Abstract: A decoy network-based service uses a decoy credential to lure an attacker to access the decoy network-based service, and monitors the attacker's activity with respect to the decoy network-based service to determine the attacker's motivation. In various examples, a decoy credential is published on an Internet-accessible site, and a system that provides a network-based service (e.g., a service provider network) subsequently receives an access request from a computing device that includes the decoy credential. Based on the decoy credential, the computing device may be provided access to a decoy network-based service, and application programming interface (API) calls made by the computing device may be routed through a decoy control plane. The data relating to the API calls may be stored and analyzed to determine a motivation of the attacker, which may be used in various downstream applications to improve security for customers of the network-based service.

Abstract: Systems and methods related to detecting characteristics of images and accentuating or manipulating characteristics of images are described. For example, a principal color of an image may be identified, a complement color may be determined based on the principal color, and the complement color may be applied to the image to accentuate the image. In this manner, an object of interest represented in the image may be emphasized and displayed in a more visually attractive manner. In addition, edges of an image may be evaluated to determine if one or more visibly cropped edges are present within the image, the image may be further cropped to remove the visibly cropped edges, and/or the image may be shifted or magnified based on such cropped edges. In this manner, an object of interest represented in the image may be magnified and emphasized, and visually distracting elements may be removed from the image.

Abstract: A conveyor system for processing items, such as manufacturers' products or boxes, from a three-dimensional arrangement to a two-dimensional arrangement includes inclined and declined conveyors. The inclined conveyor may include vacuum through perforations in the belt. A collimating conveyor includes parallel belts that operation at different speeds to move the items laterally via shear forces.

Abstract: Systems and methods for determining strategy modes for autonomous vehicles are described. An autonomous vehicle may detect aspects of other vehicles and aspects of the environment using one or more sensors. The autonomous vehicle may then determine strategy modes of the other vehicles, and select a strategy mode for its own operation based on the determined strategy modes and an operational goal for the autonomous vehicle. The strategy modes may include an uncoupled strategy mode, a permissive strategy mode, an assistive strategy mode, and a preventative strategy mode. The autonomous vehicle may further determine elements in the environment and topological constraints associated with the environment, and select the strategy mode for its own operation based thereon.

Abstract: Providing an electronic document for consumption in a first mode of operation wherein a prominent component of the content of the electronic document is presented at a first resolution. In a second mode of operation, a modified version of the prominent component having a lower resolution than the first resolution is generated.

Abstract: Systems and methods for pre-flight fabrication and/or assembly of various configurations of aerial vehicles are described. Operations of various configurations of aerial vehicles may be analyzed using models based on various inputs, which inputs may be related to routes, environments, vehicles, components, or other factors. A particular configuration may be selected for a selected route and associated task based at least in part on a desired optimization parameter. Then, the particular configuration of the aerial vehicle may be fabricated and/or assembled to complete the associated task via the selected route.

Abstract: This disclosure describes, in part, voice-controlled light dimmers that act as voice-controlled endpoints at which users may provide voice commands. These light dimmers include a front panel module coupled to a power module using a hardware interface. The front panel module may receive input from a user indicating commands for controlling appliances, and send communications to the power module using the hardware interface to control the appliances. In some examples, the communications involve encrypted data sent using an inter-integrated circuit (I2C) protocol using the hardware interface to an electrically isolated power module. The power provided to the appliances may be controlled by the power module of the voice-controlled light dimmer.

Abstract: Techniques for instantiating container instances from a pool of available container instances are described herein. An instance type is determined from a container description such that the instance type satisfies the resource parameters in the container description. An instance of the instance type is selected from a pool of running container instances, the instance is provisioned, and a container is instantiated on the instance.

Abstract: Systems and methods are described for management of data transmitted between computing devices in a communication network. An administrative component can configure one or more devices in the communication path of messages to be exchanged by devices to interpret codes embedded in the communication messages. A receiving device can review incoming messages for one or more processing codes or instructions that are embedded in the portion of the communication typically utilized solely to identify the subject matter of the communication, generally referred to as the topic portion of the communication. The receiving devices can then process the embedded codes to determine how the communication message will be routed or otherwise processed.

Abstract: Techniques for layout-agnostic clustering-based classification of document keys and values are described. A key-value differentiation unit generates feature vectors corresponding to text elements of a form represented within an electronic image using a machine learning (ML) model. The ML model was trained utilizing a loss function that separates keys from values. The feature vectors are clustered into at least two clusters, and a cluster is determined to include either keys of the form or values of the form via identifying neighbors between feature vectors of the cluster(s) with labeled feature vectors.

Abstract: Methods, systems, and computer-readable media for placement optimization for virtualized graphics processing are disclosed. A provider network comprises a plurality of instance locations for physical compute instances and a plurality of graphics processing unit (GPU) locations for physical GPUs. A GPU location for a physical GPU or an instance location for a physical compute instance is selected in the provider network. The GPU location or instance location is selected based at least in part on one or more placement criteria. A virtual compute instance with attached virtual GPU is provisioned. The virtual compute instance is implemented using the physical compute instance in the instance location, and the virtual GPU is implemented using the physical GPU in the GPU location. The physical GPU is accessible to the physical compute instance over a network. An application is executed using the virtual GPU on the virtual compute instance.

Abstract: A virtualization service that hosts multiple guests may provide utilities for use in protecting sensitive or secret information from timing side-channel attacks by obscuring accesses to data structures that have been designated as potential targets of such attacks. The service may provide a compiler or analysis tool that identifies data structures within an application that contain, or that are indexed using, sensitive or secret information. The compiler may modify the application code (or an executable representation thereof) to obscure accesses to particular elements in the data structures. For example, the layout or indexing of a sensitive data structure may be scrambled during execution, or elements of multiple data structures may be interleaved within a single, merged data structure. The scrambling may be performed using an unpredictable address translation function (e.g., one that is parameterized during initialization using a random number obtained at runtime), which may be subsequently modified (e.g.

Abstract: Generally described, one or more aspects of the present application correspond to techniques for modifying volume encryption status, either by creating an encrypted copy of an unencrypted source volume or by re-encrypting the replica with a different key than the source volume. This can be accomplished using an intermediary transform fleet that stores the encryption key(s) and performs encryption (and decryption, in cases where the source is encrypted). Further, these techniques can implement a state refresh for any client attached to the volume in order to equip the client to handle the different encryption state of the encrypted volume.

Abstract: Bypass flow may be enabled for network traffic between devices. A source device may include a flow identifier in an outbound packet that is sent to a destination device. An inbound packed sent from the destination device may include information that describes a network path between the source device and the destination device. Subsequent outbound packets bound for the destination device may be rewritten based on the information describing the network path to bypass one or more network devices in the network path.

Abstract: A request to copy at least a portion of a first network that includes a first set of devices is received, the request including one or more filtering criteria, with at least one of the one or more filtering criteria specifying a tag assigned to a device of the first set of devices. At least the portion of the first network is copied by causing the system to create, according to the one or more filtering criteria, a second network by causing a second set of devices to be configured to be duplicative of devices of the first set of devices that are assigned the tag specified by the filtering criteria.

Abstract: Power management of a routing table, which comprises a plurality of hash tables, is provided by supporting various power domain configurations. Each power domain configuration can be associated with a different number of power domains than other power domain configurations. Each power domain can add vertical capacity to the entire routing table by adding a fixed number of buckets to each of the hash tables. Efficient power management can be achieved by switching between a lower power domain configuration and a higher power domain configuration during runtime based on the dynamic load conditions.

Abstract: A data store manager of a multi-data-store storage system detects an error condition associated with applying a state change indicated in a particular journal entry of the storage system to a first data store. A first redaction entry inserted in the journal at some point after the particular entry is identified. The first redaction entry indicates the particular entry as a redaction target. After verifying that the journal does not include another redaction entry targeting the first redaction entry, processing of the particular entry is terminated and processing of later-inserted entries can proceed.

Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for latency detection for streaming video. Example methods may include receiving a request to determine a time to first frame for video content, determining a streaming service and a playback device associated with the request, and determining a time at which playback of the content is initiated. Example methods include capturing a playback sequence of the video content, classifying individual frames of the playback sequence, where each classification is associated with a probability value indicative of a likelihood the frame is a first frame, analyzing classifications of the individual frames, and determining, based at least in part on the analysis of the classifications of the individual frames, the time to first frame for the video content.

Abstract: Distributed database management systems may perform range queries over the leading portion of a primary key. Non-random distribution of data may improve performance related to the processing of range queries, but may tend to cause workload to be concentrated on particular partitions. Groups of partitions may be expanded and collapsed based on detection of disproportionate workload. Disproportionate write workload may be distributed among a group of partitions that can subsequently be queried using a federated approach. Disproportionate read workload may be distributed among a group of read-only replicated partitions.