Abstract: Embodiments upsell a hotel room selection by providing a first plurality of hotel room choices, each first plurality of hotel room choices comprising a first type of hotel room and a corresponding first price. Embodiments receive a first selection of one of the first plurality of hotel room choices. In response to the first selection, embodiments provide a second plurality of hotel room choices, the second plurality of hotel room choices comprising a subset of the first types of hotel room choices and a corresponding optimized price that is different from the respective corresponding first price.

Abstract: Systems, devices, and methods of the present invention detect deceptive or fake content in text. In an example, a computer system generates, from text a discourse tree that represents rhetorical relationships between fragments of the text. The computer system generates a communicative discourse tree from the discourse tree. The computer system identifies a number of non-trivial rhetorical relations associated with the nonterminal nodes in the communicated discourse tree and, for each terminal edge having a communicative action, a level of nesting of the communicative action. The computer system derives, from the number of non-trivial rhetorical relations and the levels of nesting of the identified communicative actions, a complexity score that is indicative of a level of deception in the text.

Abstract: Techniques for using honeypots to lure attackers and gather data about attackers and attack patterns on Infrastructure-as-a-Service (IaaS) instances. The gathered data may then be analyzed and used to proactively prevent such attacks.

Abstract: Techniques for determining recommended allocations of resources among different platforms that sell a common type of inventory. Determining the allocations can include obtaining parameters of a campaign from a client. Determining the allocations can include combining current campaign parameters and scoring with historical campaign performance data to create recommendations for dividing resources among different media platforms.

Abstract: Techniques for using signed nonces to secure cloud shells are provided. The techniques include receiving, by a session manager service, a request to connect a user device to a secure connection to a secure shell instance. The session manager service may authorize the user device to access the secure shell instance and may configure the secure shell instance, being described by a shell identifier of the secure shell instance. The techniques also include generating, by the session manager service, a nonce token and providing the shell identifier, and a router address of the secure shell router to the user device. The techniques also include generating, by the session manager service, a signed nonce token using the nonce token; and providing the signed nonce token and the shell identifier to a user device.

Abstract: A network validation system is described which may perform operations such as generating, analyzing, verifying, correcting, recommending, and deploying language, symbols, etc., such as domain specific language, configured to allow users to express their intent on the configuration and operation of a network, such as a cloud-based network. The network validation system may provide domain specific language that includes rules, statements, symbols, data, etc., configured to convey the intent of users on the configuration and operation of networks for purposes such as configuring and/or validating communication paths, testing or setting associated network object configurations, and may be employed to report violations in such configurations relative to user intent of the one or more users. The network validation system may also be employed to monitor such domain specific language and generate telemetry signaling, for example, that a rule has or has not been violated, actions a user may take, etc.

Abstract: Disclosed are techniques for processing user profiles using data structures that are specialized for processing by a GPU. More particularly, the disclosed techniques relate to systems and methods for evaluating characteristics of user profiles to determine whether to offload certain user profiles to the GPU for processing or to process the user profiles locally by one or more central processing units (CPUs). Processing user profiles may include comparing the interest tags included in the user profiles with logic trees, for example, logic trees representing marketing campaigns, to identify user profiles that match the campaigns.

Abstract: Systems, methods, and machine-readable media to migrate data from source databases to target databases are disclosed. Data may be received, relating to the source databases and the target databases. For each source database, a migration assessment may be generated based on analyzing the data, and a migration method may be selected. A migration plan that specifies a parallel migration of a set of databases to the target databases may be created, with a first migration method to migrate a first subset of the set of databases and a second migration method to migrate a second subset of the set of databases. The parallel migration may be executed according to the migration plan may be caused so that the first subset of the set of databases is migrated with the first migration method while the second subset of the set of databases is migrated with the second migration method.

Abstract: An example method facilitates modification and generation of User Interface (UI) display screens for webpages and web applications, such as process-based software applications. The example method includes receiving a first signal to access a webpage that includes a static UI display screen for a web application; serving the webpage in response to the signal; detecting the dynamic configuration functionality associated with the webpage, wherein the configuration functionality includes code and UI metadata provided in or with a dynamic layout file, the code and UI metadata including one or more rules and specifications for configuring schema used to generate rendering instructions for the dynamic part of the webpage.

Abstract: System and method for using multiple global identification subnet prefix values in a network switch environment in a high performance computing environment. A packet is received from a network fabric by a first Host Channel Adapter (HCA). The packet has a header portion including a destination subnet prefix identifying a destination subnet of the network fabric. The network HCA is allowed to receive the first packet from a port of the network HCA by selectively determining a logical state of a flag and, selectively in accordance with a predetermined logical state of the flag, ignoring the destination subnet prefix identifying the destination subnet of the network fabric.

Abstract: Techniques for modifying rules for completing requests using a conversational interface are disclosed. A conversational interface receives a user request to perform a particular function. A system extracts semantic content from the request and obtains contextual metadata associated with the request. Using the semantic content and contextual metadata, the system generates a data set of attribute values. The system determines whether the data set matches a data set of required data attributes associated with the request. If the provided data set is different than the required data set, the system determines whether to modify a set of rules associated with the request. The set of rules specifies which attribute values are required to complete the request. When the system modifies the rules associated with the request, the system also determines whether to apply the rule modification to subsequent requests by the same user and other users.

Abstract: When a request for accessing a service is received, a user object may be stored in a long-term data store, as well as in a short-term cache. The cache may be divided into a regular cache that stores full versions of the user objects, and a surrogate cache that stores compact versions of the user object. The compact version of the user object may include a field that is derived from the full user object indicating whether a subsequent request for access to a particular service should be granted. After access is granted/denied based on this value in the compact user object, the system can process an update to the full user object offline. This surrogate cache structure may be used to rapidly approve/deny requests, decoupling this procedure from the processing involved with a full user object.

Abstract: Plugins that are independently written are executed in a collaborative manner to analysis a log. A plugin executing with respect to a particular node of a hierarchical data structure determines values for a set of keys based on information of the particular node and/or any ancestor nodes, and information stored in a shared repository. The plugin stores the values for the keys as additional information of the particular hierarchical node and/or into the shared repository. The plugin does not access information of non-ancestor nodes when executing with respect to the particular hierarchical node. Each plugin writes into and retrieves from the shared repository using the shared naming convention, thereby sharing information. The sequence of execution of the plugins is not dependent on dependencies amongst the plugins. If a dependent plugin requiring an output from a requisite plugin is first executed, the dependent plugin is flagged as pending and subsequently re-executed.

Abstract: Roaming spoofing attacks can be initiated during N32-c handshake procedure used for inter-PLMN communication in 5G network. One example solution described herein uses the SEPP to mitigate the N32-c roaming spoofing attacks by cross validating the sender attribute present in N32-c handshake security capability exchange messages against the endpoint identity in the X.509v3 certificate shared during TLS handshake and the remote SEPP identity configured in the SEPP's local database.

Abstract: Described herein are systems and methods for transaction identification (ID) generation in transaction-based environments. The systems and methods provided generated transaction IDs which inherently define a range of values (a range of blockchain heights) within which the transaction is valid. This obviates problems associated with traditional transaction ID databases where a transaction ID only comprises a hashed value. That is, the presently disclosed systems and methods are an improvement over traditional hashing schemes as in traditional hashing schemes, a server must traverse an entire transaction ID database to determine if an incoming transaction is valid.

Abstract: One embodiment is a remote display system. Embodiments include a liquid-crystal display (“LCD”), an outer surface that forms a gap between the outer surface and the LCD, a light sensor disposed within the gap and covering a portion of the LCD, and a flexible printed circuit board (“PCB”) that couples the light sensor to a server.

Abstract: In accordance with an embodiment, described herein is a system and method for providing a reactive flattening map for use with a microservices or other computing environment. In a cloud computing environment, reactive programming can be used with publishers and subscribers, to abstract execution away from the thread of execution while providing rigorous coordination of various state transitions. The described approach provides support for processing streams of data involving one or more publishers and subscribers, by use of a multi-flat-map publisher component, to flatten or otherwise combine events emitted by multiple publishers concurrently, into a single stream of events for use by a downstream subscriber.

Abstract: A method for providing for network function (NF) fallback to a recovered network function NF repository function (NRF) includes, at an NF including at least one processor, generating an NF register message including an indication to notify the NF of recovery of a first NRF after a failure of the first NRF. The method further includes transmitting the NF register message to the first NRF. The method further includes communicating with the first NRF and detecting failure of the first NRF. The method further includes, in response to detecting failure of the first NRF, initiating communications with a second NRF that is a geo-redundant mate of the first NRF. The method further includes receiving notification of recovery of the first NRF and falling back to communicating with the first NRF.

Abstract: A computing device may access visually rich documents comprising an image and metadata. A graph, based on the image or metadata, can be generated for a visually rich document. The graph's nodes can correspond to words from the visually rich document. Features for nodes can be determined by the device. The device may generate model labeled graphs by assigning a pseudo-label to nodes using a pretrained model. The device may generate a plurality of graph labeled graphs by assigning a pseudo-label to nodes by matching a first node from a first graph to at least a second node from a second graph. The device may generate a plurality of updated graphs by cross referencing labels from the model labeled graphs and the graph labeled graphs. Until a change in labels is below a threshold, a model can be trained to perform key-value extraction using the updated graphs.

Abstract: Embodiments for passive spychip detection through polarizability and advanced pattern recognition are described. For example a method includes inducing a magnetic field in a passive component of a target system while the target system is emitting EMI with changes in amplitude repeating at a time interval; generating a time series of measurements of a combined magnetic field strength of the induced magnetic field and the EMI; executing a frequency-domain to time-domain transformation on the time series of measurements to create time series signals of combined magnetic field strength over time at a specific frequency range; monitoring the time series signals with an ML model trained to predict correct signal values to determine whether predicted and measured values of the time series agree; and indicating that the target device may contain a passive spychip where anomalies are detected, and is free of passive spychips where no anomalies are detected.

Abstract: A method may include extracting, from a function included in code, sub-tokens and program analysis features, generating sub-token vectors from the sub-tokens and a program analysis vector from the program analysis features, combining, by a machine learning model, the sub-token vectors to obtain a combined sub-token vector, combining the combined sub-token vector and the program analysis vector to obtain a function vector, and classifying, using the function vector, the function as a function category.

Abstract: A method for managing cloud resource dependencies is described. The method may include receiving a resource configuration of a first resource. The method may include identifying a dependency of a first stage of a first resource on a second resource and performing a topological sort of a plurality of resources, based at least in part on the dependency of the first stage of the first resource. The method may include constructing a dependency graph including the plurality of resources, including the first stage of the first resource in a subordinate rank and the second resource in a superior rank, corresponding to the topological sort. The method may include generating an execution queue including the second resource in a priority execution position in the execution queue. The method may include executing the plurality of resources according to the execution queue.

Abstract: Disclosed is an improved approach to represent RDF data in a database system, where one or more auxiliary tables are maintained for the RDF data. The auxiliary tables advantageously permit a database processing system to process a query using fewer numbers of joins or self-joins.

Abstract: One or more embodiments include obtaining information from a physical payment card. Based on the information from the physical payment card, an output is obtained that includes a valid account number corresponding to the physical payment card. The valid account number is displayed to the cardholder. The physical payment card does not contain a visual indication of the valid account number and thus cannot be used by a malicious entity. One or more embodiments may include a physical payment card. The physical payment card includes a fake account number that cannot be used for executing a transaction based on funds associated with the physical payment card. They physical payment card may also include a key that can be mapped to a valid account number that can be used for executing a transaction based on funds associated with the physical payment card.

Abstract: Disclosed is an approach to implement an on-demand secure communications channel to a cloud-related resource that is located in a customer's on-premises data center, where the on-demand channel provides access to the resource to a cloud provider's operator employees. This creates on a temporary basis all of the infrastructure that is needed to allow the operational access to the customer system, which can then be destroyed once it is no longer needed.

Abstract: A Representational State Transfer (REST)-Simple Message Transfer Protocol (SMTP) protocol gateway (RSPG) is disclosed that includes capabilities for accessing and processing REST Application Programming Interfaces (APIs) using SMTP. The RSPG receives a first email message, extracts information from the received first email message and constructs a REST API call based on the extracted information. The RSPG invokes the REST API call against a REST endpoint and receives a response generated from execution of the REST API call. The RSPG generates a second email message based on the response and causes the second email message to be communicated to an intended recipient of the response of the REST API call.

Abstract: A method for updating network function profiles in a telecommunications network includes registering, by a producer network function, a network function profile with a network function repository function (NRF), the network function profile specifying at least one serving scope or discoverable parameters by consumer NFs. The method includes determining that a load level of the producer network function has exceeded a first threshold. The method includes, in response to determining that the load level of the producer network function has exceeded the first threshold, updating the network function profile at the NRF to reduce the serving scope.

Abstract: An example method facilitates authenticating a client-side program, such as a spreadsheet, for access to and use of protected server-side data and/or functionality provided via a web service, such as a REpresentational State Transfer (REST) service or Application Programming Interface (API). The example method uses an add-in or plugin to the spreadsheet (which may run on a mobile device, desktop computer, other client system) to interrogate, negotiate with, or otherwise test or poll the web service to be accessed, so as to determine an authentication method used by the web service when authenticating clients; and to implement an authentication flow in accordance with the authentication method, thereby facilitating authentication of the spreadsheet for interaction with the web service in accordance with permissions associated with the authenticated client software, i.e., spreadsheet.

Abstract: A product configuration device outputs a configuration of a product in accordance with a set of configuration rules. The product configuration device includes a rule learning system configured to acquire a first set of data representing a plurality of configurations of the product; to generate a neural network model representing the first set of data; to extract relationships between configuration attributes from the neural network model; and to modify the set of configuration rules based on the extracted relationships to generate a modified set of configuration rules for the product configuration device. The product configuration device may also include a rule execution engine that outputs the configuration of the product based on the modified set of configuration rules.

Abstract: An electronic voting machine obtains session information in an encrypted state for conducting a voting session. The voting machine decrypts the session information using a decryption key that is specific to the voting machine. A ballot provided in the session information may then be presented in a user interface through which votes are received. The session information also includes an encryption key for a specific tabulation machine associated a priori with the voting session, as well as one or more datastores. The voting machine encrypts the votes with the encryption key and sends the votes in an encrypted state to the one or more datastores. The tabulation machine may then retrieve the votes from the location(s) and decrypt them using a corresponding private key.

Abstract: A network may be organized to provide components. Components may be generated by combining other components (sub-components) together, and components may be provided by resources in the network. This network may be represented by a graph of nodes representing components and resources. In order to efficiently analyze this graph to generate a network plan, the graph may be subdivided into independent sub-graphs. Individual resources may be shared by individual sub-graphs and considered independent when those resources are underutilized or otherwise unconstrained. Models may be used to predict which resources are unconstrained and allow those resources to be shared by otherwise independent sub-graphs, thereby increasing the decomposition of the graph and improving the efficiency of the network plan analysis.

Abstract: Techniques for computing and storing object identity hash values are disclosed. In some embodiments, a runtime system generates a value, such as a nonce, that is unique to a particular allocation region within memory. The runtime system may mix the value with one or more seed values that are associated with one or more respective objects stored in the allocation region. The runtime system may obtain object identifiers for the respective objects by applying a hash function to the result of mixing the seed value with at least the value associated with the allocation region. Conditioning operations may also be applied before, during or after the mixing operations to make the values appear more random. The nonce value may be changed from time to time, such as when memory is recycled in the allocation region, to reduce the risk of hash collisions.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Storm control information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: Aspects of the disclosure include a dynamic cloud workload reallocation based on an active ransomware attack. An example method includes receiving a first message that a computing instance is potentially infected by ransomware. The method further includes receiving a security state-based metric related to the computing instance based at least in part on the first message. The method further includes comparing the security state-based metric to a threshold metric. The method further incudes determining a likelihood of a ransomware attack based at least in part on the comparison. The method further includes transmitting second message to a job scheduler to reschedule workloads directed toward the computing instance based at least in part on the determination.

Abstract: The present embodiments relate to identifying a ransomware attack. One embodiment relates to a method comprising configuring an operating system to collect metrics related to a hardware component. A message can be received from a user space library to validate an instruction detected in a cache, the instruction being associated with the hardware component. A metric can be compared to a threshold metric. The metric can be associated with the hardware component. A likelihood of a ransomware attack can be determined based at least in part on the comparison. A message can be transmitted to the user space library comprising the determination of the likelihood of the ransomware.

Abstract: Techniques are described herein for training and applying machine learning models. The techniques include implementing an entropy-based loss function for training high-capacity machine learning models, such as deep neural networks, with anti-modeling. The entropy-based loss function may cause the model to have high entropy on negative data, helping prevent the model from becoming confidently wrong about the negative data while reducing the likelihood of generalizing from disfavored signals.

Abstract: Techniques for managing customer experience content are disclosed. A system detects new information, such as a news story, a new service request, or a modification to a testimonial or case study, associated with a set of customer experience content, such as a customer testimonial. The system analyzes the new information to identify a sentiment associated with the new information. The system generates an effectiveness score for a particular set of customer experience content based on the new information. The system provides attribute data associated with the new information, and attribute data associated with the customer experience content, to a machine learning model to generate the effectiveness score. The system compares the effectiveness score to one or more threshold values to determine an action to perform associated with the customer experience content.

Abstract: Techniques are disclosed for scaling an IP address in overlay networks without using load balancers. In certain implementations, an overlay IP address can be attached to multiple compute instances via virtual network interface cards (VNICs) associated with the multiple compute instances. Traffic directed to the multi-attached IP address is distributed across the multiple compute instances. In some other implementations, ECMP techniques in overlay networks are used to scale an overlay IP address. In forwarding tables used for routing packets, the IP address being scaled is associated with multiple next hop paths to multiple network virtualization devices (NVDs) associated with the multiple compute instances. When a particular packet directed to the overlay IP address is to be routed, one of the multiple next hop paths is selected for routing the packet. This enables packets directed to the IP address to be distributed across the multiple compute instances.

Abstract: Machine learning techniques are disclosed for rebuilding transactions to predict cash position. In one aspect a method includes obtaining data for an original transaction, classifying the original transaction into a class of multiple classes based on the data, predicting first tranche delay days for the original transaction based on the class and the data, predicting a tranche count for the original transaction based on the class and the data, predicting a tranche interval for the original transaction based on the class and the data; and rebuilding the original transaction as one or more future transactions based on the class, the first tranche delay days, the tranche count, and tranche interval. Each of the one or more future transactions comprise an updated amount of the original transaction, an updated date upon which the original transaction is anticipated, or both.

Abstract: Discussed herein is a framework that facilitates access to services offered in a target cloud environment for resources deployed in a source cloud environment. The source cloud environment is different and independent with respect to the target cloud environment. A compute instance executed in a source cloud environment generates a request to use a service provided in the target cloud environment. The request is transmitted from the source cloud environment to the target cloud environment via an intercloud service gateway. The service is executed in the target cloud environment based on an access role that is associated with the compute instance.

Abstract: Techniques for automatically discovering and protecting sensitive data are disclosed. In some embodiments, a set of data objects is searched for data matching a first set of one or more regular expressions and for metadata matching a second set of one or more regular expressions. A confidence score is then generated for a particular data objects in the set of data objects as a function of regular expressions in the first set of one or more regular expressions that match data stored in the particular data object and regular expression in the second set of one or more regular expressions that match metadata associated with the particular data object. One or more operations may be performed to protect sensitive data stored in the particular data object based, at least in part, on the confidence score.

Abstract: An alert system and method are provided to identify and characterize real-time information transmission anomalies in high-frequency global and local traceroute data. The system includes active network sensors and/or collector devices, which collect traceroute data associated with transmissions to different points in a computer network and provide the traceroute data to a master server. The traceroute data is obtained by the active network sensors by sending probing data packets to numerous computing target devices located locally with respect to the target device and/or globally. The master server determines one or more anomalies from the received traceroute data and characterizes the anomaly in terms of type, severity, location, affected Domain Name System (DNS) server and/or Internet Service Provider (ISP).

Abstract: Systems and methods for a VLAN switching and routing service (VSRS) are disclosed herein. A method can include generating a table for an instance of a VSRS, which VSRS couples a first virtual layer 2 network (VLAN) with a second network. The table can contain information identifying IP addresses, MAC addresses, and virtual interface identifiers for instances within the virtual layer 2 network. The method can include receiving with the VSRS a packet from a first instance designated for delivery to a second instance within the virtual layer 2 network, identifying with the VSRS the second instance within the virtual layer 2 network for delivery of the packet based on information received with the packet and information contained within the table, and delivering the packet to the identified second instance.

Abstract: Methods, systems, and computer readable media for message validation in fifth generation (5G) communications networks are disclosed. One method occurring at a first network node of a first network comprises: obtaining, from at least one authentication and key agreement (AKA) procedure related message associated with a user device communicating via a second network, authentication information identifying the user device; storing the authentication information in a data store for validating subsequent messages; receiving a request message associated with the user device; determining, using the authentication information, that the request message is invalid; and in response to determining that the request message is invalid, performing an invalid message action.

Abstract: Techniques are described for using a single application to interact with multiple separate realms simultaneously while maintaining data security boundaries. For example, a web browser may be used to access and interact with the multiple separate secure realms while maintaining data security boundaries between the systems. Multiple concurrent sessions may be established for a user between the web browser and multiple realms. Separate sets of security credentials (e.g., credentials used for authentication and authorization purposes) may be used to establish the sessions and for operations performed in the realms via the sessions. The application can also execute logic (e.g., via machine-executable code or instructions) for automating operations performed in the realms, such as, automating the initiation of a certain operation in one realm based upon a response received from another realm, causing operations to be initiated in two different realms such that the operations overlap in the time; and the like.

Abstract: A deployment orchestrator system is disclosed that determines an impact of deploying a new version of a component of an application deployed in a computing environment. The impact of deploying the new version of the component may be determined by generating a deployment factor for deploying the new version of a component based on analyzing information that identifies both a technical and a non-technical impact of an update made to the component. In certain embodiments, the deployment orchestrator system includes capabilities for generating different deployment plans for deploying the new version of the component. Each deployment plan is tailored based on a specific deployment factor determined for the deployment. The new version of the component is then deployed based at least in part on the deployment plan to different production regions of a production environment of the deployment orchestrator system.

Abstract: Techniques described herein allow for accurate translation of natural language (NL) queries to declarative language. A syntactic dependency parsing tree is generated for an NL query, which is used to map tokens in the query to logical data model concepts. Relationship-type mappings are completed based on relationship constraints. Final mappings are identified for any relationship tokens that are associated with multiple candidate mappings by identifying which candidate mappings have the lowest cost metrics. An NL query-specific query graph is generated based on the mapping data for the NL query and the logical data model. The query graph represents an NL query-specific version of the logical data model where grammatical dependencies between NL query words are translated to the query graph. A query graph is annotated with information, from the mapping data, that is not represented paths in the query graph. The query graph is used generate a computer-executable translation of the NL query.

Abstract: A tracing controller may utilize a binary execution trace mechanism to trace execution of compiled application machine code. The tracing controller may initiate hardware tracing to gather control-flow hardware traces of a method executing on a processor configured to generate hardware tracing information. The controller may generate a profile based on the hardware tracing information and initiate re-compiling or re-optimizing of the method in response to determining that the new profile differs from the previous profile. The controller may repeatedly profile and re-optimize a method until profiles for the method stabilize. Profiling and hardware tracing of an application may be selectively enabled or disabled allowing the controller to respond to later phase changes in application execution by re-optimizing, thereby potentially improving overall application performance.

Abstract: Systems and methods for highly-available host networking with active-active or active-backup traffic load-balancing are disclosed herein. The method can include selecting a compute instance from an overlay network residing on a substrate network, identifying a plurality of Network Virtualization Devices (“NVD”) for association with the compute instance, creating a loopback interface on each of the NVDs, each of which loopback interfaces can include a shared IP address that can be in the substrate layer, prepopulating a table in each of the NVDs, the table linking the shared IP address to the compute instance, and each of the plurality of NVDs advertising a unique route to the compute instance via the shared IP address.

Abstract: Techniques for implementing an infrastructure orchestration service are described. A configuration file for a deployment to a first execution target and a second execution target can be received. A first safety plan can be generated for the first execution target that comprises a first list of resources and operations associated with deployment at the first execution target. Approval of the first safety plan can be received. A second safety plan can be generated for the second execution target that comprises a second list of resources and operations associated with deployment at the second execution target. A determination can be made whether the second safety plan is a subset of the first safety plan. If the determination is that the second safety plan is a subset of the first safety plan, the second safety plan can automatically be approved and transmitted to the second execution target for deployment.