes measuring a strength of the AF signal received as a function of time at the second position, and identifying an inflection point of the recorded AF signal strength. The inflection point indicates at least one of a rail vehicle entering the defined section of the transportation track and the rail vehicle exiting the defined section of the transportation track. The method further includes determining an occupancy of the defined section of the transportation track, based on the inflection point.

Abstract: A process control system that controls an industrial process implemented in a plant, may include: a network provided in the plant; a first field device that is connected to the network, the first field device being configured to output one of measurement data, which is obtained by measuring a state quantity in the industrial process, and first simulation data, which simulates the state quantity; a controller that is connected to the network, the controller being configured to perform control in response to one of the measurement data and the first simulation data output from the first field device; and a simulator configured to generate the first simulation data to be output from the first field device.

Abstract: Methods and apparatus to apply multiple trip limits to a device in a process control system are disclosed. An example method involves monitoring a value of a parameter associated with the operation of the device and receiving an input indicative of an operational state of the device, where a first input indicates a first operational state and a second input indicates a second operational state. If the first input is received, comparing via a function block the value of the parameter to a first trip limit, and if the second input is received, comparing via the function block the value of the parameter to a second trip limit, and implementing a response based on the comparison.

Abstract: An embedded system is disclosed. The embedded system is used for preventing a processing machine from an abnormal phenomenon when at least one processing parameter setting value is inputted into the processing machine. The embedded system is electrically connected to the processing machine, and the processing machine comprises an input interface, a first storing medium, a first controller and a stepper motor. The embedded system comprises a second storing medium and a second controller. The second controller captures the a processing parameter setting value inputted and compares it with a security range, so as to determine whether the processing machine is able to perform process for a workpiece. When the second controller determines that the processing machine is not able to perform process for the workpiece, a stop signal is generated and transmitted to the processing machine to stop performing process for the workpiece.

Abstract: The present invention relates to a method of enabling an operator to make control or protection related decisions in a process control system, an operator terminal in a process control system as well as to a computer program product for such an operator terminal. The method includes the steps receiving (38) an operator selection of a control object in a view of control objects, selecting (40) a number of data points for a group of control objects including the operator selected control object according to a data point selection criterion, fetching (42) process data values associated with the data points and with different control aspects, and presenting (44) the process data values of on a display, where each data point receives one corresponding presentation axis on which data values of this data point are presented and data values of data points associated with the same control aspect are linked together with a line.

Abstract: When a communication abnormality detection unit in a numerical control device body detects communication abnormality in IO communication, a command transmission unit transmits a command requesting for making a reply to the numerical control device body with alarm information recorded in a recording unit of each IO unit simultaneously to all the IO units, and only the IO unit where the recording unit records the alarm information makes a reply with the alarm information.

Abstract: A monitoring apparatus includes a processor that executes a procedure, the procedure including outputting an alert when observation data satisfies a certain condition, the observation data being obtained at a certain time interval, suppressing the outputting of the alert in accordance with control, and performing control the suppressing until the certain time elapses since one of the outputting of the alert and the suppressing is performed.

Abstract: An industrial control system is provided that includes a field device configured to provide an alert, wherein the field device is configured to receive only a first plurality of behaviors for the alert and a controller of an industrial control system. The controller is configured to receive the alert and to customize a second plurality of behaviors. The controller is further configured to overlay the second plurality of behaviors on the alert, and the controller is configured to process one or more of the second plurality of behaviors differently than the first plurality of behaviors.

Abstract: What is disclosed is a wireless push button device. The wireless push button device includes a user interface configured to receive user input to control a process of a machine system. The wireless push button device also includes a first transceiver coupled to the user interface and configured to wirelessly receive input power from a second transceiver, provide user power to the user interface, and wirelessly transfer communications related to the user input to the second transceiver. The wireless push button device also includes a processing system configured to determine when a power transfer problem exists between the second transceiver and the first transceiver, and transfer an alert in response to the power transfer problem.

Abstract: A computer-implemented integrated expert system for the identification of abnormal events in an industrial plant. The expert system integrates a model-based expert system with a rule-based expert system. The model-based expert system receives data on the operating conditions of a process unit in the industrial plant and calculates one or more results that determine whether the process unit is operating abnormally. The rule-based expert system also receives data on the operating conditions of the process unit and applies its rules to the process data. The rule-based expert system also applies its rules to the one or more results generated by the model-based expert system. The integrated system may also suppress any redundant messages generated by the model-based expert system.

Abstract: An industrial process control system is provided. The industrial control system includes an alarm server with a processor configured to receive device information representative of field device information extracted from a device definition file. The processor is further configured to translate the device information into a first format interpretable by a global system for mobile communications (OPC AE) server and provide the device information in the first format to the OPC AE server.

Abstract: A method for detecting an abnormal traffic on a control system protocol, includes: checking whether session information exists in a management table; adding a new entry to the management table; checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message; and checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry. Further, the method includes detecting an abnormal traffic; and updating the table entry with packet information of the MODBUS request message.

Abstract: A system is provided that includes a controller configured to control an industrial automation system. The system also includes a sensor communicatively coupled to the controller. The sensor is configured to measure at least one operating parameter of the industrial automation system, and the sensor, the controller, or a combination thereof, is configured to derive an indication that the at least one operating parameter surpasses a process limit. The system also includes a memory configured to store the indication as an item included in a start checklist. Moreover, the controller is configured to disable a start of the industrial automation system based on the start checklist.

Abstract: A method has been invented for dynamically adapting a diagnostic system, which is at least partially implemented in a controller, and which has at least one diagnostic block. In such case, the controller is, in communication via a fieldbus with at least one field device, wherein the at least one diagnostic block is embodied in such a manner, that through this, various diagnostic parameters of the at least one field device are capable of being read. Additionally, the at least one diagnostic block is implemented (or provided) in the controller and/or in the at least one field device.

Abstract: A method for alarm monitoring abnormal conditions associated with a process operation includes collecting N sample data representing one or more parameters of a process, determining a distribution type of the sample data, obtaining an alarm monitoring strategy associated with the distribution type, and monitoring the process using the alarm monitoring strategy. The distribution type may be single-constant, multi-level discrete, normally distributed, continuous non-normally distributed, cyclical trend-up/down, and drifting away after a period maintenance. The alarm monitoring strategy includes a unilateral or bilateral control chart. The one-side control chart has either an upper control limit (UCL) of (100?p) or a lower control limit (LCL) of (p), and the two-sided control chart has a UCL of (100?p/2) and an LCL of (p/2), where p is a predetermined false alarm rate which determines the number N. The control limit may be a difference between two adjacent sample values of the sample data.

Abstract: An instrument controlling device includes an instrument information storing portion that stores instrument information, a receiving portion that receives an alert event, a first evaluating portion that evaluates whether an address of an instrument that produced the alert event matches any of the addresses in the instrument information that is stored if the alert event is an installation event, a second evaluating portion that evaluate whether instrument identifying information of device information matches identifying information of the alert event if the address matched, a selection requesting portion that requests, from an administrator, a selection as to whether or not to update the instrument information using the instrument identifying information of the alert event if the instrument identifying information does not match, and an updating portion that updates the instrument information using the instrument identifying information of the alert event if a selected instruction is an updating instruction.

Abstract: A protection monitoring system is provided that includes a protection fault handler. The protection fault handler includes a protection fault indicator. The protection fault handler is configured to activate the protection fault indicator upon indication of a protection fault signal. Moreover, the protection fault signal is indicative of a critical fault which has occurred in a protection system monitored by the protection monitoring system. The protection monitoring system also includes a user inhibit handler. The user inhibit handler includes a user inhibit indicator. Moreover, the user inhibit handler is configured to activate the user inhibit indicator upon indication of a user inhibit signal. Furthermore, the user inhibit signal is indicative of a user-enabled alarm inhibit or a user-enabled bypass.

Abstract: Disclosed are an apparatus for correcting an error of acquired data and a method thereof. The method includes determining whether states of at least one circuit breaker and at least one disconnecting switch included in at least one station are consistent with each other based on data received from at least one remote control apparatus including the at least one station; assigning a weight to a corresponding circuit breaker and a corresponding disconnecting switch and the station including the corresponding circuit breaker and the corresponding disconnecting switch when the determination result represents that the states of the circuit breaker and the disconnecting switch are inconsistent with each other; creating alarm information notifying a malfunction of the corresponding circuit breaker and the corresponding disconnecting switch when an accumulated weight value is equal to or greater than a preset reference weight value; and outputting an alarm corresponding to the alarm information.

Abstract: A diagnostic system and method for a field device in a process plant is provided. The diagnostic apparatus includes a processor operatively connected to the field device and a calendar having a proscribed period stored in memory. A diagnostic check is executed on the field device if an occurrence of a diagnostic event is detected and execution of the diagnostic check does not coincide with the proscribed period.

Abstract: In one embodiment, an industrial process control system includes a field device configured to provide an alert. The process control system also includes a graphical user interface configured to present an alarm for the alert, and an alarm server comprising a processor and configured to associate an alarm class with the alert. The alarm class includes a plurality of alarm attributes having a respective plurality of values, and the graphical user interface is configured to present the alarm for the alert based on the plurality of alarm attributes and the respective plurality of values.

Abstract: An advisable state notification framework for an operator interface system is provided. Advisable states represent events detected within an industrial system that are less critical than alarm events but that nevertheless warrant notification. The framework supports multiple classes of advisable states, which are configured and handled separately from alarm states. Each class of advisable state is notified using a unique graphical icon. Moreover, the framework distributes advisable state icons on selected screens throughout the display screen navigational hierarchy to guide the operator to screens that identify the source of the advisable state. The notification and guidance features are inherent to the operator interface development environment, accelerating development time and reducing the need to create a custom notification framework.

Abstract: A method and apparatus for developing microcomputer-based systems. A controller model having at least one parameter is simulated and, similarly, a plant model having at least one parameter and controlled by the controller model is simulated. A user interface then has access to the parameters of the controller model and plant model and optionally suspends the execution of the controller model and plant model in response to a trigger event. The user interface determines the status of the controller model parameters and/or plant model parameters at the time of the trigger without altering the controller model parameters or plant model parameters or the program code of the controller model.

Abstract: A system is provided herein for remotely controlling and monitoring machinery, the machinery having a control network for control thereof, one or more switches coupled to the control network for controlling the machinery via the control network. The system includes a controller hardwired coupled to the control network of the machinery. The controller is configured to control the machinery via the control network separately from the switches, and the controller is configured to monitor operation of the machinery. In addition, the system includes an arrangement for receiving signals for controlling the controller from a remote location and an arrangement for transmitting, to a remote location, information collected by the controller resulting from the controller monitoring operation of the machinery. Advantageously, with the subject invention, the system can control and monitor machinery from remote locations directly.