Abstract: A detection mechanism is disclosed for identifying peers transmitting network traffic towards a cloud provider using routing prefixes that were not advertised for that peer. Once detected, an alarm condition can occur and the peer notified to remove any static route configurations. In one embodiment, a collector server computer can be used to acquire routing prefixes advertised to a peer. A second server computer can be used to obtain network traffic received from the peer. A comparison can then be made between the advertised prefixes and the network traffic being received. If network traffic is being received for unadvertised prefixes, then an alarm condition can occur. The detection mechanism can regularly inspect active traffic flows against BGP route advertisements at fixed intervals. For peers that are identified that are not in compliance with route advertisements, the alarm condition can occur for follow-up remediation.

Abstract: Techniques for anomaly detection are described. An exemplary method includes receiving one or more requests to train an anomaly detection machine learning model using feedback-based training, the request to indicate one or more of a type of analysis to perform, a model selection indication, and a configuration for a training dataset; training the anomaly detection machine learning model according to the one or more requests using the training data; performing feedback-based training on the trained anomaly detection machine learning model; and using the retrained anomaly detection machine learning model.

Abstract: A first security rule set for traffic of a compute instance run at a virtualization server is stored in response to a programmatic request. A second security rule set for traffic of a network function accelerator of the virtualization server is stored in response to another programmatic request. Prior to delivery of network messages to the compute instance or from the accelerator, compliance with the applicable security rule set is verified.

Abstract: A hybrid Bacon-Shor surface code is implemented using a fault tolerant quantum computer comprising hybrid acoustic-electric qubits. A control circuit includes an asymmetrically threaded superconducting quantum interference devices (ATS) that excites phonons in a mechanical resonator by driving a storage mode of the mechanical resonator and dissipates phonons from the mechanical resonator via an open transmission line coupled to the control circuit. The hybrid Bacon-Shor surface code only couples four phononic modes per given ATS, reducing cross-talk as compared to other systems that couple more phononic modes per ATS. Also, measurements are performed such that three parity measurements are taken between a phononic readout mode and a transmon qubit in a given syndrome measurement cycle.

Abstract: Hop counts can be determined in a variety of network segments using packet headers collected at boundaries of the segments. Agents executing on network devices are used to transmit packet header data, including a TTL budget, to a collector server computer. The collector server computer can discern signal (production flows) from noise (traceroutes and probing traffic), detecting packets that are at risk of being dropped due to TTL expiration. Alerts can be generated for packet flows with a dangerously low remaining TTL budget, which are at high risk of expiring due to operational events resulting in traffic temporarily traversing slightly longer paths. Source addresses can be identified for such packet flows and network devices through which the packet flows are traversing can be identified. Hop counts can then be computed for different network segments, such as an Internet segment, a backbone segment and a data center segment.

Abstract: Movement of an autonomously motile device may be controlled by a user device. The user device may display image data captured by a camera of the autonomously motile device; a user may provide input, such as a touch gesture on a display screen, indicating a command for the autonomously motile device to move to a location indicated by the input. The autonomously motile device determines a coordinate of the input and a time of the touch input; the autonomously motile device then determines a direction and distance of a corresponding movement.

Abstract: To achieve impact-less re-routing of traffic towards non best-paths in a network, two locator routes are originated for each network fabric: a primary locator and a secondary locator. In a steady state, the forwarding state on each router is created by recursion of endpoints identifiers through their originating location's primary locator-route. Secondary locator routes are not used in the steady state. At a desired point, a steering route is injected into the network device to redirect routing from the primary locator route to the secondary locator route. The secondary locator route has a different resultant port from the primary locator route to redirect incoming packets on a different network path.

Abstract: Systems, methods, and computer-readable media are disclosed for modeled advertisement conversion attributions. An example method may include receiving first input data comprising first advertisement impression data and first advertisement conversion data, wherein the first input data includes one or more user identifiers associated with both the advertisement impression data and advertisement conversion data. The example method may also include training one or more machine learning models using the first input data. The example method may also include receiving second input data comprising second advertisement impression data, wherein user identifiers are unavailable for the second input data. The example method may also include determining, using the one or more machine learning models, second predicted conversion data associated with the second input data.

Abstract: Execution status of managed time series processing tasks may be tracked. Status of a time series processing task that operations on different portions of a time series may be respectively captured. A request for the status of one of the portions of the time series with respect to the time series processing task may be received. The status may be identified and returned. For failed tasks, a failure reason may be generated by the time series processing system and included in a response with a failure status.

Abstract: Descriptors of machine learning tasks to be used to respond to analysis requests, indicating acceptable categories of runtime environments for the tasks and metrics to be collected from the tasks, are received via programmatic interfaces. In response to an analysis request, an orchestrator receives results from individual tasks as they become available, provides the results to other tasks, and causes a response to the request to be prepared using results from at least a subset of the tasks. Metrics collected from the tasks, and a visual representation of the tasks indicating their runtime environments are presented.

Abstract: Representations of sets of descriptors of reference objects are stored in a repository, with individual descriptors including information about entities identified in the reference objects. In response to a request to extract content from a particular data object, a reference object which satisfies a similarity criterion with respect to the particular data object is identified from the repository using the descriptors. A structural comparison of the particular data object and the reference object is performed to determine an entity related to another entity identified in the particular data object.

Abstract: Methods, systems, and computer-readable media for read-only data store replication to edge locations are disclosed. A read-only data store is replicated to an edge server. A request for content is received at the edge server from a client device. The content is sought from a content cache at the edge server or from an origin server coupled to the edge server. Processing of the request is initiated, comprising encountering an event. The event is associated with a function specified by a customer, and the function specifies the read-only data store as input. The function associated with the event is executed at the edge server, including retrieval of data from the data store. The content is generated based at least in part on execution of the function. The content is sent from the edge server to the client device.

Abstract: A service implemented at a first isolated virtual network of a provider network is added to a database of privately-accessible services. Configuration changes that enable network packets to flow between the first isolated virtual network and a second isolated virtual network without utilizing a network address accessible from the public Internet are implemented. Service requests originating at the second isolated virtual network are transmitted to the first isolated virtual network via private pathways of the provider network. Metrics corresponding to service requests directed from the second isolated network to the service are collected and provided to the respective owners of one or both isolated virtual networks.

Abstract: For a given cross-data-store transaction request at a storage service, a coordinator transmits respective voting transition requests to a plurality of log-based transaction managers (LTMs) configured for the respective data stores to which writes are directed in the transaction. The LTMs transmit responses to the coordinator based on data-store-specific conflict detection performed using contents of the voting transition requests and respective data-store-specific state transition logs. The coordinator determines a termination status of the cross-data-store transaction based on the LTMs' responses, and provides an indication of the termination status to the LTMs.

Abstract: A speech recognition system utilizing automatic speech recognition techniques such as end-pointing techniques in conjunction with beamforming and/or signal processing to isolate speech from one or more speaking users from multiple received audio signals and to detect the beginning and/or end of the speech based at least in part on the isolation. Audio capture devices such as microphones may be arranged in a beamforming array to receive the multiple audio signals. Multiple audio sources including speech may be identified in different beams and processed.

Abstract: A database stores a document as a plurality of encrypted records, where each record is indicative of an incremental change to the state of the document, and encrypted using a document key. The document key is stored with encryption decryptable using a group key, and the group key is stored with encryption decryptable using a first access key. In response to a request to rotate from the first access key to a second access key, the database decrypts the group key using the first access key, a stores a group key re-encrypted with the second access key.

Abstract: Techniques for updating a machine learning (ML) model are described. A device or system may receive input data corresponding to a natural or non-natural language (e.g., gesture) input. Using a first ML model, the device or system may determine the input data corresponds to a data category of a plurality of data categories. Based on the data category, the device or system may select a ML training type from among a plurality of ML training types. Using the input data, the device or system may perform the selected ML training type with respect to a runtime ML model to generate an updated ML model.

Abstract: A cable guide can include a first bracket and a second bracket. The first bracket can be configured to be coupled with a reference body The second bracket can be configured to be coupled with a moveable body moveable relative to the reference body. For example, the moveable body may correspond to a slidable server or other appliance receivable in a rack, and the reference body may correspond to a tray in the rack. A conduit structure may extend between the first bracket and the second bracket and include a first conduit laterally joined along a juncture to a second conduit. The first conduit and the second conduit may be separately serviceable. For example, the first conduit and the second conduit may be at least one of releasably separable along the juncture or separately openable along opposite sidewalls of the conduit structure.

Abstract: Described is a method for determining when to transition devices between different states based on determined potential activity in an area near the devices. When the potential for activity near an input device is below a threshold, the device is maintained in an inactive state. When the potential for activity near the device exceeds the threshold, the device is transitioned to an active state before the potential activity can occur near the device. Likewise, when the device is in an active state, the implementations described herein provide the ability to determine when to begin and end transmission of data from the device to a remote computing resource for processing. For example, obtained video may be processed locally to determine if an activity is occurring. If an activity is occurring, relevant data is sent to a remote computing resource to determine if an action has been performed during the activity.

Abstract: A network-accessible machine learning service is provided herein. For example, the network-accessible machine learning service provider can operate one or more physical computing devices accessible to user devices via a network. These physical computing device(s) can host virtual machine instances that are configured to train machine learning models using training data referenced by a user device. These physical computing device(s) can further host virtual machine instances that are configured to execute trained machine learning models in response to user-provided inputs, generating outputs that are stored and/or transmitted to user devices via the network.