Abstract: A file management device comprising a memory; and a processor coupled to the memory and the processor configured to: a common feature extracting unit that extracts a feature common to a plurality of data files to which a same tag is provided from the data files; a tagging rule storage DB that stores a feature extracted by the common feature extracting unit and the tag provided to the data files in association with each other as a tagging rule; and a tag providing unit that provides a tag to a newly input data file based on the tagging rule stored in the tagging rule storage DB.

Abstract: In some implementations, a device may receive a request to merge a first cloud computing instance with a second cloud computing instance to generate a multi-cloud computing instance. The device may access a first application programming interface to obtain a first configuration of the first cloud computing instance. The device may access a second application programming interface to obtain a second configuration of the second cloud computing instance. The device may generate a target configuration based on the first configuration or the second configuration. The device may instantiate a set of resources with the target configuration for the multi-cloud computing instance. The device may provide output identifying the multi-cloud computing instance.

Abstract: A search query relating to a search for people and including one or more search terms is received. A search graph for the search is created from a previously created graph which is a directional graph in which people are represented by nodes and content is represented by nodes or edges. The search graph is generated by filtering out nodes or edges that represent content that is determined not to be relevant to the search terms in the search query; and, for the remaining content that is determined to be relevant to the search terms in the search query, adding to the graph a measure of the relevance of the content to the search terms. The search results are generated by operating on the search graph to identify people in the search graph who are sources of content that is relevant to the search terms.

Abstract: Various techniques are described for platform management of integrated access of public and privately-accessible datasets utilizing federated query generation and query schema rewriting optimization, including receiving at a dataset access platform a query formatted according to a first data schema, generating a copy of the query, saving the query and the copy to a datastore, parsing the copy of the query in the first schema using an inference engine, determining whether the query comprises data associated with an access control condition associated with accessing the dataset, the access control condition being configured to indicate whether the query is permitted to access the dataset, and rewriting, using a proxy server, the copy of the query in a second schema, and optimizing the rewriting by identifying a database engine to execute the query and including other data converted into another triple associated with an attribute of the query.

Abstract: Systems, devices, and methods are provided for determining whether security assurances are satisfied by security policies that are used to control access to resources used by a mainframe application. A system may use a database to store a plurality of security policies that may comprise security polices of various resources used by mainframes, including resources managed by operating systems and database systems. A reference policy that corresponds to the security assurance being sought may be determined. The security policies may be evaluated using a satisfiability modulo theories (SMT) solver to determine whether the security policies are equally or less permissive than the reference policy.

Abstract: Certain embodiments described herein relate to an improved disk usage growth prediction system. In some embodiments, one or more components in an information management system can determine usage status data of a given storage device, perform a validation check on the usage status data using multiple prediction models, compare validation results of the multiple prediction models to identify the best performing prediction model, generate a disk usage growth prediction using the identified prediction model, and adjust the available space of the storage device according to the disk usage growth prediction.

Abstract: Various techniques are described for platform management of integrated access of public and privately-accessible datasets utilizing federated query generation and query schema rewriting optimization, including receiving at a dataset access platform a query formatted according to a first data schema, generating a copy of the query, saving the query and the copy to a datastore, parsing the copy of the query in the first schema using an inference engine, determining whether the query comprises data associated with an access control condition associated with accessing the dataset, the access control condition being configured to indicate whether the query is permitted to access the dataset, and rewriting, using a proxy server, the copy of the query in a second schema by converting the copy of the query into a triple associated with the query and another triple associated with the access control condition.

Abstract: Provided herein are systems and methods for identity resolution and data enrichment. An example method performed by at least one hardware processor includes detecting at an account of a data provider, an update to personally identifiable information (PII). The PII is stored in a source table managed by an account of a data consumer. An identity resolution process is performed based on detecting the update. The identity resolution process includes generating a secure identifier of a user associated with the PII. The method further includes generating at the account of the data provider, a result table including the secure identifier. The result table is shared with the account of the data consumer.

Abstract: Various embodiments of the present invention provide methods, apparatus, systems, computing devices, computing entities, and/or the like for performing predictive structural analysis. Certain embodiments of the present invention utilize systems, methods, and computer program products that perform predictive structural analysis using at least one of table column classification machine learning models, table column clustering machine learning models, structural variance generation machine learning models, and emergence report generation machine learning models.

Abstract: The present disclosure relates to a non-transitory computer readable medium for a separate context viewing, organization, and management area for annotations that have been created. The rationale for such computer readable medium is discussed in detail. These annotations can be created on webpages or PDF documents available at a uniform resource locator (URL) anywhere on the World Wide Web. Once these annotations are created, having a system to manage the life cycle of these annotations in various contexts separate from the original web page is beneficial. This annotation life cycle and the rationale for various steps within this life cycle is discussed in detail. The present disclosure also describes some pertinent filtering and display technologies for annotations that have been created.

Abstract: Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a metadata model definition comprising a set of entity definitions specifying a set of entities, a set of semantic key definitions specifying a set of semantic keys associated with the set of entities, and a set of relationship definitions specifying a set of relationships between the set of entities. The set of semantic keys are configured to be used by an application to refer to the set of entities. The program further determines a set of technical keys for the set of entities. The set of technical keys are configured to be used by the device to refer to the set of entities. The program also stores the metadata model definition and the set of technical keys in a set of records.

Abstract: Techniques are disclosed for performing operations in a distributed computing environment comprising a plurality of computing devices implementing a Kubernetes environment. An indication is received of one or more custom resources of the Kubernetes environment. The custom resources are grouped into a commit set. The commit set is defined as an atomic unit which either succeeds or fails atomically. It is determined that at least one of the custom resources has failed to complete. In response to the determination, the custom resources of the commit set are reverted to a previous consistent state.

Abstract: A method and system for cloud distributed hybrid data storage and normalization are disclosed. The method may include obtaining a data set comprising data entities. A data entity may comprise data fields each containing a data element. The method may further include determining policy constraint meta-data for each of the data elements based on the storage policy constraint. The policy constraint meta-data may include a first meta-tag indicating the storage policy constraint for the data element. The method may further include determining whether a server satisfies the storage policy constraint based on the first meta-tag for the data element. When the server satisfies the storage policy constraint, the method may further include transmitting the data element to the server to store the data element on the server. When the server fails to satisfy the storage policy constraint, the method may further include, storing the data element on the client.

Abstract: A system and method for generating shard data based on semantic sharding is proposed. Shard data is generated by a map sharder that is configured to generate the shard data based on semantic objects in a geographical area and a definition of sections. The sections cover parts of the geographical area. The map sharder searches, for each of the sections, for semantic objects that are located at least partly in a section and stores found objects in a shard data entry of the shard data.

Abstract: A computer system obtains a data model that encodes a data source as a tree of logical tables. Each logical table includes respective data fields of the data source. For each data field in the logical tables, the system automatically assigns a semantic role to the data field based on a concept obtained from a concept graph. The system determines hierarchies between the data field and other data fields in the first data source based on a respective semantic role of the data field and semantic roles of the other data fields. The system validates the data field based on the assigned semantic role and the determined hierarchies. The system displays transformations to clean the data field based on the assigned semantic role. The system transforms data values for the data field according to a user input and updates the logical tables according to the transformed data values.

Abstract: Techniques discussed herein manage backups of a service cell (SC). Each SC may include a data plane that is isolated from other SCs and comprises a distributed computing cluster (a cluster). A manifest that specifies one or more backup policies may be used to generate a full backup or a partial backup of a data set stored by the cluster. In accordance with the manifest, a signal may be sent to nodes of the cluster. In response, the nodes may transmit locally-stored data (e.g., data segments) to specified locations at a remote storage. The system may maintain a mapping of which segments correspond to data that was stored in the cluster at a time corresponding to a full or partial backup.

Abstract: The present disclosure relates to the comparison of data items, such as media data items or streams, e.g. audio files or streams, to determine a similarity between the data items. A device receives a plurality, or ensemble, of data items, and calculates the pairwise similarity scores between a number of unique pairs of data items within the ensemble. For any given pair of data items, the pairwise similarity score is compared with an overall similarity score for an “indirect path” connecting the pair of data items via one or more intermediate data items. If the indirect path indicates a closer similarity between the data items, the pairwise score is updated based on the overall similarity score of the indirect path. The updated similarity score generated by this comparison then provides an improved indication of the similarity of the data items compared to the prior art method.

Abstract: A network validation system is described which may perform operations such as generating, analyzing, verifying, correcting, recommending, and deploying language, symbols, etc., such as domain specific language, configured to allow users to express their intent on the configuration and operation of a network, such as a cloud-based network. The network validation system may provide domain specific language that includes rules, statements, symbols, data, etc., configured to convey the intent of users on the configuration and operation of networks for purposes such as configuring and/or validating communication paths, testing or setting associated network object configurations, and may be employed to report violations in such configurations relative to user intent of the one or more users. The network validation system may also be employed to monitor such domain specific language and generate telemetry signaling, for example, that a rule has or has not been violated, actions a user may take, etc.

Abstract: In an example implementation according to aspects of the present disclosure, a method may include receiving, at a computing device, an attempt to authenticate a user via an authentication event and, upon validating the authentication event used, determining which authentication profile to initiate for the user to use the computing device. As an example, the computing device then initiates the determined authentication profile to launch a customized set of programs on the computing device for the user.

Abstract: Provided herein are systems and methods for identifying personal identifiers in content. An entity engine may receive content to identify candidate personal identifiers. The entity engine may determine that a text string in the content matches to a data format specified in entity definitions corresponding to types of personal identifiers and a rule for finding a geographic or linguistic term in the content correlated to the specific type of personal identifier. Each entity definition may specify a data format for finding a specific type of personal identifier in content. The data format corresponds to a type of personal identifier. The entity engine may identify, according to a rule of the first entity definition, a geographic or linguistic term in the content correlated to the type of personal identifier. The entity engine may classify the text string as the type of personal identifier, for preventing data breach or exfiltration.

Abstract: Some embodiments process data as defined by a polymorphic data model. A server may provide the polymorphic data model to a client application from a datastore. The functionality or features of the client application may be controlled as a function of the polymorphic data model. The client application may thus provide different functionalities when provided with different polymorphic data models. Updates to the polymorphic data model may be used to update the client application's functionality without any updates to the client application's executable code.

Abstract: In an embodiment, a computing system, such as a monitoring computer, receives a request from a user to monitor an account of the user with an online service provider. The request may include personal information and user preferences for one or more protective actions. The system periodically monitors external data sources for indications of changes to personal information associated with the account, and detects changes or attempted changes to personal information associated with the account. The system may determine risk levels associated with detected changes or attempted changes, and transmit a notification to the user via a communication channel selected based on the determined risk level and/or the user preferences. The system may also initiate protective actions, so that further unauthorized access to the account may be prevented.

Abstract: Methods, systems, and devices for asset discovery, user discovery, data classification, risk evaluation, and data/device security are described. The method includes retrieving data stored at one or more remote locations, summarizing the retrieved data at the one or more remote locations, transferring the summarized data from the one or more remote locations to the at least one computing device, processing the transferred data by the at least one computing device, discovering assets in technology environments, classifying data that resides on each asset of the discovered assets into a respective confidentiality group of multiple confidentiality groups, calculating one or more risk scores for the discovered assets or users of the discovered assets, or both, and performing a security action to protect data that resides on an asset of the discovered assets.

Abstract: A system for verifying a user's request to access a resource determines a set of entitlement attributes from the request. The set of entitlement requests indicates a type of permission to access a particular resource, including at least one of a write-access and a read-access to the particular resource. The system determines whether there is any rule that is violated by the set of entitlement attributes. In response to determining that there is at least one rule that is violated by the set of entitlement attributes, the system denies the request.

Abstract: One embodiment provides a method, including: receiving, at a service provider and from a user, a request for computation of a function, wherein the request includes a description of the function to be computed and requirements of the user; identifying, from data sources accessible to the service provider, a plurality of data sources to participate in the computation in view of the requirements and the description of the function, wherein each of the plurality of data sources includes data of a data owner and constraints on use of the data; identifying a multi-party computation protocol and parameters of the multi-party computation protocol for performing the computation; and running the computation of the function using the data of the plurality of data sources and in view of the requirements of the user and the constraints of the plurality of data sources.

Abstract: Embodiments of storage device architecture for processing data using machine learning are disclosed. In some embodiments, the storage device includes a separate I/O core and a neural network core. The storage device can create a copy of data streams in which the data is stored, and the neural network core can process the copy of the data streams in a neural network while the I/O core can perform read or write functions on the data streams.

Abstract: A system for preventing duplication of a computer source file to a destination file includes a user application accessed by a user of a computer. An agent application hosted by the computer registers for a notification of a user interface action with an operating system (OS) of the computer. The agent receives notice from the OS of the user interface action and determines if the user interface action is indicative of a data file duplication operation of a source file to a destination file location The Agent compares a property of the source file and a property of the destination file location to a blocking criteria, and blocks the user interface action from reaching the application.

Abstract: A structured data store service, such as a database service, may implement fine-grained access to data maintained at the database service using federated identity. Fine grained access requests may be received at a database service for specified data maintained for an application provider from a client of the application provider. An access credential may be also be received. Verification of the access credential may be obtained, and the database service may evaluate the fine-grained access request according to a delegation policy corresponding to the access credential to determine whether the fine-grained request is authorized. If authorized, the fine-grained access request may be service. If not authorized, the fine-grained access request may be denied. In some embodiments, multiple application clients may have the same authorization for data, such as read authorization, while another one or more application clients may have different authorization for the data, such as write authorization.

Abstract: Systems and techniques are described herein for providing a beholder, via a user interface on a user experience device, with a multi-faceted and flexibly-dimensional virtual experience of one or more target identities placed in a subject matter context. A systems aspects include selecting, finding, and interpreting digital content pertaining to a subject matter context indicated by the beholder; deconstructing digital content into discrete content elements containing content segments that are classified according to a schema of element facets, and then constructing a facet-segmented repository of discrete content elements pertaining to a target identity; supplementing existing digital content with supplemental information and content to support the presentation of expanded information content, dimensions, or sensory capabilities; and creating and presenting a virtual experience container that is adapted to the beholder and the capabilities of the beholders user experience device.

Abstract: A method, computer program product, and computing system for defining a normal IO write mode for writing data to a storage system, the normal IO writing mode including: writing the data to a cache memory system, writing the data to a journal, in response to writing the data to the journal, sending an acknowledgment signal to a host device, and writing the data from the cache memory system to a storage array. A request may be received to enter a testing IO write mode. In response to receiving the request, the data may be written to the cache memory system. The writing of the data to the journal may be bypassed. The acknowledgment signal may be sent to the host device in response to writing the data to the cache memory system. The data may be written from the cache memory system to the storage array.

Abstract: Non-limiting examples of the present disclosure describe systems and methods for scanning of data for policy compliance. In one example, network data is evaluated to generate one or more groupings. A grouping may be based on file type of the network data. Data identification rules are applied to identify one or more data schemas from file data of a grouping. One or more policy rules that apply to content of the data schema may be determined. At least one file of the file data may be scanned to determine compliance with the one or more policy rules. A report of compliance with the one or more policy rules may be generated based on a result of a file scan. Other examples are also described.

Abstract: A method includes receiving a piece of data for storage in a storage system, breaking the piece of data into a plurality of fixed size data portions, and determining a deduplication hash for each of the fixed size data portions. The method further includes checking for matching hashes already stored in the storage system, storing fixed size data portions unmatched to an already stored hash with metadata identifying the unmatched hash fixed size data portions in the storage system, and storing metadata for hash fixed size data portions already stored in the data storage system. The piece of data is reviewed for further deduplication using sliding window hashes during background activity of the data storage system.

Abstract: A data analysis computer system is provided that receives a timeseries dataset and generates implied data from the dataset. The dataset is further vectorized to reduce the dimensionality of the data. Users provide input to identify windows of data that either positively or negatively correlate to instances of a given type of occurrence within the data. The user defined windows are converted to fixed sized windows and a machine learning algorithm constructs a model from the data. The model is used to predict instances of the given type of occurrence in newly received data. Validation of the predications may be performed.

Abstract: A method includes allocating, via a tier allocation component, a first portion of data to a first tier memory component and writing the first portion of data to the first tier memory component in response to a first tier free list having an available entry. The method further includes evicting a second portion of data from the first tier memory component in response to the first tier free list being empty when the first portion of data is allocated to the first tier memory component and writing the first portion of data to the first tier memory component in response to evicting the second portion of data.

Abstract: Various techniques are described for platform management of integrated access of public and privately-accessible datasets utilizing federated query generation and query schema rewriting optimization, including receiving at a dataset access platform a query formatted according to a first data schema, generating a copy of the query, saving the query and the copy to a datastore, parsing the copy of the query in the first schema using an inference engine, determining whether the query comprises data associated with an access control condition associated with accessing the dataset, the access control condition being configured to indicate whether the query is permitted to access the dataset, and rewriting, using a proxy server, the copy of the query in a second schema by converting the copy of the query into a triple associated with the query and another triple associated with the access control condition.

Abstract: Various embodiments relate generally to data science and data analysis, computer software and systems, and wired and wireless network communications to provide an interface between repositories of disparate datasets and computing machine-based entities that seek access to the datasets, and, more specifically, to a computing and data storage platform that facilitates consolidation of one or more datasets, whereby a collaborative data layer and associated logic facilitate, for example, efficient access to, and implementation of, collaborative datasets. In some examples, a method may include receiving data representing a query of a consolidated dataset that may include datasets formatted atomized datasets, analyzing the query to classify portions of the query to form classified query portions, partitioning the query into sub-queries as a function of a classification type for each of the classified query portions, and retrieving data representing a query result from distributed data repositories.

Abstract: Techniques are provided for tiering snapshots to archival storage in remote object stores. A restore time metric, indicating that objects comprising snapshot data of snapshots created within a threshold timespan are to be available within a storage tier of a remote object store for performing restore operations, may be identified. A scanner may be executed to evaluate snapshots using the restore time metric to identify a set of candidate snapshots for archival from the storage tier to an archival storage tier of the remote object store. For each candidate snapshot within the set of candidate snapshots, the scanner may evaluate metadata associated with the candidate snapshot to identity one or more objects eligible for archival from the storage tier to the archival storage tier, and may archive the one or more objects from the storage tier to the archival storage tier.

Abstract: Examples disclosed herein relate to integrity monitoring of a computing system. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring.

Abstract: The present disclosure relates to non-transitory computer readable mediums (CRMs) for guided-viewing of annotations and the process or organizing and connecting annotations of web documents within web browsers. The rationale for creating and using such computer readable medium is discussed in detail within this disclosure. Throughout the course of this explanation, various steps are dissected and explained in detail in the context of exemplary embodiments to elaborate on the relevant data structures and the architectures, messaging patterns, and use cases that provide the context for these data structures.

Abstract: Techniques are provided for facilitating network devices to obtain configuration updates from a central configuration repository. Configuration update information is received regarding a configuration update in a configuration repository. A data tree is updated based on the configuration update information. An identifier unique to the update is generated. A determination is performed that network device properties of a network device correspond to a set of network device properties indicated for the configuration update information. A notification indicating the availability of the configuration update is sent over one or more networks to the network device.

Abstract: A method of dynamically adjusting access privileges of system identities. A set of access logs associated with a system are analyzed in order to generate a restricted access policy for an over privileged system identity. An initial access policy of the system identity is replaced with the restricted access policy and a continuous monitoring and access management (CMAM) service is initiated. Access logs are collected for a monitoring time window and an access denied error can be extracted from the access logs. The access denied error can be compared to an ignore list and/or the access denied error can be added to the ignore list. Authorization checks can be performed to determine if the action associated with the access denied error is authorized. If the action is authorized, the access policy is adjusted to allow for performance of the action.

Abstract: Embodiments described herein provide techniques for maintaining consistency in a distributed system (e.g., a distributed secondary storage system). According to one embodiment of the present disclosure, a first set of file system objects included in performing the requested file system operation is identified in response to a request to perform a file system operation. An update intent corresponding to the requested file system operation is inserted into an inode associated with each identified file system object. Each file system object corresponding to the inode is modified as specified by the update intent in that inode. After modifying the file system object corresponding to the inode, the update intent is removed from that inode.

Abstract: The disclosure herein describes determining computing assets associated with a service. Metadata from one or more computing assets of a computing system is collected. One or more alias terms are identified in the collected metadata of the one or more computing assets, wherein the alias terms are associated with the service. Service association scores are generated for the one or more computing assets based on the identified one or more alias terms and a term-score mapping. Each service association score indicates a likelihood that a computing asset is used for a service. A subset of computing assets of the one or more computing assets is identified. The subset of computing assets includes computing assets with service association scores that exceed a service association threshold. Computing assets of the service are identified based on the identified subset, thereby reducing the need for manual identification of asset-service associations.

Abstract: Systems, methods, and computer-readable media for context-based transfer and access of data include a producer which receives a request from a consumer to access a data block. The producer verifies whether a context associated with the consumer will allow access the data block, by providing a challenge to the consumer and obtaining a response, the response including a certification that the context associated with the consumer will allow the consumer to access the data block. Upon verifying that the context allows the consumer to access the data block, the producer transfers a data capsule, the data capsule including an encrypted version of the data block and a micro agent for monitoring access to the data block. The micro agent can interact with an operating system at the consumer to allow decryption and local access of the data block upon the data capsule being transferred.

Abstract: The present disclosure relates to methods and systems for organizing, viewing, and connecting annotations of web documents within web browsers. The rationale for connecting annotations is discussed in detail along with mechanisms to enhance asynchronous, guided viewing within web browsers. Furthermore, data structures and processes for constructing this functionality are discussed with the aid of use case and sequence diagrams as well as verbal descriptions. In addition, guidance is provided for hardware system specifications and architectures of the exemplary systems that are discussed.

Abstract: A software-defined network (SDN) rule modification counter system provides counters that track all changes and edits to rules at SDN controllers and SDN switches on an SDN. The system compares counters at the SDN controller and SDN switch to determine if they match. If the counters do not match, a change has been made to the rules. With the addition of rule edit statistics the SDN controller will now have visibility that a rule modification was performed. The SDN controller then verifies that the state of the device is the same as its expected state as a secondary integrity check. Based on the rule modification notification, changes to a central rules table at the SDN controller and changes to rule settings at the SDN switch are made according to pre-programmed logic.

Abstract: The invention relates to a method for cryptographically secure storing a file (101) using a web application executed by a web browser (106) on a user computer system (104, 162, 168) of a user (102, 160). The method comprises: encrypting the file (101) on the user computer system (104, 162, 168) by the web application, providing a distribution plan by the web application, fragmenting the encrypted file (101) on the user computer system (104, 162, 168) by the web application into a plurality of file fragments (F1-F4) according to the distribution plan, sending the resulting file fragments (F1-F4) by the web application over the network (178) to the storage services identified by the distribution plan (SD1-SD6).

Abstract: A method of controlling an operational system by a rules management system comprising a processor and a memory, and a computing apparatus comprising a processor and a memory are provided. The processor is programmed to execute rules from a rules repository stored on a memory in response to a request. The computing apparatus further comprises a high rules repository storing one or more high level rules, wherein each high level rule, when executed by the processor, modifies the effect of execution of one or more rules Rm in the rules repository; and a high rules conditions module that when executed by the processor identifies and executes the high level rules that apply to the request.

Abstract: A technique for using a caching layer for key-value storage in a database is described. In one example of the present disclosure, a system can receive, at an unsorted data structure of a caching layer, a key-value pair associated with a data object. The unsorted data structure can store a first plurality of key-value pairs. The system can receive one or more operations for updating the key-value pair in the caching layer. The system can determine the key-value pair is to be migrated to a sorted memory table based on a caching algorithm. The system can migrate the key-value pair to a sorted memory table configured to store a second plurality of key-value pairs that is larger than the first plurality of key-value pairs and sort the key-value pair with the second plurality of key-value pairs prior to storing the key-value pair in the sorted memory table.

Abstract: A system including persistent storage for storing an object repository and a user data backup. The system also includes a manager that obtains fragmented user data associated with an object that is potentially duplicative of an object stored in the object repository; makes a determination that the object is duplicative based on a copy of the object stored in the object repository; in response to making the determination, adds the fragmented user data to a user data backup without adding the object to the backup; associates the fragmented user data in the user data backup with the copy of the object stored in the object repository; and stores the user data backup in the persistent storage.