Abstract: Some embodiments include tracking events and classifying assets within a computer system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset can be classified based on comparison of the first signal value and the second signal value. The time series can be based on at least one time window including time intervals. Counters to determine a number of occurrences of an event type can be associated with the time intervals. Each of the counters can be incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: Some embodiments include tracking events and classifying assets within a computer system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset can be classified based on comparison of the first signal value and the second signal value. The time series can be based on at least one time window including time intervals. Counters to determine a number of occurrences of an event type can be associated with the time intervals. Each of the counters can be incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: Some embodiments include tracking events and classifying assets within a computer system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset can be classified based on comparison of the first signal value and the second signal value. The time series can be based on at least one time window including time intervals. Counters to determine a number of occurrences of an event type can be associated with the time intervals. Each of the counters can be incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: Some embodiments include tracking events and classifying assets within a computer system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset can be classified based on comparison of the first signal value and the second signal value. The time series can be based on at least one time window including time intervals. Counters to determine a number of occurrences of an event type can be associated with the time intervals. Each of the counters can be incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: A system differentiates good content from bad content in a user-provided content system. Messages are analyzed for features that characterize messages. A feature may occur in one or more messages. A feature that has more than a threshold number of occurrences in messages in a time interval is identified for further analysis. Enhanced authentication is requested from senders of the messages with occurrences of the identified feature. Based on the rate at which senders of the messages pass authentication, the content associated with the message is determined to be good content or bad content. Subsequent messages are blocked or successfully delivered based on whether features occurring in the messages are indicative of good content or bad content.

Abstract: Behavior of an online system is modified dynamically using feature expressions and feature loops. A feature expression can be expressed as a combination of other features or feature expressions, thereby allowing specification of complex features. The sets of feature expressions and policies of an online system can be modified while the online system is running. Feature loops aggregate values of a feature expression across a plurality of actions, for example, number of occurrences of an event over a time interval. The online system evaluates a set of feature expressions in response to actions performed by users. Feature expressions are used to specify policies that determine how the online system reacts to certain types of user actions. The ability to dynamically modify the feature expressions and policies of the online system allows the online system to adapt to attacks by malicious users in a timely manner.

Abstract: Some embodiments include tracking events and classifying assets within a computer system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset can be classified based on comparison of the first signal value and the second signal value. The time series can be based on at least one time window including time intervals. Counters to determine a number of occurrences of an event type can be associated with the time intervals. Each of the counters can be incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: To allow for tracking events and classifying assets within a social networking system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset is classified based on comparison of the first signal value and the second signal value. In an embodiment, the time series is based on at least one time window including time intervals. In an embodiment, counters to determine a number of occurrences of an event type are associated with the time intervals. In an embodiment, each of the counters are incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: A system differentiates good content from bad content in a user-provided content system. Messages are analyzed for features that characterize messages. A feature may occur in one or more messages. A feature that has more than a threshold number of occurrences in messages in a time interval is identified for further analysis. Enhanced authentication is requested from senders of the messages with occurrences of the identified feature. Based on the rate at which senders of the messages pass authentication, the content associated with the message is determined to be good content or bad content. Subsequent messages are blocked or successfully delivered based on whether features occurring in the messages are indicative of good content or bad content.

Abstract: Behavior of an online system is modified dynamically using feature expressions and feature loops. A feature expression can be expressed as a combination of other features or feature expressions, thereby allowing specification of complex features. The sets of feature expressions and policies of an online system can be modified while the online system is running. Feature loops aggregate values of a feature expression across a plurality of actions, for example, number of occurrences of an event over a time interval. The online system evaluates a set of feature expressions in response to actions performed by users. Feature expressions are used to specify policies that determine how the online system reacts to certain types of user actions. The ability to dynamically modify the feature expressions and policies of the online system allows the online system to adapt to attacks by malicious users in a timely manner.

Abstract: Behavior of an online system is modified dynamically using feature expressions and feature loops. A feature expression can be expressed as a combination of other features or feature expressions, thereby allowing specification of complex features. The sets of feature expressions and policies of an online system can be modified while the online system is running. Feature loops aggregate values of a feature expression across a plurality of actions, for example, number of occurrences of an event over a time interval. The online system evaluates a set of feature expressions in response to actions performed by users. Feature expressions are used to specify policies that determine how the online system reacts to certain types of user actions. The ability to dynamically modify the feature expressions and policies of the online system allows the online system to adapt to attacks by malicious users in a timely manner.

Abstract: To allow for tracking events and classifying assets within a social networking system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset is classified based on comparison of the first signal value and the second signal value. In an embodiment, the time series is based on at least one time window including time intervals. In an embodiment, counters to determine a number of occurrences of an event type are associated with the time intervals. In an embodiment, each of the counters are incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.

Abstract: Behavior of an online system is modified dynamically using feature expressions and feature loops. A feature expression can be expressed as a combination of other features or feature expressions, thereby allowing specification of complex features. The sets of feature expressions and policies of an online system can be modified while the online system is running. Feature loops aggregate values of a feature expression across a plurality of actions, for example, number of occurrences of an event over a time interval. The online system evaluates a set of feature expressions in response to actions performed by users. Feature expressions are used to specify policies that determine how the online system reacts to certain types of user actions. The ability to dynamically modify the feature expressions and policies of the online system allows the online system to adapt to attacks by malicious users in a timely manner.