Abstract: A computing system includes a web server to provide first and second variants of a web application for A/B testing, and at least one client computing device operated by at least one user. The at least one client computing device includes a web browser and a camera. The web browser is for accessing the first variant of the web application, and for accessing the second variant of the web application. The camera is to record eye movements of the at least one user when viewing the displayed web page from the first variant of the web application, and to record eye movements of the at least one user when viewing the displayed web page from the second variant of the web application. The web server includes an eye movement analyzer to compare the recorded eye movements of the at least one user to determine a distraction factor.

Abstract: A system and method system for providing auto-hyperlinking in endpoint content. A system includes email clients installed on remote client devices and managed by an application management service. The system further includes an auto-hyperlinking system having: a configuration file that regular expressions (regex's), wherein each regex is associated with an application and a URL template, and wherein each regex is coded to identify a string and parse an associated parameter; and a process that modifies an inputted email including: searching the inputted email for an email text string specified by the set of regex's; in response to locating a matching email text string as specified by an associated regex, parsing the matching email text string to extract a parameter value; and converting the email text string within the inputted email into a hyperlink based on an associated URL template, wherein the hyperlink includes the parameter value.

Abstract: Systems and methods for establishing a secure connection are described. A server receives a plurality of routing tokens for establishing a service connection between a service node and the server along a network path through a plurality of network devices. The routing tokens can be validated by a corresponding network device. The server transmits a packet including the routing tokens to a first network device. The first network device validates a first routing token associated therewith, then directs the packet along the network path to a second network device, and so forth, until each of the network device receives and validates their routing token. The server establishes a cryptographic context between the service node and server for establishing a secure channel between the service node and the server. The server transmits a service node routing token to the service node via the secure channel for validation.

Abstract: Described embodiments provide systems and methods for policy-based authentication, where the policy may designate locations and/or forms of proof of locations, for use in authentication. Some embodiments include or utilize a database storing authentication policies. In an example system, an authentication server in communication with the database is configured to receive a request from a device needing authentication. The request may include a credential. The authentication server is configured to retrieve, from the database storing authentication policies, an authentication policy corresponding to the device, the retrieved authentication policy specifying a location parameter. The authentication server is configured to receive location data from the device and resolve the authentication request using the credential and the received location data pursuant to the retrieved authentication policy.

Abstract: Virtual machines, virtualization servers, and other physical resources in a cloud computing environment may be dynamically configured based on the resource usage data for the virtual machines and resource capacity data for the physical resources in the cloud system. Based on an analysis of the virtual machine resource usage data and the resource capacity data of the virtualization servers and other physical resources in the cloud computing environment, each virtual machine may be matched to one of a plurality of virtualization servers, and the resources of the virtualization servers and other physical resources in the cloud may be reallocated and reconfigured to provide additional usage capacity to the virtual machines.

Abstract: Described embodiments provide systems and methods for routing client requests. A device may be arranged intermediary to a plurality of clients and a domain name system (DNS) controller. The device may generate a query for the DNS controller. The query may correspond to a service to be accessed by the clients. The device may receive, from the DNS controller, a response to the query. The response may include a value used by the device to route respective client requests for accessing the service to a corresponding version of a plurality of versions of the service. The device may receive, from a client, a client request for accessing the service. The device may route the client request to one of the versions of the service according to the value included in the response to manage traffic between various versions of the service.

Abstract: A method may include, in an initial virtual machine session for a user running on a virtualization server, loading a roaming user profile for the user, generating a user search index database for the user, and indexing the roaming user profile in the user search index database. In a subsequent virtual machine session for the user running on the at least one server, the user search index database for the user may be loaded and the index for the roaming user profile obtained therefrom without re-indexing the roaming user profile.

Abstract: A computing system may include a server configured to host virtual computing sessions, and a client device. The client device may be configured to remotely access a virtual computing session from the server, and receive user input data associated with the virtual computing session and classify the data into first (higher priority) and second (lower priority) data packets. The client device may also be configured to send the first data packets to the server via a first virtual channel, and send the second data packets to the server via a second virtual channel having a higher packet loss rate associated therewith than the first virtual channel. The server may be configured to assemble the second data packets to reconstruct and inject the user input data into the virtual computing session based upon the first data packets.

Abstract: Described embodiments provide systems and methods for inferring a network type and network conditions. The system includes a packet capturing engine configured to capture a plurality of network packets from a plurality of TCP network connections. The system includes a packet analyzer configured to analyze the plurality of network packets to generate a plurality of metrics. The system includes a network classifier configured to infer network types of the plurality of TCP connections based on the plurality of metrics and at least one classification model. The system also includes a conditions ranking engine configured to estimate a level of network congestion for each TCP connection based on the plurality of metrics and the network types.

Abstract: A system for managing a virtual machine is provided. The system includes a processor configured to initiate a session for accessing a virtual machine by accessing an operating system image from a system disk and monitor read and write requests generated during the session. The processor is further configured to write any requested information to at least one of a memory cache and a write back cache located separately from the system disk and read the operating system image content from at least one of the system disk and a host cache operably coupled between the system disk and the at least one processor. Upon completion of the computing session, the processor is configured to clear the memory cache, clear the write back cache, and reboot the virtual machine using the operating system image stored on the system disk or stored in the host cache.

Abstract: A method for generating microapp recommendations comprises receiving observational data that characterizes interactions between users and applications. The method further comprises defining a set of correlation trees based on the received observational data. Each correlation tree in the set represents a sequence of interactions between one of the users and one or more of the applications. The set includes a first quantity of correlation trees. The method further comprises identifying a subset of similar correlation trees, each of which is included in the set. The subset includes a second quantity of correlation trees that is less than the first quantity. The method further comprises making a determination that the second quantity is greater than a threshold quantity. The method further comprises, in response to making the determination, generating a microapp recommendation based on the sequence of interactions represented by a correlation tree that is representative of the subset.

Abstract: A technique increases capacity in a topic-subscription messaging system. The technique involves, during a first time period, operating a first topic structure of the system. The first topic structure includes a first topic and a plurality of first subscriptions coupled with the first topic. The technique further involves, during a second time period, providing a second topic structure which includes a second topic and a plurality of second subscriptions coupled with the second topic. The technique further involves, during a third time period, providing a link from the second topic structure to the first topic structure making (i) the second topic structure a parent to the first topic structure and (ii) the first topic structure a child to the second topic structure, the link conveying messages from a particular second subscription of the second topic structure to the first topic of the first topic structure.

Abstract: A method for generating microapp recommendations comprises receiving observational data that characterizes interactions between users and applications. The method further comprises defining a set of correlation trees based on the received observational data. Each correlation tree in the set represents a sequence of interactions between one of the users and one or more of the applications. The set includes a first quantity of correlation trees. The method further comprises identifying a subset of similar correlation trees, each of which is included in the set. The subset includes a second quantity of correlation trees that is less than the first quantity. The method further comprises making a determination that the second quantity is greater than a threshold quantity. The method further comprises, in response to making the determination, generating a microapp recommendation based on the sequence of interactions represented by a correlation tree that is representative of the subset.

Abstract: A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria.

Abstract: Described embodiments provide systems and methods for replaying a service graph of a plurality of microservices. A device stores a plurality of snapshots of a service graph of a plurality of microservices generated for each of a plurality time increments over a time period. Each of the plurality of snapshots of the service graphs include metrics at a respective time increment from execution of each of the plurality of microservices. The device receives a request to replay the service graph. Responsive to the request, the device displays at least two or more of the plurality of snapshots of the service graph in sequence corresponding to two or more of the plurality of time increments.

Abstract: A principal database is described in which each entry includes one principal identity, and one or more alias identities that may each have an authorization scope. Principal identity attributes include a principal identifier and login credentials, and alias identity attributes include an authorization scope and login credentials. Responsive to successfully authenticating the user for a first application (a multiple-identity application), based on the alias identity login credentials, an access token containing both the alias identity attributes and the principal identity attributes is transmitted to the first application, causing the first application to grant a scope of access based on the authorization scope. Responsive to a request to authenticate the user for a second application (a single-identity application), the access token is transmitted to the second application without re-authenticating the user, causing the second application to grant a scope of access based on the principal identifier.

Abstract: The system and methods discussed herein provide for filtering out noisy application signatures to improve the precision of first packet application classification. In some implementations, the system receive application signatures from devices along with their network identifiers. Based upon the frequency at which identical application signatures appear as originating from distinct network environments, the system determines the validity of application signatures and avoids storing irrelevant information for routing network traffic.

Abstract: A client computing device may include a memory and a processor cooperating with the memory to run a first Software as a Service (SaaS) application session from a server for a first SaaS application within an embedded browser and viewable within a user interface (UI). The processor may further pre-launch a second SaaS application from the server different than the first SaaS application within the embedded browser based upon browser commands within the first SaaS application session. The second SaaS application session may be hidden so that it is not viewable within the UI. Upon user selection of the second SaaS application, the processor may display the second SaaS application session so that it is viewable within the UI.