Abstract: Systems and methods are provided for implementing a multi-service file system for a hosted computing instance via a locally-addressable secure compute layer. Software within the instance can submit file operations to the secure compute layer, which the secure compute layer can translate into calls to one or more network-accessible storage services. To provide a multi-service file system, the secure compute layer can obtain mapping data mapping file system objects within the virtualized file system to different network-accessible storage services. On receiving a file operation, the secure compute layer can determine one or more network-accessible storage services corresponding to the file operation, and submit appropriate calls to the one or more network-accessible storage services.

Abstract: Availability zone and region recovery are described. For an availability zone (AZ), a recovery availability zone (rAZ) may be identified based on available computing capacity of the recovery availability zone and geographic proximity of the availability zone relative to the recovery availability zone. In an instance in which the availability zone is impacted in which at least one of hardware and software of the availability zone is not fully operational, a virtual private cloud (VPC) is generated that establishes a peered connection between the availability zone and the recovery availability zone. A service is executed in the recovery availability zone, permitting any other services executing in the availability zone to invoke the service and become partially or fully operational.

Abstract: An optical transceiver includes a built-in optical switch to switch between diverse fiber paths in switches in a datacenter or in switches between two datacenters. The built-in optical switch can be used to switch between racks in a datacenter to increase capacity for any rack that requests it. A controller, which receives a signal from a server computer in one of the racks, can be external to the optical transceiver or within the optical transceiver. In either case, the server computer can be provided with additional bandwidth when needed. For connections between datacenters, the built-in optical switch allows for optical line protection, but without the need for a splitter circuit, which incurs a significant power loss and requires a more expensive transceiver. Consequently, the built-in optical switch within an optical transceiver can be used in a variety of contexts to increase efficiency and reduce overall costs for network devices.

Abstract: Described are systems and methods for monitoring, detecting, and/or protecting various systems of an aerial vehicle, such as an unmanned aerial vehicle (UAV). Embodiments of the present disclosure can provide a multi-tiered system to provide monitoring, detection, and/or initiation of protection protocols in response to detected faults in connection with the electronics associated with UAV systems, such as the motor drive and/or control systems that may drive the propulsion systems of the UAV.

Abstract: Remote Triggered Black Holes (RTBHs) can be precisely placed on networks that are not directly physically connected to a target of an attack. A network source of a potential attack can be determined. A path between the network source and the target can be identified, and a determination can be made as to which networks along that path subscribe to an attack mitigation service. From multiple identified subscriber networks, a subscriber network can be identified that is determined to be appropriate for placement of a black hole to mitigate the attack. Once selected, the identified network can receive attack information and acknowledge placement of the black hole. The subscriber network can then begin discarding traffic for the attack target. A subscriber-owned list of network prefixes can be reviewed before allowing RTBH injection for a corresponding address space.

Abstract: Data is encoded to be incrementally authenticable. A plaintext is used to generate a ciphertext that comprises a plurality of authentication tags. Proper subsets of the authentication tags are usable to authenticate respective portions of plaintexts obtained from the ciphertext. Portions of the plaintext can be obtained and authenticated without decrypting the complete ciphertext.

Abstract: Techniques for building, validating, and utilizing custom database software in a shared management environment are described. A database customization service allows users to provide database installation files as part of a configuration to generate a custom database engine version. The creation of custom database engine versions may be governed by policy, and the database customization service may provide recommendations for creating custom database engine versions according to various criteria. The custom database engine version can be built, and its functionality and correctness verified. Users may launch database instances using these custom database engine versions that can be managed under a shared management scheme where both users and the database customization service can perform host-level management.

Abstract: A latch mechanism for a sidewalk delivery robot or container includes a plunger that extends to engage a latch body on a lid to lock the lid closed, a cable for pulling the plunger out of engagement with the lid to free the lid for opening, and a temporary catch mechanism for holding the plunger in the retracted position during an initial phase of the opening process. The catch, and therefore the plunger, is released when a forward-extending release arm of the catch is engaged by the latch body during the opening process to pivot the catch. A slot hinge mechanism includes a spring piston to guard against finger pinching and a slider that is attached to the piston of the latch mechanism by the cable. Actuation of the hinge mechanism retracts the piston to its retracted position.

Abstract: Systems and methods are described herein for implementing a hybrid codec to compress and decompress image data using both lossy and lossless compression. In one example encoding process, it may be determined whether a first block of pixels of a frame of image data contains an edge. A type of compression by which to encode the first block may be selected based on that determination. The first block may be compressed using the selected type of compression. At least one second value associated with the first block of pixels may be set to indicate at least oof the compressed value or the type of compression used to compress the first block.

Abstract: Methods, systems, and computer-readable media for auto-tuning permissions using a learning mode are disclosed. A plurality of access requests to a plurality of services and resources by an application are determined during execution of the application in a learning mode in a pre-production environment. The plurality of services and resources are hosted in a multi-tenant provider network. A subset of the services and resources that were used by the application during the learning mode are determined. An access control policy is generated that permits access to the subset of the services and resources used by the application during the learning mode. The access control policy is attached to a role associated with the application to permit access to the subset of the services and resources in a production environment.

Abstract: Disclosed are various embodiments for inferring brand similarities using graph neural networks and selection prediction. In one embodiment, a brand-to-brand graph is generated indicating similarities between a set of brands according to at least one of: click-through data or conversion data. Using a first graph neural network (GNN) tower, the brand-to-brand graph is analyzed to determine brand similarities among a first brand identified from a search query and a first set of other brands. Using a second GNN tower, the brand-to-brand graph is analyzed to determine brand similarities among a second brand and a second set of other brands. A level of similarity between the first brand and the second brand is determined based at least in part on an output of the first GNN tower and an output of the second GNN tower.

Abstract: A data service implements a configurable data compressor/decompressor using a recipe generated for a particular data set type and using compression operators of a common registry (e.g., pantry) that are referenced by the recipe, wherein the recipe indicates at which nodes of a compression graph respective ones of the compression operators of the registry are to be implemented. The configurable data compressor/decompressor provides a customizable framework for compressing data sets of different types (e.g., belonging to different data domains) using a common compressor/decompressor implemented using a common set of compression operators.

Abstract: Various embodiments of systems and methods for providing virtualized (e.g., serverless) broker clusters for a data streaming service are disclosed. A data streaming service uses a front-end proxy layer and a back-end broker layer to provide virtualized broker clusters, for example in a Kafka-based streaming service. Resources included in a virtualized broker cluster are monitored and automatically scaled-up, scaled-down, or re-balanced in a way that is transparent to data producing and/or data consuming clients of the data streaming service.

Abstract: Systems and methods for sender profile and/or recipient profile disambiguation and/or confirmation are disclosed. In instances where a sender profile is not indicated by a user sending a communication from a communal device, heuristic data may be utilized to infer the sender profile. Similar heuristic data may also be used when selection of the sender profile is associated with a low confidence level. Heuristic data may also be used to infer the recipient profile when the user does not indicate the recipient profile or when selection of the recipient profile is associated with a low confidence. Various confirmations may result from the sender and recipient profile disambiguation.

Abstract: Methods, systems, and computer-readable media for tracing service interactions without global transaction identifiers are disclosed. A service monitoring system receives an event message from a first service in a service-oriented system. The event message comprises one or more elements of data from a body of a service request from an upstream service. The first service initiates a sub-task associated with the service request. The service monitoring system receives one or more additional event messages from one or more additional services. The additional event message(s) comprise one or more additional elements of data from one or more additional service requests associated with one or more additional sub-tasks. The service monitoring system determines, based (at least in part) on the element(s) of data in the event message and the additional element(s) of data in the additional event message(s), that the sub-task and the additional sub-task(s) are associated with a higher-level task.

Abstract: Systems and methods for configuring a virtual machine provided by a remote computing system based on the availability of one or more remote computing resources and respective corresponding prices of the one or more remote computing resources are disclosed. Users are presented with an interface that allows for selection of individual remote computing resources to be included in a custom-configured virtual machine. Also, a customized corresponding price is determined for the custom-configured virtual machine based on user selections and current availability of the selected remote computing resources to be included in the custom-configured virtual machine.

Abstract: Apparatus and methods are disclosed herein for remote, direct memory access (RDMA) technology that enables direct memory access from one host computer memory to another host computer memory over a physical or virtual computer network according to a number of different RDMA protocols. In one example, a method includes receiving remote direct memory access (RDMA) packets via a network adapter, deriving a protocol index identifying an RDMA protocol used to encode data for an RDMA transaction associated with the RDMA packets, applying the protocol index to a generate RDMA commands from header information in at least one of the received RDMA packets, and performing an RDMA operation using the RDMA commands.

Abstract: Learning iterations, individual ones of which include a respective bucket group selection phase and a class boundary refinement phase, are performed using a source data set whose records are divided into buckets. In the bucket group selection phase of an iteration, a bucket is selected for annotation based on output obtained from a classification model trained in the class boundary refinement phase of an earlier iteration. In the class boundary refinement phase, records of buckets annotated as positive-match buckets for a target class in the bucket group selection phase are selected for inclusion in a training set for a new version of the model using a model enhancement criterion. The trained version of the model is stored.

Abstract: Systems, devices, and methods are provided for processing images using machine learning. Features may be obtained from an image using a residual network, such as ResNet-101. Features may be analyzed using a classification model such as K-nearest neighbors (K-NN). Features and metadata extracted from images may be used to generate other images. Templates may be used to generate various types of images. For example, assets from two images may be combined to create a third image.