Abstract: A system maintains, generates, and manages infrastructure layouts. The infrastructure layouts interconnect infrastructure components and capture relational aspects between the components within the interconnections. The infrastructure layouts map northbound services, which are service outputs, to southbound services, which are service capabilities, for fulfillment. The system may traverse a mapping from a northbound service to a fulfilling southbound service to generate a workflow to support deployment of the northbound service. In various implementations, the system may compare a path, which maps a northbound service to a southbound service, to a policy model to determine compliance with the policy.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining a network path between computer assets. One of the methods includes receiving an asset topology that includes an identifier for each computer-related asset that may be an entry point for an attack simulation, receiving threat data that identifies vulnerabilities of computer-related assets, determining a first computer-related asset that may be an entry point for an attack simulation, identifying one or more first vulnerabilities of the first computer-related asset, determining a path from the first computer-related asset to a second computer-related asset, determining one or more second vulnerabilities of the second computer-related asset, determining a probability that the second computer-related asset will be compromised by an adversary, and determining a change to the asset topology to reduce the probability that the second computer-related asset will be compromised by an adversary.

Abstract: A system may receive an identifier for a new model product and identify a stored parts list associated with the identifier. The system may determine a code for one or more parts included on the parts list and may compare the code for a part, of the one or more parts included on the parts list, with codes for parts included in old model products. The system may determine that the part included on the parts list is comparable to one of the parts included in the old model products if the code for the part included on the parts list matches the code for the one of the parts included in the old model products. The system may use data associated with the one of the parts included in the old model products to generate a new spare parts forecast.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for identifying network security risks. One of the methods includes receiving organizational hierarchy data and receiving access privilege data for a network, generating an adjacency matrix that represents connections between individuals within the organizational hierarchy and various groups, and that represents connections between the individuals and various access privileges, selecting an analytic technique for analyzing the adjacency matrix, determining, for each individual, an individual score that represents a security risk associated with the individual's network account, and in response to determining that the individual score meets a threshold, applying security controls.

Abstract: A device may receive, from another device, an image that depicts one or more events occurring at a location. The device may detect an event of the one or more events depicted in the image. The device may determine a first score that indicates a likelihood that the event is an anomalous event. The first score may be based on first data received from the other device. The device may determine a second score that indicates a similarity between the event and another event. The second score may be based on second data received from the other device. The second data may comprise data from a sensor, a wearable device, a mobile device, and/or a handheld device. The device may perform an action based on the first score or the second score.

Abstract: A system includes circuitry for rewriting blockchains in a non-tamper-evident or tamper-evident operation using a key secret held by a trusted party. The blockchains may include a series of blocks secured by a chameleon hash that may prevent non-tamper-evident rewrites by non-trusted parties that are not in possession of the key secret. Rewrite circuitry of the system may determine randomness data from the chameleon hash and altered data from a rewrite. The randomness data may be written to the randomness field of a block overwritten with the altered data such that the block remains coding-consistent with the chameleon hash and other blocks in the blockchain.

Abstract: A device may receive a source document to be processed for contextual information associated with named entities included in the source document. The device may identify a named entity included in the source document, and may identify a context of the source document. The device may identify a reference document associated with the named entity. The reference document may be different from the source document. The device may perform a semantic similarity analysis based on the context of the source document and further based on the reference document. The device may identify contextual information, included in the reference document, based on performing the semantic similarity analysis. The contextual information may relate to the context of the source document. The device may provide the contextual information.

Abstract: A system includes circuitry for rewriting blockchains in a non-tamper-evident or tamper-evident operation using a key secret held by a trusted party. The blockchains may include a series of blocks secured integrity codes that may prevent non-tamper-evident rewrites by non-trusted parties that are not in possession of the key secret. In some cases, the key may allow valid but tamper-evident rewrites of the blockchain by trusted entities. Integrity outputs may be generated from the integrity codes based on the content of the previous blocks in the series such that attempts by untrusted parties to replace a block may be detected through coding-inconsistencies with other blocks.

Abstract: A device may obtain a document, of a document type, from which specific information is to be captured. The specific information to be captured may depend on a document class associated with the document. The device may identify the document class, associated with the document, based on a characteristic of the document. The document class may identify a category of document in which the document is included, and may be associated with multiple document types. The device may determine field information associated with the document class. The field information may include information that identifies a portion of the document where the specific information is located, or may include information that identifies a manner in which the specific information can be identified within the document. The device may analyze the document, based on the field information, in order to capture the specific information. The device may provide the captured specific information.

Abstract: The vulnerability of network devices may be predicted by performing a survival analysis on big data. A prediction algorithm may be built by considering historical data from heterogeneous data sources. The operating state of the network devices on a network may be predicted. The services potentially affected by a predicted outage may be determined and displayed. Alternatively or in addition, the number of clients potentially affected by a predicted outage may be determined and displayed.

Abstract: A system includes circuitry for performing hybrid blockchain rewrites by trusted parties. The hybrid blockchain may include blocks with multiple parts. In some cases, the blocks may include a core part and a tertiary part. The system may include conditions for validity preserving and/or non-tamper-evident rewrites to the parts of the block. The conditions to support rewrites to the core part may be more stringent than the corresponding conditions to support rewrites to the tertiary part. In some cases, the core part may be write-locked.

Abstract: A network security analysis system performs anomaly detection with low false positives by implementing a multiple perspective analysis of network data. The analysis system takes a new approach to defining the network baseline, using, as examples, topic modeling and time series algorithms. The analysis system implements natural language processing techniques to examine the content of network and time series data to establish and maintain a definition of the baseline network state model, against which new activity is compared to identify anomalies.

Abstract: A device may receive sensor data from a sensor device located on a particular farm. The device may identify an alert, associated with the particular farm, based on the sensor data and using a model. The model may be created based on imagery data and numeric data relating to a group of farms. The device may determine, using the model, a recommended course of action to address the alert, and provide, to a user device associated with the particular farm, the recommended course of action.

Abstract: Data from an application is analyzed periodically in real-time using a predictive data model to predict potential application failures. Application logs are used to build the predictive data model. The predictive data model includes features created from the application logs which are good predictors of application failures. The predictive data model analyzes and provides anomaly scores for various anomalies for the real-time data collected over a time period. The anomaly scores are compared with a threshold score to predict the probability of occurrences of application failures. If there is a higher probability of occurrence of an incident of application failure, corrective actions to mitigate or reduce the probability of occurrence of the application failure are implemented.

Abstract: A task transformation architecture meets the technical challenges of geographically distributed task assignment and completion, e.g., by crowd-sourced workers who are external to any given enterprise that needs the task completed. The architecture delivers task information to the workers while maintaining confidentiality. In one aspect, the architecture determines when task descriptions include confidential information, transforms the task to remove the confidential information, and delivers the transformed task to the worker. When the worker responds with a completed project, e.g., source code for executing the transformed task, the architecture transforms the completed project into a form that restores the confidential information.

Abstract: A system for self-learning archival of electronic data may be provided. A binary classifier may identify a text segment of an electronic dataset in response to text of the electronic dataset being associated with indicators of a word model. A first multiclass classifier may generate a first classification set comprising respective statistical metrics for the datafield that each predefined identifier in a group of predefined identifiers is representative of the datafield. A second multiclass classifier may receive a context of the electronic dataset and generate a second classification set. A combination classifier may apply weight values to the first classification set and the second classification set and form a weighted classification set and select a predefined identifier as being representative of the datafield based on the weighted classification set. The processor may store, in a memory, a data record comprising an association between the predefined identifier and the datafield.

Abstract: A system creates an abstraction layer surrounding a diverse data system including multiple different databases. Data is received from data sources and ingested into the various databases according to a core model. New instances of the core model are created and added to a larger linked data model (LDM) when new data sources are added to the system. The LDM captures the linkages between different linked data objects and links across different databases. Accordingly, applications are able to access or explore the linked data stored in different databases without prior knowledge of the linking relationships.

Abstract: A system creates an abstraction layer surrounding a diverse data system including multiple different databases. Data is received from data sources and ingested into the various databases according to a core model. New instances of the core model are created and added to a larger linked data model (LDM) when new data sources are added to the system. The LDM captures the linkages between different linked data objects and links across different databases. Accordingly, applications are able to access or explore the linked data stored in different databases without prior knowledge of the linking relationships.

Abstract: A system may include first sensor to monitor first information relating a volume of information searched by a user, a second sensor to monitor second information relating to a number of requests, made by the user, to access a resource, a third sensor to monitor third information relating to a number of requests, made by the user, from different geographic locations, and a device to receive the first information, the second information, and the third information, and process the first information, the second information, and the third information in connection with the resource.

Abstract: A method and system generate test cases for applications that include User Graphical Interfaces (GUIs). The system may extract GUI information from prototype requirements (e.g., interactive wireframes), generate a screen model for each screen of the GUI by using a subset of extracted GUI information, generate an application model representing the prototype requirements by combining the screen model for each screen, and generate test cases by using the sequence of the GUICs and the event types included in the test path and a semantic knowledge base. The semantic knowledge base is generated by using the relationships between GUICs and the GUIC events.