Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Methods, systems and computer program products for recommendation systems. Embodiments commence by gathering a set of pathnames that refer to content objects of a collaboration system. A tokenizer converts at least some of the pathnames into vectors. The vectors comprise hierarchical path components such as folder names or file names, which vectors are labeled with an indication as to whether or not the folder or file referred to in a particular vector had been clicked on by one or more users. Some portion of the labeled vectors are used to train a predictive model. Collaboration recommendations may be generated that pertain to security-related recommendations.

Abstract: Methods, systems, and computer program products for automated document generation within a collaboration system. Multiple components are operatively interconnected to carry out automated document generation operations. Collaboration activity limitations are enforced over newly-generated documents. The document generation process produces newly-generated documents and other outputs that are stored in the collaboration system. Operational elements of the collaboration system are able to access the generated document and other document generation system outputs to perform content analysis. Based at least in part on results of the content analysis, characteristics of the generated document and characteristics of the corresponding document system I/O, the collaboration system assigns and/or modifies access parameters of the newly-generated document and its metadata. The access parameters control ongoing enforcement of document handling policies.

Abstract: Methods, systems, and computer program products for automated document generation within a collaboration system. Multiple components are operatively interconnected to carry out automated document generation operations. Collaboration activity limitations are enforced over newly-generated documents. The document generation process produces newly-generated documents and other outputs that are stored in the collaboration system. Operational elements of the collaboration system are able to access the generated document and other document generation system outputs to perform content analysis. Based at least in part on results of the content analysis, characteristics of the generated document and characteristics of the corresponding document system I/O, the collaboration system assigns and/or modifies access parameters of the newly-generated document and its metadata. The access parameters control ongoing enforcement of document handling policies.

Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: Systems and methods of real time notification of activities that occur in a web-based collaboration environment are disclosed. In one aspect, embodiments of the present disclosure include a method, which may be implemented on a system, for selecting a recipient of a notification an activity according to criteria determined based on a workspace in which the activity was performed in the online collaboration platform and/or sending the notification of the activity to the recipient such that the recipient is notified in real time or near real time to when the activity occurred.

Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for content management systems. A security threat management facility (STMF) is identified. The STMF contains a database of threat assessment values in addition to further information pertaining to one or more users. Concurrent with operation of the STMF, a content management system (CMS) tracks user-initiated content object interaction events. Based on analysis of the tracked user-initiated content object interaction events, a further threat assessment value is generated by the CMS. Such a further threat assessment is determined based on one or more user-to-user relationships or one or more user-to-file relationships as determined at the content management system. An augmented threat assessment is formed using both the threat assessment values of the STMF with the further threat assessment value from the CMS.

Abstract: Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for content management systems. Content objects of a content management system (CMS) are managed from original creation through to final disposition (e.g., deletion). The CMS communicates with a security threat management facility (STMF). In operation, the STMF establishes a first set of security parameters corresponding to information derived from packet inspection, whereas the CMS establishes a second set of security parameters corresponding to information derived at least in part by analysis of user activities or contents of the content object. A security perimeter is formed by combining the first set of security parameters and a second set of security parameters. Risks or vulnerabilities corresponding to the content object are minimized by choosing the lower of any two compared parameters to define a lower risk perimeter for the content object.

Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Embodiments are directed to distributing records among storage partitions by maintaining a table of records. The table of records can be indexed based on an original partitioning key in the table of records. A plurality of counters can be initialized with each counter associated with a sub-range in a total range of key values for a secondary index partitioning key. Each record of the table of records can be read and a count of records in the associated sub-range can be accumulated in each counter. The number of records per partition can be determined based on the total number of records in the total range of key values and the number of available partitions and the records can be distributed to the available partitions in the storage system based on the number of records in each sub-range.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: Management of web conference assets in a content management system. At the conclusion of a web conferencing session, an event is raised at the content management system. Various web conference assets (e.g., recordings) and web conference parameters are analyzed in conjunction with content management system metadata. Based on the analysis, one or more actions to perform on the web conference assets are determined. The content management system metadata may include user profile information of at least one web conference participant. Rules and/or a classification model that considers then-current conditions at the content management system are used singly, or in combination, to determine action characteristics and/or labels such as a retention period or security classifications to apply to the web conference assets. The web conference assets are stored in a hierarchical directory at the content management system. The hierarchy of the directory is derived from aspects of the web conferencing facility.

Abstract: Methods, systems and computer program products for recommendation systems. Embodiments commence by gathering a set of pathnames that refer to content objects of a collaboration system. A tokenizer converts at least some of the pathnames into vectors. The vectors comprise hierarchical path components such as folder names or file names, which vectors are labeled with an indication as to whether or not the folder or file referred to in a particular vector had been clicked on by one or more users. Some portion of the labeled vectors are used to train a predictive model. Another portion of the vectors are used to validate the predictive model. When the model exhibits sufficient precision and recall, the predictive model is then used to predict the probability that a particular user would have an interest in a particular folder or file. The folder name or file name is presented as a collaboration recommendation.

Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates associated with content objects taken from the plurality of content objects. When a document template is identified, template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: A recommendation system integrated with a content management system (CMS). The CMS stores instances of shared content objects and coordinates user interactions by and between a plurality of CMS users. Shared content objects are divided into a plurality of portions, after which any user interactions over the various portions of the content object are observed and analyzed. User interest inferences are drawn from analysis of the observed user interactions taken user over respective particular portions of the content object. Based on the inferred user interests, fine-grained recommendations are formed and propagated. Some fine-grained recommendations refer to further content objects (e.g., content objects of different types). Some fine-grained recommendations are propagated to other CMS users (e.g., to a plurality of CMS users that are related in some way). The fine-grained recommendations refer to one or more specific portions of a content object as well as to the content object itself.

Abstract: Embodiments are directed to association of storage objects in a multi-tenant, cloud-based storage environment. More specifically, a first object can be made available in the file system of the environment and can be accessed, for example, by its file or object name. At some point thereafter, an auxiliary object can be provided that is related to the first object. For example, this auxiliary object can comprise metadata or other content associated with or related to the first object. According to one embodiment, this auxiliary object can be assigned an identifier that not only uniquely identifies the auxiliary object but also identifies, within the identifier itself, the relationship to the first object. This relational naming can be used to track the relationship between objects, e.g., to update the auxiliary object based on changes to the first object, but without a separate mapping of the objects.

Abstract: Methods, systems, and computer program products. A virtual canvas is presented in an active area of an online meeting facility that renders participant-specific online virtual canvas interactions raised by a respective plurality of users' devices. Users can see and hear each other's interactions during an virtual canvas session. Annotations include drawings, content object edits, voice annotations, etc. that correspond to a displayed portion of a content object of a content management system (CMS). Based on the interactions and/or inferences made based on those interactions, the virtual canvas system generates commands to be executed by the content management system. Characteristics of interactions between users can be enriched by drawing information from the content management system and using such information in combination with the interactions themselves.

Abstract: Methods, systems, and computer program products. A virtual canvas is presented in an active area of an online meeting facility that renders participant-specific online virtual canvas interactions raised by a respective plurality of users' devices. Users can see and hear each other's interactions during an virtual canvas session. Annotations include drawings, content object edits, voice annotations, etc. that correspond to a displayed portion of a content object of a content management system (CMS). Based on the interactions and/or inferences made based on those interactions, the virtual canvas system generates commands to be executed by the content management system. Characteristics of interactions between users can be enriched by drawing information from the content management system and using such information in combination with the interactions themselves.