Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for content management systems. A security threat management facility (STMF) is identified. The STMF contains a database of threat assessment values in addition to further information pertaining to one or more users. Concurrent with operation of the STMF, a content management system (CMS) tracks user-initiated content object interaction events. Based on analysis of the tracked user-initiated content object interaction events, a further threat assessment value is generated by the CMS. Such a further threat assessment is determined based on one or more user-to-user relationships or one or more user-to-file relationships as determined at the content management system. An augmented threat assessment is formed using both the threat assessment values of the STMF with the further threat assessment value from the CMS.

Abstract: Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for content management systems. Content objects of a content management system (CMS) are managed from original creation through to final disposition (e.g., deletion). The CMS communicates with a security threat management facility (STMF). In operation, the STMF establishes a first set of security parameters corresponding to information derived from packet inspection, whereas the CMS establishes a second set of security parameters corresponding to information derived at least in part by analysis of user activities or contents of the content object. A security perimeter is formed by combining the first set of security parameters and a second set of security parameters. Risks or vulnerabilities corresponding to the content object are minimized by choosing the lower of any two compared parameters to define a lower risk perimeter for the content object.

Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Embodiments are directed to distributing records among storage partitions by maintaining a table of records. The table of records can be indexed based on an original partitioning key in the table of records. A plurality of counters can be initialized with each counter associated with a sub-range in a total range of key values for a secondary index partitioning key. Each record of the table of records can be read and a count of records in the associated sub-range can be accumulated in each counter. The number of records per partition can be determined based on the total number of records in the total range of key values and the number of available partitions and the records can be distributed to the available partitions in the storage system based on the number of records in each sub-range.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: Management of web conference assets in a content management system. At the conclusion of a web conferencing session, an event is raised at the content management system. Various web conference assets (e.g., recordings) and web conference parameters are analyzed in conjunction with content management system metadata. Based on the analysis, one or more actions to perform on the web conference assets are determined. The content management system metadata may include user profile information of at least one web conference participant. Rules and/or a classification model that considers then-current conditions at the content management system are used singly, or in combination, to determine action characteristics and/or labels such as a retention period or security classifications to apply to the web conference assets. The web conference assets are stored in a hierarchical directory at the content management system. The hierarchy of the directory is derived from aspects of the web conferencing facility.

Abstract: Methods, systems and computer program products for recommendation systems. Embodiments commence by gathering a set of pathnames that refer to content objects of a collaboration system. A tokenizer converts at least some of the pathnames into vectors. The vectors comprise hierarchical path components such as folder names or file names, which vectors are labeled with an indication as to whether or not the folder or file referred to in a particular vector had been clicked on by one or more users. Some portion of the labeled vectors are used to train a predictive model. Another portion of the vectors are used to validate the predictive model. When the model exhibits sufficient precision and recall, the predictive model is then used to predict the probability that a particular user would have an interest in a particular folder or file. The folder name or file name is presented as a collaboration recommendation.

Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates associated with content objects taken from the plurality of content objects. When a document template is identified, template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: A recommendation system integrated with a content management system (CMS). The CMS stores instances of shared content objects and coordinates user interactions by and between a plurality of CMS users. Shared content objects are divided into a plurality of portions, after which any user interactions over the various portions of the content object are observed and analyzed. User interest inferences are drawn from analysis of the observed user interactions taken user over respective particular portions of the content object. Based on the inferred user interests, fine-grained recommendations are formed and propagated. Some fine-grained recommendations refer to further content objects (e.g., content objects of different types). Some fine-grained recommendations are propagated to other CMS users (e.g., to a plurality of CMS users that are related in some way). The fine-grained recommendations refer to one or more specific portions of a content object as well as to the content object itself.

Abstract: Embodiments are directed to association of storage objects in a multi-tenant, cloud-based storage environment. More specifically, a first object can be made available in the file system of the environment and can be accessed, for example, by its file or object name. At some point thereafter, an auxiliary object can be provided that is related to the first object. For example, this auxiliary object can comprise metadata or other content associated with or related to the first object. According to one embodiment, this auxiliary object can be assigned an identifier that not only uniquely identifies the auxiliary object but also identifies, within the identifier itself, the relationship to the first object. This relational naming can be used to track the relationship between objects, e.g., to update the auxiliary object based on changes to the first object, but without a separate mapping of the objects.

Abstract: Methods, systems and computer program products for content management systems. The techniques of the methods, systems and/or computer program products automatically determine activity-based content object access permissions and/or make a recommendation of activity-based content object access permissions. A machine learning model is formed from observations of user interactions over a plurality of content objects. The model is continually updated based on ongoing observation and analysis of user interaction events. When a collaborative relationship is formed between an invitor and one or more invitees, the activity-based permissions model is accessed to determine a set of access permissions to assign to the collaborative relationship. A single collaborative relationship may cover many collaboration objects. In some cases, a set of access permissions are automatically assigned to the collaborative relationship. In other cases, a set of access permissions is presented to the invitor as a recommendation.

Abstract: Methods, systems, and computer program products. A virtual canvas is presented in an active area of an online meeting facility that renders participant-specific online virtual canvas interactions raised by a respective plurality of users' devices. Users can see and hear each other's interactions during an virtual canvas session. Annotations include drawings, content object edits, voice annotations, etc. that correspond to a displayed portion of a content object of a content management system (CMS). Based on the interactions and/or inferences made based on those interactions, the virtual canvas system generates commands to be executed by the content management system. Characteristics of interactions between users can be enriched by drawing information from the content management system and using such information in combination with the interactions themselves.

Abstract: Methods, systems, and computer program products. A virtual canvas is presented in an active area of an online meeting facility that renders participant-specific online virtual canvas interactions raised by a respective plurality of users' devices. Users can see and hear each other's interactions during an virtual canvas session. Annotations include drawings, content object edits, voice annotations, etc. that correspond to a displayed portion of a content object of a content management system (CMS). Based on the interactions and/or inferences made based on those interactions, the virtual canvas system generates commands to be executed by the content management system. Characteristics of interactions between users can be enriched by drawing information from the content management system and using such information in combination with the interactions themselves.

Abstract: Methods, systems and computer program products for content management systems. In a computing environment having multiple interconnected computer systems, one or more network communication links between a first computer system that hosts a first application and a second computer system that hosts one or more second applications are established. The first computer system hosts a plurality of shared content objects that can be operated over by any second applications that are interfaced with the first application. Particular interaction events over a shared content object take place at the second applications and/or at the interfaces between the first and second applications. Such particular interaction events are recorded as they occur, after which, based on event attributes associated with the particular interaction events, at least one workflow of the first application is selected. The selected workflow of the first application is executed to perform operations over the shared content object.

Abstract: Scalable architectures, systems, and services are provided herein for generating jobs by applying user-specified metadata rules to metadata events. More specifically, the scalable architecture described herein uses metadata to drive automations and/or polices in a cloud-based environment. In one embodiment, the architecture integrates a metadata service with an event-based automation engine to automatically trigger polices and/or automations based on metadata and/or changes in metadata changes. The metadata service can include customizable and/or pre-build metadata templates which can be used to automatically apply a metadata framework (e.g., particular fields) to files based on, for example, the upload or placement of a particular file in a particular folder. The architecture also provides for advanced metadata searching and data classification.

Abstract: Methods, systems and computer program products for managing workflows between multiple third-party systems. A content management system stores a workflow that operates over content objects by invoking third-party applications. The content management system invokes these third-party applications, and these applications make modifications to the progression of the workflows as the third-party applications carry-out their specific portions of the workflow. Upon receipt of a workflow variable value from a first third-party application, the content management system determines the semantics of the workflow variable value and caries out a next portion of the workflow. The content management system then invokes a further next portion of the workflow to be carried out by a second third-party application.

Abstract: Systems and methods for folder synchronization and offline synchronization via a mobile platform in a web-based collaboration environment are disclosed. One embodiment includes synchronizing user selected folders and/or sub-folders via the mobile platform, using portable devices including smart phones and tablets using any mobile operating system to allow offline access. Child or sub-folders of the selected folders and/or sub-folders are automatically detected and synchronized for offline access. Any change or new content detected on the client side or on the server side is also synchronized such that the selected folders and/or sub-folders on the client and server sides are up to date.

Abstract: Systems and methods for forming collaboration recommendations. Techniques for forming event-based recommendations use time-decayed event values. A shared content management system supports a plurality of users that generate events by interacting with content objects of the shared content management system. Events over the content objects are captured as event objects. Method steps are invoked upon receiving event objects that describes user-to-object interaction events that arise from interactions by users over content objects. Different types of interactions carry different importance values. The importance values can be applied as weights when scoring user-to-object interaction activities. The importance can decay over time. As time progresses and as the importance of older interactions decay, score components of a user-to-object interaction can be updated based at least in part on a time decay function. The system emits collaboration recommendations based on the decayed user-to-user collaboration scores.