Abstract: A method includes obtaining an array of sorted identifiers to be stored in a designated portion of a memory of a given computing system, determining a segment size for splitting elements of the array into a plurality of segments, splitting the array into the plurality of segments based at least in part on the determined segment size, and compressing the plurality of segments to create a plurality of compressed segments. The method also includes generating a balanced binary search tree comprising a plurality of nodes each identifying a range of elements of the array corresponding to a given one of the segments and comprising a pointer to a given compressed segment corresponding to the given segment. The method further includes maintaining the balanced binary search tree and the compressed segments in the designated portion of the memory, and processing queries to the array utilizing the balanced binary search tree.

Abstract: A method includes extracting variable length strings from text data, associating the extracted strings with indexes in an indexing structure that maintain identifiers for instances of the strings in the text data, selecting a set of the strings having corresponding indexes whose size exceeds a threshold size value, and determining whether to merge a first index corresponding to a first string with a second index corresponding to a second string, the second string being a sub string of the first string, wherein the determination is based at least in part on a comparison of a first size of the first index and a second size of the second index. The method further includes merging the first index with the second index to create a merged index in the indexing structure responsive to the determination, and processing queries to the text data utilizing the indexing structure with the merged index.

Abstract: A method includes monitoring user behavior in an enterprise system, identifying a given user of the enterprise system associated with a given portion of the monitored user behavior, determining a predicted impact of compromise of the given user on the enterprise system, generating a risk score for the given user based on the predicted impact of compromise and the given portion of the monitored user behavior, and identifying one or more remedial actions to reduce the risk score for the given user. The method also includes implementing, prior to detecting compromise of the given user, at least one of the remedial actions to modify a configuration of at least one asset in the enterprise system, the at least one asset comprising at least one of a physical computing resource and a virtual computing resource in the enterprise system.

Abstract: A method includes obtaining data from a plurality of data sources associated with an n-gram indexing data structure and storing at least a portion of the obtained data in a first storage, the stored data comprising one or more n-gram strings. The method also includes estimating frequencies of occurrence of respective ones of the n-gram strings in the stored data, the estimated frequency of occurrence of a given n-gram string being based at least in part on a size of a given n-gram index in the n-gram indexing data structure corresponding to the given n-gram string. The method further includes, in response to detecting one or more designated conditions, selecting a portion of the stored data based at least in part on the estimated frequencies and moving the selected portion of the stored data from the first storage to a second storage having different read and write access times.

Abstract: A method includes determining a set of sizes for size bucket indexes of an indexing structure, and indexing a plurality of records into the size bucket indexes. The indexing comprises, for a given record, rounding a size of the given record to a nearest one of the determined set of sizes and placing the given record in a size bucket index associated with the nearest one of the determined set of sizes. The method also includes receiving one or more queries to the plurality of records, a given one of the queries specifying a record size. The method further includes processing the given query utilizing the indexing structure by mapping the specified record size to at least a given one of the size bucket indexes and returning one or more records from the given size bucket index.

Abstract: A method includes obtaining messages associated with assets in an enterprise system, splitting each of the messages into a set of tokens, determining a count of a number of occurrences of each of the tokens, and assigning weights to the tokens based at least in part on the counts of the number of occurrences of the tokens. The method also includes determining a score for each of the messages based at least in part on a combined sum of the weights for the set of tokens of that message, generating a summary of the messages by selecting a subset of the messages for based at least in part on the scores. The method further includes identifying remedial actions to be applied to assets in the enterprise system based at least in part on the summary of the messages, and implementing at least one of the identified remedial actions.

Abstract: A method includes obtaining an array of sorted identifiers to be stored in a designated portion of a memory of a given computing system, determining a segment size for splitting elements of the array into a plurality of segments, splitting the array into the plurality of segments based at least in part on the determined segment size, and compressing the plurality of segments to create a plurality of compressed segments. The method also includes generating a balanced binary search tree comprising a plurality of nodes each identifying a range of elements of the array corresponding to a given one of the segments and comprising a pointer to a given compressed segment corresponding to the given segment. The method further includes maintaining the balanced binary search tree and the compressed segments in the designated portion of the memory, and processing queries to the array utilizing the balanced binary search tree.

Abstract: A method includes initializing an addressable array indexing data structure comprising addresses for respective strings having a first length, the addressable array indexing data structure comprising two or more levels of character arrays with each level being associated with a corresponding character position in the strings having the first length. The method also includes extracting variable length strings from one or more records in a data set, and populating entries in the addressable array indexing data structure for extracted strings having the first length with addresses for indexes corresponding to those strings, wherein addresses for strings having the first length are generated by selecting a character value from a character array at each of the levels in the addressable array indexing data structure. The method further includes receiving, from client devices, queries to the records in the data set, and processing the queries utilizing the addressable array indexing data structure.

Abstract: A method includes obtaining data from a plurality of data sources associated with an n-gram indexing data structure and storing at least a portion of the obtained data in a first storage, the stored data comprising one or more n-gram strings. The method also includes estimating frequencies of occurrence of respective ones of the n-gram strings in the stored data, the estimated frequency of occurrence of a given n-gram string being based at least in part on a size of a given n-gram index in the n-gram indexing data structure corresponding to the given n-gram string. The method further includes, in response to detecting one or more designated conditions, selecting a portion of the stored data based at least in part on the estimated frequencies and moving the selected portion of the stored data from the first storage to a second storage having different read and write access times.

Abstract: A method includes obtaining messages associated with assets in an enterprise system, splitting each of the messages into a set of tokens, determining a count of a number of occurrences of each of the tokens, and assigning weights to the tokens based at least in part on the counts of the number of occurrences of the tokens. The method also includes determining a score for each of the messages based at least in part on a combined sum of the weights for the set of tokens of that message, generating a summary of the messages by selecting a subset of the messages for based at least in part on the scores. The method further includes identifying remedial actions to be applied to assets in the enterprise system based at least in part on the summary of the messages, and implementing at least one of the identified remedial actions.

Abstract: A method includes monitoring user behavior in an enterprise system, identifying a given user of the enterprise system associated with a given portion of the monitored user behavior, determining a predicted impact of compromise of the given user on the enterprise system, generating a risk score for the given user based on the predicted impact of compromise and the given portion of the monitored user behavior, and identifying one or more remedial actions to reduce the risk score for the given user. The method also includes implementing, prior to detecting compromise of the given user, at least one of the remedial actions to modify a configuration of at least one asset in the enterprise system, the at least one asset comprising at least one of a physical computing resource and a virtual computing resource in the enterprise system.

Abstract: A method includes determining a set of sizes for size bucket indexes of an indexing structure, and indexing a plurality of records into the size bucket indexes. The indexing comprises, for a given record, rounding a size of the given record to a nearest one of the determined set of sizes and placing the given record in a size bucket index associated with the nearest one of the determined set of sizes. The method also includes receiving one or more queries to the plurality of records, a given one of the queries specifying a record size. The method further includes processing the given query utilizing the indexing structure by mapping the specified record size to at least a given one of the size bucket indexes and returning one or more records from the given size bucket index.

Abstract: A method includes initializing an addressable array indexing data structure comprising addresses for respective strings having a first length, the addressable array indexing data structure comprising two or more levels of character arrays with each level being associated with a corresponding character position in the strings having the first length. The method also includes extracting variable length strings from one or more records in a data set, and populating entries in the addressable array indexing data structure for extracted strings having the first length with addresses for indexes corresponding to those strings, wherein addresses for strings having the first length are generated by selecting a character value from a character array at each of the levels in the addressable array indexing data structure. The method further includes receiving, from client devices, queries to the records in the data set, and processing the queries utilizing the addressable array indexing data structure.

Abstract: A method includes extracting variable length strings from text data, associating the extracted strings with indexes in an indexing structure that maintain identifiers for instances of the strings in the text data, selecting a set of the strings having corresponding indexes whose size exceeds a threshold size value, and determining whether to merge a first index corresponding to a first string with a second index corresponding to a second string, the second string being a sub string of the first string, wherein the determination is based at least in part on a comparison of a first size of the first index and a second size of the second index. The method further includes merging the first index with the second index to create a merged index in the indexing structure responsive to the determination, and processing queries to the text data utilizing the indexing structure with the merged index.