Abstract: A feature deployment service of a provider network may deploy feature processing units (FPUs) to implement data processing features at both a provider network and edge devices. The use of FPUs may allow a client to use new features at the edge, without delays due to compliance/testing or software upgrades. An FPU includes a model and compute logic that are used to implement a data processing feature. A feature processing service deploys the FPU to an FPU engine at the provider network and also deploys the FPU to edge devices of the client's network that each include an edge FPU engine. The FPU engine at the provider network and the edge FPU engine at each edge device conform to a common specification/API, allowing deployment and use of the same FPU/data processing features at both the cloud and the edge.

Abstract: Techniques for adaptive network connectivity in a cloud provider network are described. A managed networking service obtains metadata associated with an application deployed in the cloud provider network and uses the metadata to construct a graph including application components and network components. Network flows are identified from the metadata and used to construct flow metadata that is linked to paths of the graph. The flow metadata is further enhanced with capability information for the network components on the path. The graph can be efficiently analyzed to identify alternative, superior networking configurations for the application.

Abstract: A system can be configured to provide an advertiser budget control system designed to work within the confines of a privacy preserving content delivery environment intended to reduce or eliminate third-party cookies. This system uses a control system, a PID controller and duty cycle, to control budget delivery to place content within a browser. The control system can be used to stably deliver budget with real-time delivery rate updates while also preventing over-spending of budget.

Abstract: Techniques for using establishing a communication session using a third-party (3P) communications service are described. When a request is received to integrate the 3P service with a first-party (1P) service, a username and password associated with the 3P service are sent to it, and a contact list associated with the 3P service is received in return. When a user of a first device sends a request to communicate with a recipient, if the recipient is represented in the 3P contact list, the system sends a request to the second communication system to establish a communication session.

Abstract: A compute channel having a compute pipeline of compute stages can be configured using a configuration pipeline with a control table and a datapath table. The control table stores control entries corresponding to respective microoperations, and each control entry includes control information for the compute channel. A datapath table stores datapath configuration entries corresponding to respective microoperations, and each datapath configuration entry has a datapath configuration that includes computational circuit block configurations to configure respective computational circuit blocks in the compute pipeline of the compute channel. Control logic can issue a microoperation to the compute channel by configuring the compute channel according to the control information of the microoperation obtained from the control table, and by inputting the datapath configuration of the microoperation obtained from the datapath table into the configuration pipeline of the compute channel.

Abstract: Methods and apparatus for portable network interfaces to manage authentication and license enforcement. A system may include a plurality of resource instances including a producer instance configured to implement a network-accessible service, and an authentication coordinator. The coordinator may assign an interface record to the service, wherein the interface record comprises an IP address and a set of security properties. The coordinator may configure the security properties to allow a client to request an attachment of the interface record to a selected resource instance, such that the selected resource instance is enabled to transmit network messages from the IP address using one or more physical network interfaces of the selected resource instance. The producer resource instance initiates authentication operations for the service, including at least one authentication operation based on the IP address of the interface record.

Abstract: Described is a system and method for routing output information to one or more of a plurality of output devices. In one implementation, output information that includes information to be presented and a location information identifying where the output information is to be presented may be generated by an output host. The output information is received by an output router that determines, based on the location information, an output device and routes the output information to the output device for presentation.

Abstract: Systems and techniques are described for motion detection. In various examples, a camera device may initiate execution of a non-computer vision-based motion detection process. In some examples, the camera device may initiate execution of a computer vision-based classification process during the execution of the non-computer vision-based motion detection process. In various examples, first result data may be determined by the non-computer vision-based motion detection process. In various examples, the execution of the computer vision-based classification process may be terminated based at least in part on the first result data.

Abstract: Described herein is a system for enabling a user to perform complex goals using multiple skills/applications of an intelligent assistant device. Skills may register as consumers of an action or providers of an action, and the consumer skills may be configured to invoke provider skills to perform actions. The system receives a request to perform an action from a skill along with some action data. The system validates the action data, selects another skill to perform the action, and forwards the request to the selected skill to perform the action.

Abstract: A plurality of security rule processing nodes is configured for network traffic of a set of sources and destinations. Respective subsets of configuration information of the sources and destinations, including security rules, are transmitted to the nodes. Respective addresses of at least a subset of the nodes are transmitted to a packet processing intermediary. The intermediary requests evaluation of applicable security rules with respect to packet flows by selected nodes prior to initiating routing actions for packets of the flows.

Abstract: Methods, systems, and computer-readable media for unified search and navigation for cloud-based services are disclosed. A unified search system receives textual input entered using a search interface. The search interface is displayed in a user interface concurrently with a management console for a cloud provider network. Based (at least in part) on the textual input, the system performs a search using one or more indexes usable to determine service names and descriptive information for the services. The system generates search results comprising a portion of the service names and a portion of the descriptive information. The search results are displayed using a search results overlay that is displayed concurrently with at least a portion of the management console. The system receives additional input entered using the overlay and comprising a selection of a particular search result. Responsive to the selection, additional information associated with the particular search result is displayed.

Abstract: Techniques for configuring a speech processing system with a privacy mode that is associated with the identity of a user that activated the privacy mode are described. A user may speak an indication to have the speech processing system activate a privacy mode. When such an indication is detected by the speech processing system, the speech processing system determines an identity of the user, determines a unique system identifier associated with the user, and generates a privacy mode flag. The speech processing system then associates the privacy mode flag with the user's unique system identifier. The privacy mode flag indicates to components of the speech processing system that any data related to processing of the user's utterances should not be sent to long term storage, thus causing various components of the system to delete data once the respective component is finished processing with respect to an utterance of the user.

Abstract: Anomalous interactions with a website or other system may be detected based on the types of characteristics associated with previous anomalous interactions, independent of the values associated with those characteristics. Historical data is used to determine characteristics of interactions, each characteristic having a type and a value. For historical interactions in which a set of characteristic values are associated with a potentially anomalous interaction, the characteristic types are analyzed in subsequent interactions. If values for those characteristic types occur at a frequency greater than a threshold frequency for a set of subsequent interactions, this may indicate that the interactions are anomalous. Use of the characteristic types for this purpose, rather than historical characteristic values, enables anomalous interactions to be detected independent of the characteristic values associated with the interactions.

Abstract: An agent running on an IoT device of a client's network may receive a default password from a provider network and use the received default password to determine whether the password assigned to the IoT device has been changed from the default password to a different one. The agent may retrieve a salt string, a hashing algorithm, and a hashed string from a password database of the IoT device, combine the salt string with the received default password to generate a salted default password, and apply the hashing algorithm to the salted default password to generate a new hashed string. The agent may then compare the new hashed string to the hashed string retrieved from the password database. If they match, then the agent sends an indication to the provider network that the default password is still assigned to the IoT device.

Abstract: The present disclosure generally relates to systems and methods for initiating secure network connections at a first computing device without blocking operation of a real-time processor that handles latency-sensitive input/output (I/O) operations. In some implementation examples, the real-time processor obtains a request to establish a secure connection with a second computing device over a network. The real-time processor can enqueue into an inter-processor queue a request for performing a cryptographic operation. An additional processor can obtain the request and perform the cryptographic operation. After completing the cryptographic operation, the additional processor can enqueue information indicating the cryptographic operation is completed into the inter-processor queue. The real-time processor can obtain the information from the inter-processor queue and use the information to establish the secure connection with the second computing device.

Abstract: A neural text-to-speech system may be configured to emphasize words. Applying emphasis where appropriate enables the TTS system to better reproduce prosodic characteristics of human speech. Emphasis may make the resulting synthesized speech more understandable and engaging than synthesized speech lacking emphasis. Emphasis may be manually annotated to, and/or predicted from, a source text (e.g., a book). In some implementations, the system may use a generative model such as a variational autoencoder to generate word acoustic embeddings indicating how emphasis is to be reflected in the synthesized speech. A phoneme encoder of the TTS system may process phonemes to generate phoneme embeddings. A decoder may process the word acoustic embeddings and the phoneme embeddings to generate spectrogram data representing the synthesized speech.

Abstract: In networks, some communication links may be provided as part of a network overlay. Technologies are disclosed for monitoring/analyzing targeted networks (e.g., network overlays) using probe packets sent from outside of the targeted networks/overlays. The probe packets are configured to include a stack of headers, including indications of UDP source ports, which are respectively examined in order at network devices in the targeted network to determine a routing scheme to utilize to route the packet.

Abstract: Technologies are disclosed for shortening and/or minimizing service interruptions. An incident service executing within a service provider network is used to detect an incident that has caused a service interruption and performs operations to assist in resolving the service interruption. The incident service may identify resources (e.g., computing resources, individuals, . . . ) to triage and remediate the service interruption. For instance, the incident service may provide information to one or more users of a customer experiencing a service interruption to assist in guiding the user(s) to address one or more problems to assist in resolving the service interruption. The information may include information such as providing one or more recommendations to configure one or more services, such as one or more actions to perform (e.g., a step-by-step runbook).

Abstract: Interruptions in an ordered replication stream can be received from in a database. A database instance of the ordered replication stream may detect missing log records and then evaluate log records that are subsequently received to determine whether to update a portion of an in-memory data structure for performing database requests using a comparison of sequence numbers of the last update corresponding to the portion of the in-memory data structure indicated in the log record and the last update recorded for the portion of the in-memory data structure. For comparison indicating valid portions, the log record can be used and for comparison indicating invalid portions, the portion of the in-memory data structure can be made unavailable.

Abstract: Systems and methods relating to a millimeter wave radio-frequency (RF) sleep monitoring device are described. The device includes a surface transparent to RF signals through which a radar device enclosed in a housing transmits RF signals. An antenna array is enclosed within the housing and is oriented at a non-zero angle with respect to a vertical axis of the device. The antenna array receives the reflected RF signals through the surface. The reflected RF signals are used to generate sleep monitoring data such as a respiratory rate or motion data associated with a user.