Abstract:
Methods and systems for monitoring communication of mobile communication terminals, such as cellular phones. An off-air monitoring system reconstructs both directions of a call conducted between two mobile terminals by receiving only downlink channels. The off-air monitoring system receives multiple downlink transmissions transmitted by base stations in a wireless communication network. The system uses the received downlink transmissions to reconstruct the bidirectional call content of calls conducted between wireless terminals. In order to reconstruct the bidirectional content of a given call, the system identifies and correlates the two downlink transmissions of that call from among the multiple received downlink transmissions.
Abstract:
Methods and systems for protecting computer systems against intrusion. The disclosed techniques detect intrusions by jointly considering both cyber security events and physical security events. In some embodiments, a correlation subsystem receives information related to the computer system and its physical environment from various information sources in the cyber domain and in the physical domain. The correlation subsystem analyzes the information and identifies both cyber security events and physical security events. The correlation subsystem finds cyber security events and physical security events that are correlative with one another, and uses this correlation to detect intrusions.
Abstract:
A profile or dossier of a user is constructed based partly on data culled from a data network that reveals indirect, network-mediated relationships with other individuals and groups. The profile is assembled from information, such as properties of a target individual to build an initial social circle of the target individual. References to the target individual can be derived from the direct and indirect associations in order to compile a dossier on the target individual from the references to the target individual. The initial social circle may be expanded by building respective new social circles having new associations by crawling a plurality of web sites, and deriving additional references to the target individual from the new associations in the new social circles. According to a further aspect of the method, compiling a dossier includes extracting metadata from the references.
Abstract:
A monitoring system that receives messages that are exchanged with the application server. Relationships between users are posited in response to the times at which the messages are received. A relationship between two users may be posited in response to receiving, at approximately the same time, two messages from the application server that are destined, respectively, for the two users. The near-simultaneous receipt of the two messages indicates that the two messages were sent from the server at approximately the same time, which, in turn, indicates that the two messages may correlate with one another. Further indication of a correlation between the messages, which may increase the level of confidence with which the relationship between the two users is posited, may be found by examining the respective sizes of the messages, which indicate the message types.
Abstract:
Methods and systems for storing and managing large numbers of small files. A data processing system includes clients that generate large numbers be stored on a storage device managed by a File System (FS). An Archive Server (AS) receives multiple files from the client, archives the files in larger archives, and sends the archives to the FS for storage. When requested to read a file, the AS retrieves the archive in which the file is stored, extracts the file and sends it to the requesting client. In other words, the AS communicates with the clients in individual file units, and with the storage device in archive units. The AS is typically constructed as an add-on layer on top of a conventional FS, which enables the FS to handle small files efficiently without modification.
Abstract:
Systems and methods of script identification in audio data obtained from audio data. The audio data is segmented into a plurality of utterances. A script model representative of a script text is obtained. The plurality of utterances are decoded with the script model. A determination is made if the script text occurred in the audio data.
Abstract:
Methods and systems to identify the domain names that can potentially be used for delivering instructions to a bot, before bots on a computer network succeed in obtaining the instructions. The system maintains a device rating for each device that reflects a likelihood that the device is infected by malware. The system also maintains a domain-name rating for each device that reflects a likelihood that the domain name is malicious. When a device attempts to access a particular domain name, the domain-name rating of the domain name is updated in light of the device rating of the device, and/or update the device rating of the device in light of the domain-name rating.
Abstract:
Methods and systems for creating demographic profiles of mobile communication network users. A demographic classification system analyzes network traffic, so as to estimate the specific combination of application classes installed on a given terminal, and usage patterns of the applications over time. This combination of application classes and their respective usage patterns are a highly personalized choice made by the user, and is therefore used by the system to deduce the user's demographic profile. The demographic classification system operates on monitored network traffic, as opposed to obtaining explicit and accurate information regarding the installed applications from the terminal. The system then deduces the demographic profile of the user from the list of estimated application classes.
Abstract:
A method for locating of a wireless device, performed by a third party, comprising: communicating with the wireless device in a silent call, to compel the wireless device to continuously emit signals; activating a monitoring apparatus to monitor the signals emitted from the wireless device; resetting an idling timer means of the wireless device, such that the silent call is not ended by the wireless device; identifying a relative location from which the signals become stronger and locating the wireless device; and terminating the silent call.
Abstract:
By formulizing a specific company's internal knowledge and terminology, the ontology programming accounts for linguistic meaning to surface relevant and important content for analysis. The ontology is built on the premise that meaningful terms are detected in the corpus and then classified according to specific semantic concepts, or entities. Once the main terms are defined, direct relations or linkages can be formed between these terms and their associated entities. Then, the relations are grouped into themes, which are groups or abstracts that contain synonymous relations. The disclosed ontology programming adapts to the language used in a specific domain, including linguistic patterns and properties, such as word order, relationships between terms, and syntactical variations. The ontology programming automatically trains itself to understand the domain or environment of the communication data by processing and analyzing a defined corpus of communication data.