Abstract: In some implementations, a device may receive training data identifying a set of workflows. The device may generate a set of workflow templates based on the training data identifying the set of workflows, wherein a workflow template, of the set of workflow templates, is associated with a set of steps for completing a task associated with the workflow template. The device may receive, from a client device associated with an entity, a new task for automation using a new workflow. The device may parse the new task to identify one or more steps associated with the new task. The device may identify one or more workflow templates. The device may a workflow recommendation relating to the one or more workflow templates. The device may output workflow data associated with the workflow recommendation.

Abstract: A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.

Abstract: Methods and server systems for computing fraud risk scores for various merchants associated with an acquirer described herein. The method performed by a server system includes accessing merchant-related transaction data including merchant-related transaction indicators associated with a merchant from a transaction database. Method includes generating a merchant-related transaction features based on the merchant-related indicators. Method includes generating via risk prediction models, for a payment transaction with the merchant, merchant health and compliance risk scores, merchant terminal risk scores, merchant chargeback risk scores, and merchant activity risk scores based on the merchant-related transaction features. Method includes facilitating transmission of a notification message to an acquirer server associated with the merchant.

Abstract: Methods and server systems for improving accuracy of authorization optimizer are described herein. Method performed by server system includes receiving a Non-Sufficient Funds (NSF) error message from an acquirer server. Method includes accessing historical transaction data from a transaction database. The historical transaction data includes transaction related information associated with a plurality of users. Method includes generating a plurality of transaction features associated with the user based on the historical transaction data. Method includes determining via an authorization optimizer model, an optimal time slot from a plurality of time slots for the user based on the plurality of transaction features associated with the user. The optimal time slot indicates an optimal time window for the acquirer server to transmit an upcoming recurring payment request to the payment account of the user.

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Abstract: A proactive energy-saving processing in an access point (AP) device is described. The AP monitors/computes usage/operating parameters (load factors) of the AP, and based on the obtained parameters, adjusts one or more AP operating parameters to reduce power consumption. The process is proactive in the sense that the current conditions in the AP do not require scaling back AP functionality. Nonetheless, the AP can scale back some functionality to reduce its power consumption, proactively, despite the absence of a need to do so.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

Abstract: An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Abstract: Metadata of each file of a group of files of a storage and chunk file metadata are analyzed to identify one or more file segment data chunks that are not referenced by the group of files of the storage. Fragmented chunk files to be combined together are identified based at least in part on the one or more identified file segment data chunks. The chunk file metadata is updated with an update that concurrently reflects the removal of at least a portion of the one or more file segment data chunks that are not referenced by the group of files and the combination of the identified fragmented chunk files.

Abstract: A specification of content to be stored in a cloud storage is received at a client-side component. A first portion of the content is divided into a plurality of data chunks. One or more data chunks of the plurality of data chunks that are to be sent via a network to be stored in the cloud storage are identified. It is determined whether a batch size of the one or more identified data chunks does not meets a threshold size. One or more data chunks of a second portion of the content that are to be stored in the cloud storage are identified. It is determined that a size of a second batch of data chunks that includes the one or more identified data chunks of the first portion of the content and the one or more identified data chunks of the second portion of the content does not meet the threshold size. It is determined that a batch period is greater than or equal to a batch threshold period. The second batch of data chunks is written to a storage of a cloud server included in a data plane.

Abstract: Systems, methods, and computer-readable media for updating configurations in sensors deployed in multi-layer virtualized environments. In some examples, a system can track information of sensors and collectors in the network. In response to determining that a specific collector becomes unavailable (e.g., the specific collector is down, offline or becomes unsupported), the system can determine affected sensors corresponding to the specific collector, determine a new collector among active collectors of the network for each of the affected sensors, and dynamically update configuration and settings of the affected sensors to maintain proper collector-to-sensor mappings and other settings on the affected sensors.

Abstract: Data chunks sent to a content destination are tracked. It is determined whether content of a portion of an object to be sent to the content destination matches one of the data chunks previously sent to the content destination. In response to the determination that the portion of the object to be sent to the content destination matches one of the data chunks previously sent to the content destination, a source reference to the matching previously sent data chunk where the content destination can locally obtain the content for the portion of the object is provided to the content destination.

Abstract: A networking system may disrupt an unauthorized wireless connection to the network. In particular, the networking system may detect a wireless connection between a client device and an unauthorized wireless access point. The networking system may receive a probe request management frame from the client device. The network system may, responsive to the detection of the wireless connection, send a probe response management frame to the client device.

Abstract: Data associated with a source system is ingested. After the data is ingested, a post-processing metadata conversion process is performed including by selecting an entry of a chunk metadata data structure and determining that a data chunk associated with the selected entry is not referenced by at least a threshold number of objects. In response to determining that the data chunk associated with the selected entry is not referenced by at least the threshold number of objects, metadata of a tree data structure node corresponding to a chunk identifier associated with the data chunk is updated to store a reference to a chunk file storing the data chunk and the selected entry is removed from the chunk metadata data structure.

Abstract: A specification of content to be stored in a cloud storage is received at a client-side component. A portion of the content is divided into a plurality of data chunks. One or more data chunks of the plurality of data chunks that are to be sent via a network to be stored in the cloud storage are identified. It is determined whether a batch size of the one or more identified data chunks meets a threshold size. Based on the determination of whether the batch size meets the threshold size, a cloud storage destination among a plurality of different cloud storage destinations associated with different performance tiers is selected.

Abstract: File metadata structures of a file system are analyzed. At least one metadata element that is duplicated among the analyzed file metadata structures is identified. The at least one identified metadata element is deduplicated including by modifying at least one of the file metadata structures to reference a same instance of the identified metadata element that is referenced by another one of the file metadata structures.

Abstract: A request to launch an application that is comprised of a plurality of layers is received. Each layer of the plurality of layers of the application is comprised of one or more corresponding virtualization resource units. The one or more corresponding virtualization resource units at each of the plurality of layers of the application is expressed as a resource ratio. It is determined that a surplus of resources is available for one or more applications. In response to determining that the surplus of resources is available for one or more applications, a priority associated with the application is determined. A version of the application is launched based on the determined priority associated with the application. The launched version of the application maintains the resource ratio.

Abstract: It is determined that an expiration date for an object associated with a first archive that includes a chunk object that includes a plurality of data chunks has expired. The first archive is stored in a first cloud performance storage class according to an archive tiering policy. It is determined that the archive tiering policy indicates migrating the plurality of data chunks included in the chunk object from the first cloud performance storage class to a second cloud performance storage class. In response to determining that the archive tiering policy indicates migrating the plurality of data chunks included in the chunk object from the first cloud performance storage class to the second cloud performance storage class, the plurality of data chunks included in the chunk object are migrated from the first cloud performance storage class to the second cloud performance storage class.