Abstract:
Reconstructing web sessions of target users may be performed by accepting communication packets exchanged over a network during at least one network session associated with a target user. The packets may be processed so as to identify web pages viewed by the target user during the network session and interactions between the target user and the viewed web pages. The network session may be reconstructed as viewed by the target user over time, based on the identified web pages and interactions. The reconstructed network session may be presented to an operator. The interactions may be identified by a pattern of one or more packets that matches a given interaction selected from a set of possible interactions that are available in a given viewed web page.
Abstract:
Methods and system for predicting a future location of users of wireless communications terminals. Location information indicating respective locations of multiple wireless communication terminals may be received and processed so as to predict a future meeting among respective users of the wireless communication terminals. An action may be taken with respect to the predicted future meeting. The location information may be received from a wireless communication network to obtain a Point-of-Interest (POI) that is related to one or more of the users from a characteristic location profile of the one or more users. The POI may be indicated as the likely location of the future meeting.
Abstract:
A security method that includes defining rules specifying permitted movements of passengers in a transportation terminal. Passengers entering the terminal may be issued a boarding pass having a Radio Frequency Identification (RFID) tag attached thereto. The location of the RFID tag may be measured and responsive to the measured location of the RFID tag, a violation of at least one of the rules by the passenger may be detected. An action with respect to the detected violation may be taken. The rules may define a region that is forbidden for access, a region in which the passengers are expected to be in motion, a region in which the passengers are expected not to be stationary for more than a given time period, etc.
Abstract:
A computer-implemented method for session processing includes identifying a type of data item that is presented to a user by a computerized system. A session in which the user interacts with the computerized system is recorded. A data item of the identified type is automatically detected in the recorded session. The recorded session is replayed, while refraining from presenting the detected data item in the replayed session.
Abstract:
A method of zoning a transcription of audio data includes separating the transcription of audio data into a plurality of utterances. A that each word in an utterances is a meaning unit boundary is calculated. The utterance is split into two new utterances at a work with a maximum calculated probability. At least one of the two new utterances that is shorter than a maximum utterance threshold is identified as a meaning unit.
Abstract:
Methods, systems, and computer readable media for automated transcription model adaptation includes obtaining audio data from a plurality of audio files. The audio data is transcribed to produce at least one audio file transcription which represents a plurality of transcription alternatives for each audio file. Speech analytics are applied to each audio file transcription. A best transcription is selected from the plurality of transcription alternatives for each audio file. Statistics from the selected best transcription are calculated. An adapted model is created from the calculated statistics.
Abstract:
Methods and systems for range matching. The system holds a definition of one or more ranges of Internet Protocol (IP) addresses. The definition may specify any desired number of ranges of any suitable size, and some ranges may overlap one another or be contained in one another. The definition may also specify certain returned values and/or relative priorities for the various ranges. In a pre-processing phase, a hash table that is subsequently queried with addresses to be range-matched. The hash table may be updated at run-time. During operation, the system receives addresses (e.g., extracts addresses from monitored communication traffic) and identifies by querying the hash table, for each address, whether the address falls within any of the ranges.
Abstract:
Systems and methods of script identification in audio data obtained from audio data. The audio data is segmented into a plurality of utterances. A script model representative of a script text is obtained. The plurality of utterances are decoded with the script model. A determination is made if the script text occurred in the audio data.
Abstract:
Methods and systems for monitoring activity on a local area networks (LAN). In particular, embodiments described herein provide systems and methods for associating packets with the devices from which they were communicated, despite the obfuscatory behavior of any network address translators (NAT). A processor first receives packets that were collectively communicated, by a plurality of devices, via a NAT-serviced LAN. The processor aggregates the packets into multiple packet aggregations on a per device basis. Fields that are contained in the respective packet headers of the packets are used. The packet aggregations may be grouped. The embodiments use unencrypted lower-level information (including, for example, IPIDs and domain names), such that aggregation and grouping may be successfully performed even if information in the application layer is encrypted.
Abstract:
Automatic forensic investigation techniques to more effectively differentiate false positives from true positives. An incident is automatically investigated by a processor that communicates instructions to a device on a network and analyzes information received from the device in response to the instructions. In response to analyzing, the processor raises or lowers its level of confidence in the incident. If the processor's level of confidence in the incident is sufficiently high, the processor generates an output that indicates that the security of the network has been compromised. Otherwise, the processor ascertains that the incident is a false positive and may modify a criteria for alert generation.