Abstract: Zero-day attacks with unknown attack signatures are detected by correlating behavior differences of a plurality of entities. An entity baseline behavior for each entity of the plurality of entities is determined 310, the entity baseline behavior includes multiple variables. An entity behavior difference for each entity is determined at a series of points in time 320. Correlations between the entity behavior differences for the plurality of entities are determined at the series of points in time 330. Based on these correlations, it is determined whether the plurality of entities is exhibiting coordinated behavior differences 340. An attack signature is determined based on the entity behavior differences and the correlations 350. A database of attack signatures is generated 360.

Abstract: Zero-day attacks with unknown attack signatures are detected by correlating behavior differences of a plurality of entities. An entity baseline behavior for each entity of the plurality of entities is determined 310, the entity baseline behavior includes multiple variables. An entity behavior difference for each entity is determined at a series of points in time 320. Correlations between the entity behavior differences for the plurality of entities are determined at the series of points in time 330. Based on these correlations, it is determined whether the plurality of entities is exhibiting coordinated behavior differences 340. An attack signature is determined based on the entity behavior differences and the correlations 350. A database of attack signatures is generated 360.

Abstract: Methods, systems, and computer program products for historical state snapshot construction over temporally evolving data are provided herein. A computer-implemented method includes classifying each of multiple temporally evolving data entities into one of multiple categories based on one or more parameters; partitioning the multiple temporally evolving data entities into multiple partitions based at least on (i) said classifying and (ii) the update frequency of each of the multiple temporally evolving data entities; implementing multiple checkpoints at a distinct temporal interval for each of the multiple partitions; and creating a snapshot of the multiple temporally evolving data entities at a selected past point of time (i) based on said implementing and (ii) in response to a query pertaining to a historical state of one or more of the multiple temporally evolving data entities.

Abstract: Methods and arrangements for efficiently mining a control flow graph from execution logs of a distributed system. Using at least one text clustering technique, two text clusters are generated from the plurality of execution logs. At least one approximate template is generated based on the at least two text clusters. At least one refined template is created via refining the at least one approximate template using multimodal sequencing. The control flow graph is created based on the at least one refined template. An anomaly is detected in the control flow graph.

Abstract: Methods, systems, and computer program products for organizing on-disk layout of index structures are provided herein. A method includes organizing an on-disk corpus of data index structures; partitioning each data index structure into an active and/or latest state data partition and an archived data partition; sub-partitioning each of the archived data partitions into sub-partitions based on exact lifespan of each data item; executing a search query that includes temporal predicates and keyword predicates across the corpus by: pruning a collection of identified items of data from the corpus that contain the keyword predicates using range metadata associated with the temporal predicates to generate a pruned list of data items; and performing a list intersection operation on the data index structures to generate a list of common data items from the pruned list; retrieving the common data items from the active and/or latest state data partitions and the archived data sub-partitions.

Abstract: Methods and arrangements for identifying root causes of system failures in a distributed system said method including: utilizing at least one processor to execute computer code that performs the steps of: recording, in a storage device, collected machine state data, wherein the collected machine state data are added to historical machine state data; creating, based on the historical machine state data, a healthy map model; detecting at least one failed machine state in the distributed system; comparing the failed machine state against the healthy map model; identifying, based on the comparison, at least one root cause of the failed machine state; and displaying, on a display device, a ranked list comprising the at least one root cause. Other variants and embodiments are broadly contemplated herein.

Abstract: Methods, systems, and computer program products for historical state snapshot construction over temporally evolving data are provided herein. A computer-implemented method includes classifying each of multiple temporally evolving data entities into one of multiple categories based on one or more parameters; partitioning the multiple temporally evolving data entities into multiple partitions based at least on (i) said classifying and (ii) the update frequency of each of the multiple temporally evolving data entities; implementing multiple checkpoints at a distinct temporal interval for each of the multiple partitions; and creating a snapshot of the multiple temporally evolving data entities at a selected past point of time (i) based on said implementing and (ii) in response to a query pertaining to a historical state of one or more of the multiple temporally evolving data entities.

Abstract: Systems and methods for preventing web services from using sensitive data in customizing web pages for a user. In one embodiment, a protection system is implemented between the user and the web service. The protection system identifies past interactions of the user with the web service, identifies text in the past interactions between the user and the web service, and identifies subjects discussed in the text. The protection system then communicates with the user to determine which of the subjects are sensitive to the user, and deletes a history stored by the web service for the user that relates to the sensitive subjects.

Abstract: Method(s) and system(s) for providing privacy to personal information of end users while utilizing recommendation services and personalized content are described. According to the present subject matter, the system(s) implement the described method(s) for providing privacy to personal information of end users. The method for privacy protection includes receiving user consumption data associated with one or more end users where the user consumption data comprises at least a slice of interest profile and associated interest group id of the slice of interest profile; and where the user consumption data is received through a network anonymization layer. The method may further include routing the user consumption data to an interest group aggregator node from amongst a plurality of intermediary nodes based on distributed hash table routing mechanism, and wherein the interest group aggregator node is associated with the interest group id present in the user consumption data.

Abstract: Methods and arrangements for identifying root causes of system failures in a distributed system said method including: utilizing at least one processor to execute computer code that performs the steps of: recording, in a storage device, collected machine state data, wherein the collected machine state data are added to historical machine state data; creating, based on the historical machine state data, a healthy map model; detecting at least one failed machine state in the distributed system; comparing the failed machine state against the healthy map model; identifying, based on the comparison, at least one root cause of the failed machine state; and displaying, on a display device, a ranked list comprising the at least one root cause. Other variants and embodiments are broadly contemplated herein.

Abstract: Methods and arrangements for efficiently mining a control flow graph from execution logs of a distributed system. Using at least one text clustering technique, two text clusters are generated from the plurality of execution logs. At least one approximate template is generated based on the at least two text clusters. At least one refined template is created via refining the at least one approximate template using multimodal sequencing. The control flow graph is created based on the at least one refined template. An anomaly is detected in the control flow graph.

Abstract: Methods, systems, and computer program products for organizing on-disk layout of index structures are provided herein. A method includes organizing an on-disk corpus of data index structures; partitioning each data index structure into an active and/or latest state data partition and an archived data partition; sub-partitioning each of the archived data partitions into sub-partitions based on exact lifespan of each data item; executing a search query that includes temporal predicates and keyword predicates across the corpus by: pruning a collection of identified items of data from the corpus that contain the keyword predicates using range metadata associated with the temporal predicates to generate a pruned list of data items; and performing a list intersection operation on the data index structures to generate a list of common data items from the pruned list; retrieving the common data items from the active and/or latest state data partitions and the archived data sub-partitions.

Abstract: According to an implementation of the present subject matter, apparatus and methods for privacy protected clustering of user interest profiles are described. The method includes generating at least one interest profile segment based on an interest profile of an end user (404). Further, semantic terms corresponding to the at least one interest profile segment are obtained based on interaction with a semantic metadata database coupled to a user device of the end user (406), wherein the semantic terms are obtained from amongst one or more semantic terms provided in the semantic metadata database. Each of the at least one interest profile segment are subsequently transformed into at least one semantic representation (408). Further, a cluster identifier is assigned to the at least one interest profile segment based on the at least one semantic representation, wherein the cluster identifiers are generated using locality sensitive hashing (LSH) technique (410).

Abstract: Method(s) and system(s) for providing privacy to personal information of end users while utilizing recommendation services and personalized content are described. According to the present subject matter, the system(s) implement the described method(s) for providing privacy to personal information of end users. The method for privacy protection includes receiving user consumption data associated with one or more end users where the user consumption data comprises at least a slice of interest profile and associated interest group id of the slice of interest profile; and where the user consumption data is received through a network anonymization layer. The method may further include routing the user consumption data to an interest group aggregator node from amongst a plurality of intermediary nodes based on distributed hash table routing mechanism, and wherein the interest group aggregator node is associated with the interest group id present in the user consumption data.

Abstract: According to an implementation of the present subject matter, apparatus and methods for privacy protected clustering of user interest profiles are described. The method includes generating at least one interest profile segment based on an interest profile of an end user (404). Further, semantic terms corresponding to the at least one interest profile segment are obtained based on interaction with a semantic metadata database coupled to a user device of the end user (406), wherein the semantic terms are obtained from amongst one or more semantic terms provided in the semantic metadata database. Each of the at least one interest profile segment are subsequently transformed into at least one semantic representation (408). Further, a cluster identifier is assigned to the at least one interest profile segment based on the at least one semantic representation, wherein the cluster identifiers are generated using locality sensitive hashing (LSH) technique (410).

Abstract: Systems and methods for preventing web services from using sensitive data in customizing web pages for a user. In one embodiment, a protection system is implemented between the user and the web service. The protection system identifies past interactions of the user with the web service, identifies text in the past interactions between the user and the web service, and identifies subjects discussed in the text. The protection system then communicates with the user to determine which of the subjects are sensitive to the user, and deletes a history stored by the web service for the user that relates to the sensitive subjects.

Abstract: The present subject matter discloses a system and a method for privacy protection to protect the confidential and personal information of end users using a client device (108) to avail services recommended by a service provider (110). In one embodiment, a privacy protection system (102)for recommendation services comprises a processor (202) and a memory (204) coupled to the processor (204). The memory (204) comprises a interest group aggregator module (112) having at least one interest group aggregator, each of the at least one interest group aggregator configured to collate a plurality of segments of profile information pertaining to a plurality of end users categorized in a interest group based on a interest profile of each of the plurality of end users.