公开(公告)号：US11431792B2

公开(公告)日：2022-08-30

申请号：US15420420

申请日：2017-01-31

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： Manish Marwah ,  Renato Keshet ,  Barak Raz ,  Brent James Miller

IPC: H04L29/06 ,  H04L67/104 ,  H04L9/40 ,  H04L12/46

Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. Contextual information is determined for the alert, the determined contextual information comprising spatial and temporal distributions of previous instances of the alert or similar alerts. The contextual information is communicated for use in addressing the issue in the computing arrangement.

公开(公告)号：US10255084B2

公开(公告)日：2019-04-09

申请号：US15184478

申请日：2016-06-16

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： Olga Shain ,  Yaniv Sabo ,  Renato Keshet

IPC: G06F3/0481 ,  G06F9/451 ,  G06F17/30

Abstract: The present disclosure relates to an interactive system that manages analytics contexts through a series of analytics interactions. The disclosed interactive system receives a selection of an analytics interaction from a user during an interactive analytics session. Then, the system generates a series of analytics interactions by the user during the interactive analytics session. Each analytics interaction represents an analytics context that comprises an analytics interaction, a result, and a reference analytics context. Moreover, the system manages a plurality of analytics contexts by selecting the reference analytics context from previous analytics interactions, or by navigating to a different analytics context, or by deactivating a user-selected analytics context, and presents to the user the series of analytics interactions with the result corresponding to both the selection of the analytics interaction and the reference analytics context. Each analytics interaction in the series of analytics interactions is selectable by the user.

公开(公告)号：US20170192872A1

公开(公告)日：2017-07-06

申请号：US15325847

申请日：2014-12-11

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Morad Awad ,  Gil Elgrably ,  Mani Fischer ,  Renato Keshet ,  Mike Krohn ,  Alina Maor ,  Ron Maurer ,  Igor Nor ,  Olga Shain ,  Doron Shaked

IPC: G06F11/34 ,  G06F17/18

CPC classification number: G06F11/3476 ,  G06F3/04842 ,  G06F11/3072 ,  G06F11/3452 ,  G06F16/24568 ,  G06F17/18 ,  G06F17/40 ,  G06F2201/86 ,  G06K9/00543 ,  G06K9/6284

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

公开(公告)号：US20170149810A1

公开(公告)日：2017-05-25

申请号：US14951807

申请日：2015-11-25

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Renato Keshet ,  Justin Scaggs ,  Yaniv Sabo ,  Ron Maurer ,  Hila Nachlieli ,  Alina Maor ,  Olga Shain ,  Alexander Maydanik

IPC: H04L29/06

CPC classification number: H04L63/1425 ,  H04L63/0281 ,  H04L63/145

Abstract: An interactive system to detect malware is provided to interactively analyze web proxy log data. The log data is progressively processed to compute analytics for different context settings. The system has a context module, an interaction module and a plurality of analytics modules. When a change of the context setting (filter, weights etc.) is requested, the processing and calculation of analytics for the current context setting is paused and subsequently restarted for the now changed context setting. An analytics interface provided via a graphical user interface is updated upon the change of context settings.

公开(公告)号：US11061395B2

公开(公告)日：2021-07-13

申请号：US16071959

申请日：2016-02-04

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Sagi Schein ,  Renato Keshet

IPC: G05B23/02 ,  G06N3/04 ,  H04L29/06

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

公开(公告)号：US10534800B2

公开(公告)日：2020-01-14

申请号：US15564573

申请日：2015-04-30

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： Hila Nachlieli ,  George Forman ,  Renato Keshet

IPC: G06F17/30 ,  G06F16/28 ,  G06F5/01 ,  G06N5/04 ,  G06N99/00

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating a group of most frequent elements in a dataset, calculating features of each of the most frequent elements in the dataset, applying a trained model to the features of each of the most frequent elements, and generating a list of predicted relevant elements from the list of most frequent elements. The method further comprises determining at least one element-chain group for each predicted relevant element and a group score for the element-chain-group, ordering a plurality of element-chain groups for the dataset based on the group score for each of the element-chain groups, and identifying a predetermined number of element-chain groups to be outputted to a user.

公开(公告)号：US20170053024A1

公开(公告)日：2017-02-23

申请号：US15306803

申请日：2014-04-28

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： George Forman ,  Renato Keshet ,  Hila Nachlieli

IPC: G06F17/30 ,  G06N99/00

CPC classification number: G06F16/35 ,  G06F16/3344 ,  G06N20/00

Abstract: According to an example, term chain clustering may include receiving a set of training cases from a known category, and receiving a set of unlabeled cases that are to be analyzed with respect to the known category. A plurality of terms of the set of training cases from the known category, and the set of unlabeled cases that are to be analyzed, may be analyzed using a term scoring function to generate a score for each of the plurality of terms. A highest scoring term may be selected from the analyzed terms based on the score for each of the plurality of terms. A selected set that includes cases from the set of unlabeled cases that include the highest scoring term may be generated.

Abstract translation: 根据一个示例，术语链聚类可以包括从已知类别接收一组训练情况，以及接收关于已知类别进行分析的一组未标记的病例。 可以使用术语评分函数来分析来自已知类别的一组训练情况的多个术语，以及将要分析的一组未标记的病例，以生成多个术语中的每一个的得分。 可以基于多个术语中的每一个的分数从所分析的术语中选择最高得分项。 可以生成包括来自包括最高得分项的未标记案例集的案例的选定集合。

公开(公告)号：US11899444B2

公开(公告)日：2024-02-13

申请号：US17348380

申请日：2021-06-15

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Sagi Schein ,  Renato Keshet

IPC: G05B23/02 ,  G06N3/044 ,  H04L9/40

CPC classification number: G05B23/0297 ,  G06N3/044 ,  H04L63/1425

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

公开(公告)号：US11240256B2

公开(公告)日：2022-02-01

申请号：US15420417

申请日：2017-01-31

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： Tomasz Jaroslaw Bania ,  William G. Horne ,  Renato Keshet ,  Pratyusa K. Manadhata ,  Manish Marwah ,  Brent James Miller ,  Barak Raz ,  Tomas Sander

IPC: G06F21/00 ,  H04L29/06

Abstract: In some examples, a plurality of alerts relating to issues in a computing arrangement are received, where the plurality of alerts generated based on events in the computing arrangement. A subset of the plurality of alerts is grouped into a bundle of alerts, the grouping being based on a criterion. The bundle of alerts is communicated to cause processing of the alerts in the bundle of alerts together.

公开(公告)号：US20190033851A1

公开(公告)日：2019-01-31

申请号：US16071959

申请日：2016-02-04

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Sagi Schein ,  Renato Keshet

IPC: G05B23/02 ,  G06N3/04 ,  H04L29/06

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.