公开(公告)号：US11036561B2

公开(公告)日：2021-06-15

申请号：US16044230

申请日：2018-07-24

Applicant: Oracle International Corporation

Inventor： Stuart Wray ,  Felix Schmidt ,  Craig Robert Schelp ,  Manel Fernandez Gomez ,  Nipun Agarwal

IPC: G06F9/50 ,  H04L12/803 ,  H04L12/26

Abstract: Embodiments monitor statistics from groups of devices and generate an alarm upon detecting a utilization imbalance that is beyond a threshold. Particular balance statistics are periodically sampled, over a timeframe, for a group of devices configured to have balanced utilization. The devices are ranked at every data collection timestamp based on the gathered device statistics. The numbers of times each device appears within each rank over the timeframe are tallied. The device/rank summations are collectively used as a probability distribution representing the probability of each device being ranked at each of the rankings in the future. Based on this probability distribution, an entropy value that represents a summary of the imbalance of the group of devices over the timeframe is derived. An imbalance alert is generated when one or more entropy values for a group of devices shows an imbalanced utilization of the devices going beyond an identified imbalance threshold.

公开(公告)号：US10768982B2

公开(公告)日：2020-09-08

申请号：US16135802

申请日：2018-09-19

Applicant: Oracle International Corporation

Inventor： Andrew Brownsword ,  Tayler Hetherington ,  Pavan Chandrashekar ,  Akhilesh Singhania ,  Stuart Wray ,  Pravin Shinde ,  Felix Schmidt ,  Craig Schelp ,  Onur Kocberber ,  Juan Fernandez Peinador ,  Rod Reddekopp ,  Manel Fernandez Gomez ,  Nipun Agarwal

IPC: G06F9/54 ,  G06F9/48 ,  G06F11/30 ,  G06F9/38 ,  G06F9/455 ,  G06N20/00 ,  G06F16/11 ,  G06F16/18

Abstract: Herein are techniques for analysis of data streams. In an embodiment, a computer associates each software actor with data streams. Each software actor has its own backlog queue of data to analyze. In response to receiving some stream content and based on the received stream content, data is distributed to some software actors. In response to determining that the data satisfies completeness criteria of a particular software actor, an indication of the data is appended onto the backlog queue of the particular software actor. The particular software actor is reset to an initial state by loading an execution snapshot of a previous initial execution of an embedded virtual machine. Based on the particular software actor, execution of the execution snapshot of the previous initial execution is resumed to dequeue and process the indication of the data from the backlog queue of the particular software actor to generate a result.

公开(公告)号：US20200034208A1

公开(公告)日：2020-01-30

申请号：US16044230

申请日：2018-07-24

Applicant: Oracle International Corporation

Inventor： Stuart Wray ,  Felix Schmidt ,  Craig Robert Schelp ,  Manel Fernandez Gomez ,  Nipun Agarwal

IPC: G06F9/50

Abstract: Embodiments monitor statistics from groups of devices and generate an alarm upon detecting a utilization imbalance that is beyond a threshold. Particular balance statistics are periodically sampled, over a timeframe, for a group of devices configured to have balanced utilization. The devices are ranked at every data collection timestamp based on the gathered device statistics. The numbers of times each device appears within each rank over the timeframe are tallied. The device/rank summations are collectively used as a probability distribution representing the probability of each device being ranked at each of the rankings in the future. Based on this probability distribution, an entropy value that represents a summary of the imbalance of the group of devices over the timeframe is derived. An imbalance alert is generated when one or more entropy values for a group of devices shows an imbalanced utilization of the devices going beyond an identified imbalance threshold.

公开(公告)号：US11784964B2

公开(公告)日：2023-10-10

申请号：US17197375

申请日：2021-03-10

Applicant: Oracle International Corporation

Inventor： Renata Khasanova ,  Felix Schmidt ,  Stuart Wray ,  Craig Schelp ,  Nipun Agarwal ,  Matteo Casserini

IPC: H04L61/4511 ,  G06N20/00 ,  H04L41/16 ,  G06F40/30

CPC classification number: H04L61/4511 ,  G06N20/00 ,  H04L41/16 ,  G06F40/30

Abstract: Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.

公开(公告)号：US20220027777A1

公开(公告)日：2022-01-27

申请号：US16935313

申请日：2020-07-22

Applicant: Oracle International Corporation

Inventor： Felix Schmidt ,  Yasha Pushak ,  Stuart Wray

IPC: G06N20/00 ,  G06F16/901 ,  G06N5/04

Abstract: Techniques are described that extend supervised machine-learning algorithms for use with semi-supervised training. Random labels are assigned to unlabeled training data, and the data is split into k partitions. During a label-training iteration, each of these k partitions is combined with the labeled training data, and the combination is used train a single instance of the machine-learning model. Each of these trained models are then used to predict labels for data points in the k−1 partitions of previously-unlabeled training data that were not used to train of the model. Thus, every data point in the previously-unlabeled training data obtains k−1 predicted labels. For each data point, these labels are aggregated to obtain a composite label prediction for the data point. After the labels are determined via one or more label-training iterations, a machine-learning model is trained on data with the resulting composite label predictions and on the labeled data set.

公开(公告)号：US11451565B2

公开(公告)日：2022-09-20

申请号：US16122664

申请日：2018-09-05

Applicant: Oracle International Corporation

Inventor： Guang-Tong Zhou ,  Hossein Hajimirsadeghi ,  Andrew Brownsword ,  Stuart Wray ,  Craig Schelp ,  Rod Reddekopp ,  Felix Schmidt

IPC: G06N3/04 ,  H04L9/40 ,  G06K9/62

Abstract: Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.

公开(公告)号：US12217136B2

公开(公告)日：2025-02-04

申请号：US16935313

申请日：2020-07-22

Applicant: Oracle International Corporation

Inventor： Felix Schmidt ,  Yasha Pushak ,  Stuart Wray

IPC: G06N20/00 ,  G06F16/901 ,  G06N5/04

Abstract: Techniques are described that extend supervised machine-learning algorithms for use with semi-supervised training. Random labels are assigned to unlabeled training data, and the data is split into k partitions. During a label-training iteration, each of these k partitions is combined with the labeled training data, and the combination is used train a single instance of the machine-learning model. Each of these trained models are then used to predict labels for data points in the k−1 partitions of previously-unlabeled training data that were not used to train of the model. Thus, every data point in the previously-unlabeled training data obtains k−1 predicted labels. For each data point, these labels are aggregated to obtain a composite label prediction for the data point. After the labels are determined via one or more label-training iterations, a machine-learning model is trained on data with the resulting composite label predictions and on the labeled data set.

公开(公告)号：US20230421528A1

公开(公告)日：2023-12-28

申请号：US18237853

申请日：2023-08-24

Applicant: Oracle International Corporation

Inventor： Renata Khasanova ,  Felix Schmidt ,  Stuart Wray ,  Craig Schelp ,  Nipun Agarwal ,  Matteo Casserini

IPC: H04L61/4511 ,  G06N20/00 ,  H04L41/16

CPC classification number: H04L61/4511 ,  G06F40/30 ,  H04L41/16 ,  G06N20/00

Abstract: Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.

公开(公告)号：US20220294757A1

公开(公告)日：2022-09-15

申请号：US17197375

申请日：2021-03-10

Applicant: Oracle International Corporation

Inventor： Renata Khasanova ,  Felix Schmidt ,  Stuart Wray ,  Craig Schelp ,  Nipun Agarwal ,  Matteo Casserini

IPC: H04L29/12 ,  H04L12/24 ,  G06N20/00

Abstract: Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.

公开(公告)号：US10917203B2

公开(公告)日：2021-02-09

申请号：US16414954

申请日：2019-05-17

Applicant: Oracle International Corporation

Inventor： Stuart Wray ,  Felix Schmidt ,  Craig Schelp ,  Pravin Shinde ,  Akhilesh Singhania ,  Nipun Agarwal

IPC: G06F11/00 ,  H04L1/20 ,  H04B17/309 ,  H04L12/26 ,  H04L1/00 ,  H04B17/26

Abstract: Embodiments use Bayesian techniques to efficiently estimate the bit error rates (BERs) of cables in a computer network at a customizable level of confidence. Specifically, a plurality of probability records are maintained for a given cable in a computer system, where each probability record is associated with a hypothetical BER for the cable, and reflects a probability that the cable has the associated hypothetical BER. At configurable time intervals, the probability records are updated using statistics gathered from a switch port connected to the cable. In order to estimate the BER of the cable at a given confidence level, embodiments determine which probability record is associated with a probability mass that indicates the confidence level. The estimate for the cable BER is the hypothetical BER that is associated with the indicated probability mass. Embodiments store the estimate in memory and utilize the estimate to aid in maintaining the computer system.