429 results about "Event analysis" patented technology

Techniques for managing real-time business event analysis and monitoring are provided. In some examples, a logical request may be received at a business intelligence server configured with a continuous query service. Additionally, the continuous query service may be configured to translate the logical request into a physical request. Further, business intelligence information may be provided based at least in part on querying against an event data stream with a continuous query configured based at least in part on the physical request translated by the continuous query service.

A system for predictive analysis of very large data sets using a distributed computational graph has been developed. Data receipt software receives streaming data from one or more sources. In a batch data pathway, data formalization software formats input data for storage. A batch event analysis server inspects stored data for trends, situations, or knowledge. Aggregated data is passed to message handler software. System sanity software receives status information from message handler and optimizes system performance. In the streaming pathway, transformation pipeline software manipulates the data stream, provides results back to the system, receives directives from the system sanity and retrain software.

Athletic performance monitoring systems and methods, many of which utilize, in some manner, global positioning satellite (“GPS”) data, provide data and information to athletes and/or to equipment used by athletes during an athletic event. Such systems and methods may provide route information to athletes and/or their trainers, e.g. for pre-event planning, goal setting, and calibration purposes. Such systems and methods optionally may provide real time information to the athlete while the event takes place, e.g., to assist in reaching the pre-set goals. Additionally, data and information collected by such systems and methods may assist in post-event analysis for athletes and their trainers, e.g., to evaluate past performances and to assist in improving future performances.

A system that analyzes data from sensors and video cameras to generated synchronized event videos and to automatically select or generate tags for an event. Enables creating, transferring, obtaining, and storing concise event videos generally without non-event video. Events stored in the database identifies trends, correlations, models, and patterns in event data. Tags may represent for example activity types, players, performance levels, or scoring results. The system may analyze social media postings to confirm or augment event tags. Users may filter and analyze saved events based on the assigned tags. The system may create highlight and fail reels filtered by metrics and by tags.

A system and method for the dynamic distribution of intrusion signatures to aid in protecting a network system from harmful activities. An analysis function includes means for identifying one or more intrusion signatures to be dynamically distributed to an intrusion detection function for monitoring. The analysis function and/or the intrusion detection function may be centralized or distributed. Monitoring may be prioritized, localized, and made operational or non-operational. The intrusion detection function may be embodied in either or both of an appliance and a network forwarding device. The analysis function may distribute the intrusion detection function in addition to the intrusion signatures. In one embodiment of the invention, the system includes an intrusion detection function and a dynamic intrusion signatures function. The intrusion detection function monitors for and reports detected intrusion signatures. The dynamic intrusion signatures function determines whether reported intrusion signatures exist in a library of signatures associated with a particular intrusion detection function. If the reported signature does not exist in the library, the library is updated. Detected intrusion signatures are reported to similarly enabled devices for library analysis and updating, if necessary. The related method includes the steps of monitoring for intrusion signatures or other triggering events, analyzing the events and updating IDS signature libraries as necessary. Optional steps of the method include verifying that reported information has been received and acted upon, and recording of the detection, reporting, and updating information in a central repository. The system and method enable dynamic distribution of IDS signatures enabling improved network IDS coverage while limiting the processing and storage requirements of network devices, particularly forwarding devices such as switches and routers that may include the IDS function. That capability enables broader coverage, faster and better tuned responses to harmful activities.

The embodiment of the invention provides a modeling method of an early warning model of mixed failures and a modeling system. The modeling method provided by the invention comprises the following steps of: generating a function analyzing module on the basis of HAZOP (Hazard and Operability Analysis) or FMEA (Failure Mode and Effects Analysis); generating a degeneration analyzing module on the basis of FMEA analyzing results and a theory of stochastic processes; generating an accident analyzing module according to state monitoring data and maintenance action information; generating an action analyzing module according to output results of the function analyzing module and the degeneration analyzing module through combining a DBN (Dynamic Bayesian Network) theory; taking the output of the accident analyzing module as an inference evidence and utilizing a DBN inference algorithm to process forward and backward inferences in the same time period to generate an evaluating module for outputting factors and consequences of system failures; taking the output results of the evaluating module and the accident analyzing module as the inference evidence and utilizing the DBN inference algorithm to process forward and backward inferences in the different time periods to generate a predicating module for outputting prospective degeneration tendencies of each member of the system. The model provided by the invention can be used for tracking the failure factors of the system and inferring possible failure consequences and probability.

A method and system for generating recommendations across multiple product or service domains are disclosed. The system includes a plurality of domain servers for handling user events and for interfacing with users via the Internet, a database for storing the user events, and a recommendation engine. The recommendation engine further includes one or more computer programs containing instructions for collecting the user events across a plurality of product or service domains in the database, receiving a triggering event for recommendations, analyzing the user events to formulate correlations between the user events in the database, and generating recommendations in response to the triggering event in accordance with the correlations between the user events in the database. The disclosure uses user input data from different domains for producing recommendations in any of those domains. The disclosure allows for access to a greater amount of user input data which in turn improves the quality of recommendations.

Systems and methods for providing a framework for supporting a self organizing/optimization network (SON) feature in an over the air communications system. An enhanced mobile communications device is provided that performs functions to creating a framework for enhancing SON algorithms. The communications device stores event analysis data in an on board memory and, on certain conditions, signals the analysis to the network. The analysis includes information useful in performing SON algorithms at the network level, such as cell coverage and neighboring cell signal level information, cell selection and reselection information at different locations, relative signal strength between cell base stations at different locations, and coverage hole information. Utilizing the stored information, the network can automatically perform SON algorithms to improve network efficiency without the need for manual intervention by an operator. Embodiments include event filtering by the communications device to efficiently utilize the on board storage.

Dynamic administration of event pools for relevant event and alert analysis during event storms including receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system, each event including an occurred time and a logged time; creating, by the event analyzer, an events pool; determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold; if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time; and if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

Relevant alert delivery including determining, by an events listener associated with an event queue, whether one or more events in an events queue have not been assigned to any events pool by any event analyzer; and if one or more events in the events queue have not been assigned to any events pool, identifying by the events listener in dependence upon the event analysis rules one or more alerts; sending by the event listener to an alerts queue all the alerts identified by the event listener; the alerts queue having an associated alerts listener; determining whether one or more alerts in the alerts queue have not been assigned to any alert pool; if one or more alerts in the alerts queue have not been assigned to any alerts pool, and determining in dependence upon alert analysis rules whether to suppress the alerts; and transmitting the unsuppressed alerts.

Solutions for responding to security-related incidents in a computer network, including a security server, and a client-side arrangement. The security server includes an event collection module communicatively coupled to the computer network, an event analysis module operatively coupled to the event collection module, and a solution module operatively coupled to the event analysis module. The event collection module is configured to obtain incident-related information that includes event-level information from at least one client computer of the plurality of client computers, the incident-related information being associated with at least a first incident which was detected by that at least one client computer and provided to the event collection module in response to that detection. The event analysis module is configured to reconstruct at least one chain of events causally related to the first incident and indicative of a root cause of the first incident based on the incident-related information. The solution module is configured to formulate at least one recommendation for use by the at least one client computer, the at least one recommendation being based on the at least one chain of events, and including corrective/preventive action particularized for responding to the first incident.

The invention discloses a DNS (Domain Name Server) safety monitoring system and method of a domain name resolution system. The DNS safety monitoring system comprises a data acquisition module and an event analysis module, wherein the data acquisition module is used for acquiring the network data of a DNS and providing the network data to the event analysis module; and the event analysis module isused for analyzing the network data and generating a monitoring result. The system and the method can be used for preventing network attacks such as domain name hijacks, site phishing, zombie attacks, and the like and improving the running stability and reliability of the DNS.

The invention relates to a gun-ball linkage road traffic parameter collection and rule breaking snapshooting system which comprises a gun type camera, a ball type camera, a network switch, an event analysis meter, a traffic detecting software module and a signal controller. The gun-ball linkage road traffic parameter collection and rule breaking snapshooting system is characterized in that the gun type camera and the ball type camera are arranged on the front-upper position of a vehicle and are connected with the network switch which is connected with the event analysis meter, a microprocessor, the traffic detecting software module and the like are arranged in the event analysis meter, and accordingly a road intersection detecting local area network is formed and is connected to a city traffic command center through a city telecom backbone network or a special optical cable, traffic video real-time monitoring, video recording and rule-breaking vehicle track snapshooting in the road view field range are achieved, the structure is advanced and simple, snapshooting and measuring are combined perfectly, snapshooting is timely, the traffic parameters are accurate in measuring, real-time performance is wide, and the system is a foresight product for traffic video monitoring.

A video recording and playback device (10) incorporates a processor (114) for processing the video signal to detect the presence of commercial messages. Video and audio event detectors (102, 104) detect the presence of events in the signal as it is recorded. The timing relationship of the detected events is analyzed to classify the video segments between events as program material or as commercial messages. After a program is recorded, control marks are generated (132) to indicate the beginning and end of commercial groups so that they will be skipped during subsequent replay of the recorded program.

Methods, systems and products are provided for dynamic administration of component event reporting in a distributed processing system including receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system; determining, by the events analyzer in dependence upon the received events and one or more event analysis rules, to change the event reporting rules of one or more components; and instructing, by the events analyzer, the one or more components to change the event reporting rules.

In a video recorder/player that increases a frame rate for only a channel in which an event occurs in images captured by a plurality of cameras and which performs event analysis with higher accuracy within limited processing resources and limited storage capacity, the channel in which the event occurs is set as an event CH and normal channels are set as normal CH. When any event occurs, a processing is divided in accordance with a situation at that time into a frame rate changing processing of the event CH, a frame rate changing processing of the normal CH and the event CH and a changing processing that changes the frame rate of the event CH within a possible range.

The invention provides a full-automatic anti-intrusion intelligent video monitoring alarm system for an unattended villa, which relates to the technical field of intelligent monitoring systems. The anti-intrusion intelligent video monitoring alarm system comprises a video intelligent analysis system, an anomalous event analysis system and an anomalous event alarm system. The video intelligent analysis system particularly refers to automatically detecting an object through a subregion autonomous non-reference threshold algorithm and an object key information secondary extraction algorithm and automatically tracking the object by adopting a movement trend tracking algorithm merging Kalman filtering and particle filtering. By detecting and tracking the movement objective track information, the movement direction, the horizontal and vertical displacement, and the object center position of the object are determined. The anomalous event analysis system particularly refers to analyzing video signals acquired by a villa monitoring camera through a machine vision algorithm, judging anomalous and dubious behaviors of the objects (personnel) around and in a villa through a preset rule, and notifying information on pictures, characters and the like of the anomalous behaviors and events to a proprietor or a security department in time.

The invention provides an intelligent video analysis system and method based on PTZ video camera cruising. The system comprises a front-end PTZ video camera and a rear-end server. The rear-end server comprises a cruising configuration module, a PTZ video camera control module, a video analysis configuration module, a system control module, an intelligent video analysis module and an alarm management module. The cruising configuration module is used for setting cruising groups and cruising points of the system to generate a cruising list. The PTZ video camera control module is used for analyzing the cruising list and generating a cruising execution list automatically. The video analysis configuration module is used for configuring related intelligent video analytical algorithms for all the cruising points and configuring the cruising points into the cruising list. The system control module is used for calibrating video camera parameters of each cruising point, calling a video stitching module and automatically generating a panorama splicing map in the whole cruising period according to the execution sequence of the cruising points. The intelligent video analysis module is used for conducting target detection and event analysis according to related setting and giving a real-time alarm to a detected event. The alarm management module is used for conducting corresponding local management on the alarm.

The invention discloses a clustering algorithm-based exceptional event analysis method for evaluating the whole state of an electric meter. The method comprises the steps of aiming at the abnormal users with overvoltage, overcurrent, wrong clock of the electric meter, undervoltage of the electric meter, overhigh temperature of the electric meter, opened cover of the electric meter, continuous exceeding on the upper limit of a load, voltage reverse phase sequence, current reverse phase sequence, inversed current, imbalanced voltage three phases, imbalanced current three phases and the like, the document information of the users are checked, and the users having documents with problems are filtered; for the users with the abnormity, the whole state of the electric meter is evaluated and analyzed by combining information such as marketing service metering fault, fault meter changing and information lack examining on site through the comprehensive analysis of the clustering algorithm according to multiple dimensions such as the manufacturer, the batch, the region, the type of the metering device, the voltage level, the user class and the line, a technical means and a reference basis are provided for whether an electric power company for on-site inspection needs to be performed and whether a shift plan needs to be made, and the method is accurate and has small errors.

Methods, systems, and computer program products for restarting event and alert analysis after a shutdown in a distributed processing system are provided. Embodiments include identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.

Methods, systems and products are provided for relevant alert delivery with event and alert suppression including identifying by the event analyzer in dependence upon the event arrival rules one or more alerts; closing, by the event analyzer in dependence upon the events pool operation rules, the events pool; determining, by the events analyzer in dependence upon the event suppression rules, whether to suppress one or more events in the closed events pool; identifying by the event analyzer in dependence upon the events pool closure rules and any unsuppressed events assigned to the events pool, one or more additional alerts; assigning by the alert analyzer the identified alerts to an alerts pool; determining by the alert analyzer in dependence upon alert analysis rules and the alerts in the alert pool whether to suppress any alerts; and transmitting the unsuppressed alerts to one or more components of the distributed processing system.

An event analysis system and method of analysing events are provided. The method comprises the steps of displaying event element icons in a user interface, updating the location of moved event element icons in the user interface, and determining an organization of the event elements based upon the location of the event element icons in the user interface. The event element icons represent event elements in an event or chain of event elements. The event element icons are movable in a coding panel of the user interface. The event analysis system comprises a presentation module for generating a user interface and event element icons for the user interface, a controller module for controlling the display of the user interface, and a data model module for holding a data structure representing the event elements and used to generate the event element icons.

Methods, systems, and computer program products for restarting event and alert analysis after a shutdown in a distributed processing system are provided. Embodiments include identifying, by an incident analyzer, a shutdown condition of the distributed processing system; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; if the shutdown was unplanned, identifying, by the incident analyzer, a previously configured restart mode; selecting, by the incident analyzer, an identification of a restart event in the event log according to the previously configured restart mode; and restarting, by the incident analyzer, event and alert analysis using the restart event identified in the event log.

Methods, systems and products are provided relevant alert delivery including assigning by an event analyzer each received event to an events pool; determining by the event analyzer in dependence upon event analysis rules and the events assigned to the events pool whether to suppress one or more of the events; identifying by the event analyzer in dependence upon event analysis rules and the events assigned to the events pool one or more alerts; sending by the event analyzer to an alert analyzer all the alerts identified by the event analyzer; assigning by the alert analyzer the identified alerts to an alerts pool; determining by the alert analyzer in dependence upon alert analysis rules and the alerts in the alert pool whether to suppress any alerts; and transmitting the unsuppressed alerts to one or more components of the distributed processing system.

Methods, systems, and computer program products for event management in a distributed processing system are provided. Embodiments include receiving, by the incident analyzer, one or more events from one or more resources, each event identifying a location of the resource producing the event; identifying, by the incident analyzer, an action in dependence upon the one or more events and the location of the one or more resources producing the one or more events; identifying, by the incident analyzer, a location scope for the action in dependence upon the one or more events; and executing, by the incident analyzer, the identified action.