361 results about "Remedial action" patented technology

A system is disclosed that uses expert systems to monitor and evaluate quality in a large language model. The system can include a prompt library that associates prompts with areas of expertise. The system selects prompts from the library and evaluates first responses generated by a large language model for the set of prompts against second responses generated by a modified version of the large language model to the set of prompts. The evaluation uses expert systems associated with the areas of expertise for the set of prompts. If the system determines that the evaluation indicates a degradation criterion is met, the system may take remedial action. The system provides an effective way to evaluate and prevent the use of modified language models that do not meet the required standards.

A method may include receiving a description of an event occurring at a wellsite; extracting a failure mode from the description using a fine-tuned large language model (LLM); identifying a matching failure mode from historical data processed using the fine-tuned LLM, where the matching failure mode is associated with one or more remedial actions that successfully resolved the matching failure mode; and outputting the one or more remedial actions for implementation at the wellsite.

The invention provides a rules engine that evaluates, modifies, and dynamically routes inputs to AI models based on provider restrictions and management rules. Provider restrictions are stored. Based on management rules and the detected provider restrictions, the input can be modified with contextual placeholders and prompts can be injected for input into the destination model. Reversal of the modifications can occur to the outputs. The system can notify the user, an administrator, and a supervisor regarding the security evaluation and remedial actions. The evaluations can be logged for auditing purposes.

This disclosure describes techniques for an email security system to detect a malicious email and take remedial actions in response to the detected malicious email. The techniques described herein may enable the email security system to detect whether an email is malicious based on whether one or more files attached to the email are malicious. In some cases, the email security system determines whether an email attachment file is malicious based on a set of features that are specific to both a classification of the email (e.g., a semantic classification of the email) and a format of the email attachment file.

Disclosed are various embodiments for providing blockchain-based threat intelligence. First, a computer determines that a request for a remedial action has been recorded to a blockchain by a smart contract. Then, the computer evaluates the request for the remedial action to determine the remedial action to be performed. Subsequently, the computer causes the remedial action to be performed by a security service.

A system detects changes in model context protocol (“MCP”) processes, and performs a remedial action. A server-sent events (“SSE”) bridge sends a request to an MCP server. A first resource profile is received from the MCP server. This is stored and compared against a second updated version of the resource profile. When a difference is detected, the SSE bridge determines whether to block a resource command from reaching the SSE bridge. The decision is based on comparing the difference to security rules, which can be defined as part of a management profile.

A system for predicting system component failures within a computer system that comprises a plurality of hardware components and a plurality of software components. The system may comprise memory storing instructions that, when executed, cause a processor to: obtain performance metrics by monitoring a network interface of the computer system; generate component failure probabilities by processing the performance metrics; determine that a first component failure probability among the component failure probabilities exceeds a risk threshold; determine remedial actions that mitigate a first component failure probability; and mitigate the first component failure probability by initiating an execution of the remedial actions.

Systems and methods are described for providing secure computer sessions using a dedicated browser. The dedicated browser is restricted to accessing a predefined set of one or more webpages. The dedicated browser accesses a respective webpage of the predefined set of one or more webpages through a respective proxy server of a set of one or more proxy servers. While accessing the respective webpage through the set of one or more proxy servers, the dedicated browser monitors whether a specified user is physically adjacent to the computer system using the camera and biometric information for the specified user. In accordance with a determination that the specified user is not physically adjacent to the computer system, the dedicated browser takes a remedial action (e.g., terminates access to the respective webpage).

A computer system that detects a change and automatically performs a remedial action associated with an application programming interface (API) for an application is described. During operation, the computer system may receive data from a second computer system that implements a data-query engine for a database and the data may be associated with the database. Then, the computer system may detect the change in the data based at least in part on one or more of: a schedule of when to check for the change; a location in the database associated with the data; expected content of the data; or a relationship between the data and additional data. When the change is detected, the computer system may perform the remedial action, where the remedial action includes providing a notification with information specifying a data element associated with the API that is affected by the change.

One example method includes pre-processing a dataset, wherein the dataset includes data and / or metadata that indicates a software configuration of an internet of things (IoT) device, and / or indicates a history of any performance issues and / or security issues experienced by the IoT device, after the dataset is pre-processed, providing the dataset as an input to a machine learning model, using the machine learning model to generate, based on the input, respective target variable value predictions for each target variable in a group of target variables, and a first one of the target variables corresponds to the software configuration, and a second one of the target variables corresponds to the history, and when the target variable value predictions indicate a potential security issue and / or a potential performance issue, with the IoT device, taking a remedial action to resolve the potential security issue and / or the potential performance issue.

A network management system may collect processor usage statistics from one or more network devices. The network management system may determine, for each network device of the one or more network devices, aggregate processor usage statistics across a time window based on the processor usage statistics and, based on an aggregate overall processor usage for a given network device exceeding a baseline threshold, analyze aggregate per-process processor usage for the given network device to determine one or more processes as a root cause of anomalous behavior of the given network device. The network management system may generate a remedial action to remediate the root cause.

The structures and algorithms described herein employ look ahead motion planning, in which motion planning for a least two goals is performed before a robot executes the resulting motion plans, and the ability to transition between the preceding one of the motion plans to a subsequent (e.g. following) one of the motions plans is assessed. Thus, the system can determine whether a robot will get trapped (e.g., blocked by another robot) at the end of a first motion plan, preventing, limiting or delaying execution of a second motion plan. Detection of such a condition can cause one or more remedial actions can be taken, for example generating a new, revised or replacement first motion plan. Other remedial action can moving another robot, performing motion planning for the other robot, to alleviate a blocking condition and / or determining a new order for the goals.

An illustrative method includes monitoring operations performed with respect to a storage system by an entity using an identity associated with a particular role, the particular role providing the entity with a set of permissions associated with the storage system; determining, based on the monitoring, that one or more operations of the operations deviate from an expected activity profile associated with the role by more than a threshold; and performing, based on the determining that the one or more operations deviate from the expected activity by more than the threshold, a remedial action with respect to the entity.

Techniques for validating operation of vehicle systems using map data are described herein. The techniques may include receiving sensor data associated with an environment in which a vehicle is operating and generating estimated map data based at least in part on the sensor data. Additionally, stored map data may be received and compared with the estimated map data. If it is determined that an inconsistency exists between the estimated map data and the stored map data, the techniques may include determining whether the inconsistency is attributable to an error associated with the stored map data, the sensor data, or a localization system of the vehicle. As such, one or more specific remedial actions may then be performed based at least in part on determining that the error is associated with at least one of the stored map data, the sensor data, or the localization system.

Monitoring is performed for the activation of a set of one or more previously attached Kprobes. A determination is made that a strategy pattern match has occurred. The strategy pattern comprises a set of one or more behaviors including the activation of the at least one Kprobe included in the set of Kprobes. A remedial action is taken in response to the determination. Examples of such remedial actions include generating an alert and terminating a network connection.

Network traffic (e.g., as monitored by a security appliance on a local network) associated with a session is parsed to determine, using a prefilter, that a suspicious portion of that traffic should be forwarded to a remote service. The remote service is configured with a plurality of realtime detectors. A verdict is received from the remote service. In the event the verdict indicates that the session is malicious, a remedial action is taken in response.

The invention includes a UI that allows addition of functional placeholders to an AI pipeline, and a rules engine that chooses pipeline objects during or before AI pipeline execution. The rules engine can select pipeline objects meeting the same function type and object rules of the functional placeholder. The rules engine also applies customizable security rules and artificial intelligence (AI) model routing to queries. Remedial actions are taken when the rule evaluation exceeds a threshold. The remedial actions include transforming the query by replacing sensitive information with a reversible placeholder. The actual result can be modified by reversing the placeholder and redacting additional sensitive information. The system can notify the user, an administrator, and a supervisor regarding the security evaluation and remedial actions. The evaluations can be logged for auditing purposes.

Methods and systems for detecting anomalous software behavior by monitoring frequency spectrums emanating from an electronic device are provided. A method includes storing frequency spectrum profiles for software applications and operational modes on the device. During execution of a software application, the real-time emanating frequency spectrum is measured and compared to the stored spectrum profile for that application and operational mode. Deviations between the real-time and reference spectrums indicate anomalous behavior from unknown software executing. The device determines a deviation exists and performs remedial actions like alerting the user, disconnecting from the network, shutting down, or switching application execution to another device. Frequency profiles are measured for new applications installed and stored to keep the data updated. Monitoring real-time frequency spectrums emanating from a device provides a computationally lightweight technique for detecting malicious software behavior without requiring complex analysis of application code.

One or more computing devices, systems, and / or methods for mobile device security profiling are provided. A device connected to a communication network is detected. Device profile information associated with the device is used to select a device behavior security model from available device behavior security models. The device behavior security model is provided to the device. The device utilizes the device behavior security model to determine whether the device is exhibiting normal operating behavior or abnormal operating behavior (e.g., an application on the device performing a denial of service attack). If abnormal operating behavior is detected by the device, then the device can perform a remedial action.

An enterprise security system is improved by taking remedial actions responsive to detecting attempts at tampering with computing resources. When a tamper detection instrument detects an attempt at tampering, information about the attempt at tampering may be used to identify one or more candidate types of threats and / or candidate threats. One or more remedial actions associated with the threat or type of threat can be identified and applied in ten enterprise network environment.

A fraud detection system includes a source communication device associated with a source and a client device associated with a client to identify fraudulent calls to provide mitigating or remedial actions. The client device includes a memory that stores instructions and a processor that executes the instructions. The instructions cause the client device to monitor a wireless communication between the client device and the source communication device to identify a keyword, a combination of keywords, a context, and / or a topic of the wireless communication. Moreover, the instructions cause the client device to identify fraudulent detection characteristics of the wireless communication based at least in part of the keyword, the combination of keywords, the context, and / or the topic, identify the wireless communication as fraudulent communication based on the fraudulent detection characteristics, and identify and implement a remedial action based at least in part on a threshold of the wireless communication.

A computer system for predicting an anomaly behavior (fraudulent behavior) for a user of a smart shopping cart (physical receptacle). The computer system gathers data associated with a physical activity of the user, the user being physically present at a location of a retailer and adding one or more items from the location of the retailer to the physical receptacle. The computer system applies a computer model to detect, based on the gathered data, one or more anomalies during the physical activity of the user, the one or more anomalies being indicative of the fraudulent behavior. In response to determining that the one or more detected anomalies satisfy a threshold condition for the fraudulent behavior, the computer system sends a communication to a management system of the retailer to cause at least one remedial action to be performed before the user physically leaves the location of the retailer.

A processor implemented method including monitoring an event in a system, analyzing a log of the event to determine whether the event is a system incident, searching, responsive to the event being determined to be a system incident event, an internal knowledge base for causes of the system incident event and remedial actions for the system incident event, based on retrieval-augmented generation, prompting a first inquiry, the first inquiry including the log and a search result from the searching to a first LLM, and generating a first response including remedial actions for the system incident event by the first LLM, based on the first inquiry and the search result.

A method includes a data protection system determining, based on a first security threat detection process, that a storage system is possibly being targeted by a security threat; performing, based on the determining that the storage system is possibly being targeted by the security threat, a first remedial action with respect to the storage system, the first remedial action comprising generating a snapshot of data stored by the storage system; confirming, based on a second security threat detection process, whether the storage system is possibly being targeted by the security threat; and performing, based on the confirming whether the storage system is possibly being targeted by the security threat, a second remedial action with respect to the storage system, the second remedial action comprising specifying a retention duration with respect to the snapshot.

A computer-implemented method for proactively detecting and remediating anomalous devices includes accessing, via a network, device attributes corresponding to enterprise devices within an enterprise network, providing the device attributes to a supervised machine learning model, and predicting, via the supervised machine learning model, whether each enterprise device is healthy or anomalous, where the enterprise device is predicted to be healthy unless the supervised machine learning model determines that the probability of the enterprise device being anomalous exceeds a specified confidence threshold. The method includes, for each enterprise device that is predicted to be anomalous, perturbing a portion of the corresponding device attributes via an automated counterfactual generator to generate synthetic data representative of counterfactual healthy devices. The method includes generating recommended remedial action(s) that will cause each enterprise device to approximate each counterfactual healthy device and causing surfacing, via a user interface, of the recommended remedial action(s).

The invention provides a rules engine that applies customizable security rules and artificial intelligence (AI) model routing to queries. The rules are evaluated with respect to the query, an anticipate result of the query, and the actual result. Remedial actions are taken when the rule evaluation exceeds a threshold. The remedial actions include transforming the query by replacing sensitive information with a reversible placeholder. The actual result can be modified by reversing the placeholder and redacting additional sensitive information. The system can notify the user, an administrator, and a supervisor regarding the security evaluation and remedial actions. The evaluations can be logged for auditing purposes.

Systems are provided for generating, modifying and using SBOMs for facilitating risk assessment and threat mitigation for corresponding programs, and particularly for large programming builds. The creation and modification of the SBOMs includes processes for omitting declarations referenced in chunk SBOMs of program chunks incorporated into a final programming build associated with a build SBOM, but which are not actually utilized by the final programming build, as well as processes for adding new declarations for code segments that are not declared in the related chunk SBOMs, even though the code segments are utilized by the final programming build. Systems are also configured to use SBOMs in combination with configuration restriction records to assess and resolve threat events in a manner that can prevent unnecessary remedial actions for threat events that appear to be relevant to one or more files or dependencies incorporated into a program.

Aspects relate to monitoring timing margin of logic paths and its degradation through an integrated circuit. In one example an integrated circuit has a logic path formed in the integrated circuit. A monitor circuit is formed in the integrated circuit near the logic path and configured to monitor a condition of the logic path and to generate a diagnostic code sequence to indicate the condition of the logic path over time. A monitor controller is configured to receive diagnostic codes of the diagnostic code sequence, to determine a condition of the integrated circuit based on the diagnostic code sequence, and to initiate a remedial action in response to the condition of the integrated circuit.

Techniques are disclosed for sending downloadable software packages that may be executed to perform tests of a network device without requiring the network device to update firmware. In one example, the network device obtains a software package comprising instructions for simulating a network instance and stores the software package in a volatile memory of the network device. The network device simulates, based on the instructions, the network instance to obtain data indicative of a performance of the network instance. The network device sends, via a communication channel established with a network management system (NMS) based on the software package, the data indicative of the performance of the network instance. In some examples, the NMS uses the data indicative of the performance of the network instance to identify a root cause of a failure of the network device or a remedial action to be performed upon the network device.