Abstract: Aspects of the subject disclosure are directed towards protecting machines, such as virtual machines in a cloud datacenter, from receiving unwanted traffic, and also reducing bandwidth by eliminating redundant data transmissions. In one aspect, an agent intercepts packets from a source, and determines whether the destination is allowed to receive packets from the source, based upon a communication group membership. The agent also may drop packets based upon malware/fraud signatures. The agent also attempts to reduce bandwidth by replacing redundant content with identifiers (e.g., hashcodes), which a destination machine uses to rebuild the original content. A destination-side agent may perform the same or similar communication group membership and malware/fraud signature filtering operations, and reassemble redundancy-reduced content from received identifiers as needed.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: A system and method is provided for generating a dynamic comprehensive domain review. A domain review engine obtains authoritative literature associated with a domain to extract insights using entity recognition and relationship extraction, and ranks the extracted results to generate a dynamic domain review.

Abstract: A knowledge base can include a dictionary associated with classes of a model, e.g., an ontology. A text segment that is not found in the dictionary can be received. Feature(s) can be determined for the text segment and, based partly on providing the feature(s) to a classifier, a set of values can be determined. The distribution can include values respectively corresponding to the classes. One of the values can be greater than a predetermined threshold. That value can correspond to a class. An indication identifying the class can be presented via a user interface having functionality to provide input that the text segment is associated with the class, is not associated with the class, or is associated with another class. Based at least partly on adding a new class to the ontology, a precedence table indicating priorities between motifs defining relationships between classes of the ontology can be updated.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: Free-form text in a document can be analyzed using natural-language processing to determine actionable items specified by users in the text or to provide recommendations, e.g., by automatically analyzing texts from multiple users. Words or phrases of the text can be mapped to classes of a model. An actionable item can be determined using the mapped words or phrases that match a selected grammar pattern. Items can be ranked, e.g., based on frequency across multiple documents. In some examples, the classes can include a suggestion-indicator class or a modal-indicator class, and the selected grammar pattern can include one of those classes. In some examples, the mapping can use a dictionary. A new term not in the dictionary can be automatically associated with classes based on attributes of the new term and of terms in the dictionary, e.g., the new term's part of speech or neighboring terms.

Abstract: A nexus of a software failure can be determined. A feature module can determine execution features based at least in part on particular execution-related data. An analysis module can determine particular nexus data based at least in part upon a stored computational model and the determined execution features. In some examples, a communications module receives the particular execution-related data and transmits the determined particular nexus data via the communications interface. In some examples, a modeling module determines the computational model based at least in part on training data including execution features of a plurality of execution-related data records and respective nexus data values. Some examples include executing a program module, transmitting execution-related data of the program module, receiving a nexus data value, and executing the program module again if the nexus is a condition external to the program module.

Abstract: A computing device can receive at least one document including text segments. The computing device can determine a characteristic pattern associated with a first text segment of the text segments and determine an association between the first text segment and a first individual class of a model based at least in part on the characteristic pattern. The computing device can determine a collection of classes of the model associated with the at least one document based at least in part on the association, and determine an actionable item associated with the at least one document based at least in part on the collection and at least one grammar pattern. The computing device can present or transmit an indication of the actionable item. In some examples, the computing device can arrange actionable items in an order based at least in part on occurrences of the actionable items from multiple documents.

Abstract: A data center system is described which includes multiple data centers powered by multiple power sources, including any combination of renewable power sources and on-grid utility power sources. The data center system also includes a management system for managing execution of computational tasks by moving data components associated with the computational tasks within the data center system, in lieu of, or in addition to, moving power itself. The movement of data components can involve performing pre-computation or delayed computation on data components within any data center, as well as moving data components between data centers. The management system also includes a price determination module for determining prices for performing the computational tasks based on different pricing models. The data center system also includes a “stripped down” architecture to complement its use in the above-summarized data-centric environment.

Abstract: Sensor data from multiple sensors associated with a user is received. The sensors may include sensors of a smart phone, and sensors associated with other devices such as fitness trackers, video game consoles, and cameras. The sensor data is processed to identify entities such as persons, locations, and objects that may be of interest to the user. A personal digital assistant application can present information related to the identified entities to the user, and can allow the user to perform various queries with respect to the identified entities, and previously identified entities. In addition, the identified entities can be used to trigger one or more rules including recording when and where a particular entity is identified, and generating an alert when a particular entity is identified.

Abstract: A performance-based storage service level agreement (SLA) can be established that specifies one or more storage performance parameters. A storage allocation process can include receiving a request for a storage SLA that specifies one or more storage performance parameters, determining, for a virtual machine (VM) and based at least in part on the one or more storage performance parameters in the storage SLA: (i) a storage location among a set of candidate storage locations, and (ii) an amount of storage to allocate. The amount of storage can then be allocated at the storage location for the VM to use in making storage requests. Runtime enforcement of the storage SLA can utilize a scheduling mechanism that buffers individual storage requests into different queues that are used for meeting one or more storage performance requirements specified in storage SLA.

Abstract: Sensor data from multiple sensors associated with a user is received. The sensors may include sensors of a smart phone, and sensors associated with other devices such as fitness trackers, video game consoles, and cameras. The sensor data is processed to identify entities such as persons, locations, and objects that may be of interest to the user. A personal digital assistant application can present information related to the identified entities to the user, and can allow the user to perform various queries with respect to the identified entities, and previously identified entities. In addition, the identified entities can be used to trigger one or more rules including recording when and where a particular entity is identified, and generating an alert when a particular entity is identified.

Abstract: Described herein are various technologies pertaining to identification of inbound and outbound network and application attacks with respect to a data center. Commodity servers are used to monitor ingress and egress traffic flows, and anomalies are detected in the traffic flows. Responsive to detecting an anomaly, a mitigation strategy is executed to mitigate damage caused by a cyber-attack.

Abstract: There is provided a method and system for process migration in a data center network. The method includes selecting processes to be migrated from a number of overloaded servers within a data center network based on an overload status of each overloaded server. Additionally, the method includes selecting, for each selected process, one of a number of underloaded servers to which to migrate the selected process based on an underload status of each underloaded server, and based on a parameter of a network component by which the selected process is to be migrated. The method also includes migrating each selected process to the selected underloaded server such that a migration finishes within a specified budget.

Abstract: Disclosed herein is a system and method for searching or processing queries for searching for documents contained in a domain specific knowledge base. The system takes a query and generates from the query a modified version of the query by passing the query through one or more filters in a query processor. The query processor adds or removes terms from the query. The query processor can add or recognize that two words that appear to be separate words actually identify a specific software entity or can determine that a number appearing in a query is not just a number but refers to a specific version or a number relevant to the specific problem.

Abstract: Disclosed herein is a system and method for generating an enhanced index for documents contained in a knowledge base. Documents or configuration snapshots are tokenized and then passed through a number of filters. The filters modify the token stream to generate an enhanced token stream for the document by removing words from the stream and adding domain level knowledge to the tokens in the stream. The token stream is then added to the index for the document so that searches can be completed against the knowledge base when searches are generated from configuration snapshots or from inputted search queries.

Abstract: Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures.

Abstract: Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures.

Abstract: Disclosed herein is a system and method for generating an enhanced index for documents contained in a knowledge base. Documents or configuration snapshots are tokenized and then passed through a number of filters. The filters modify the token stream to generate an enhanced token stream for the document by removing words from the stream and adding domain level knowledge to the tokens in the stream. The token stream is then added to the index for the document so that searches can be completed against the knowledge base when searches are generated from configuration snapshots or from inputted search queries.

Abstract: Aspects of the subject disclosure are directed towards automatically inferring the significant parts of bug reports, including by querying a knowledge base built by mining information from a large number of earlier bug reports. Common phrases in the earlier bug reports are filtered to provide a subset of phrases relevant to a bug domain, which are stored in the knowledge base and mapped to an ontology model of the knowledge base. When a new bug report is received for inference/analysis, the phrases therein are tagged based upon the ontology model, and the knowledge base queried with the tagged phrases to determine problems, activities and actions that are likely related to the new bug report.