Abstract: The present disclosure describes a system and method for generating a dependency tree for program information collected at runtime, and enriching the dependency tree with information relating to how frequently functions are called at runtime. The present disclosure further provides for detecting vulnerabilities in functions, and generating recommendations for an optimal remediation that efficiently addresses one or more vulnerabilities. Either or both of the vulnerabilities and the remediations may be sorted and ranked, such that the most critical vulnerabilities are identified and the most effective remediations are identified.

Abstract: The present disclosure describes technology for training and deploying time-series optimized transformers for observability with latent decoding (Toto-LD). The system includes processors and a storage device for storing instructions. The processors may execute the instructions to receive an input sequence of multivariate time-series data having a plurality of data points. The input sequence may be separated into a plurality of temporal patches. For each temporal patch, the respective patch may be normalized based on causal statistics derived from the data points within the respective patch and preceding patches. Patch embeddings may be generated for subsequent processing by a transformer.

Abstract: The present disclosure describes technology for training and deploying time-series optimized transformers for observability with latent decoding (Toto-LD). The system includes processors and a storage device for storing instructions. The processors may execute the instructions to process data using an artificial intelligence (AI) model. The AI model includes a patch embedding layer a transformer architecture, and a sequence combining layer. The patch embedding layer may be configured to receive patches of time-series data and generate patch embeddings. The transformer architecture may be configured to generate output embeddings based on an input sequence comprising patch embeddings. The sequence combining layer may be configured to generate the input sequence based on the patch embeddings and the output embedding.

Abstract: The present disclosure describes technology for training and deploying time-series optimized transformers for observability with multimodal input (TOTO-M). The system includes processors and a storage device for storing instructions. The processors may execute the instructions to process multimodal data using an artificial intelligence (AI) model. The AI model includes a text embedding model configured to generate one or more query text embeddings based one or more query texts corresponding to multivariate time-series data The AI model further includes a patch embedding layer configured to generate patch embeddings from the multivariate time-series data and a transformer architecture comprising one or more segments including space-wise blocks and time-wise blocks. The transformer architecture is configured to receive the patch embeddings combined with the one or more query text embeddings, process the patch embeddings, and output transformed embeddings.

Abstract: The present disclosure describes a system and method for generating a dependency tree for program information collected at runtime, and enriching the dependency tree with information relating to how frequently functions are called at runtime. The present disclosure further provides for detecting vulnerabilities in functions, and generating recommendations for an optimal remediation that efficiently addresses one or more vulnerabilities. Either or both of the vulnerabilities and the remediations may be sorted and ranked, such that the most critical vulnerabilities are identified and the most effective remediations are identified.

Abstract: The present disclosure describes technology for training and deploying time-series optimized transformers for observability (TOTO). The system may process multivariate time-series data using an artificial intelligence (AI) model. The model may include a patch embedding layer and a transformer architecture. The patch embedding layer is configured to receive the multivariate time-series data and output patch embeddings. The transformer architecture is configured to process the output patch embeddings and output transformed embeddings. The transformer architecture may include segments, with each segment including at least one space-wise block and a configurable number of time-wise blocks.

Abstract: The technology disclosed herein provides a mechanism to avoid double counting when generating metrics from monitoring events received from an endpoint (e.g., end user's web browser, or mobile application). A unique identifier is assigned to each monitoring event matching a metric definition. When the number of unique identifiers assigned is below a predetermined threshold, a deduplication system determines whether the unique identifier for a given monitoring event is duplicative of any other unique identifiers, corresponding to other monitoring events, using a hash set. When the number of unique identifiers exceeds the predetermined threshold, the unique identifiers are automatically added to a probabilistic data structure, such as a scalable Bloom filter. In this scenario, the deduplication system would determine whether the unique identifier for the given monitoring event is duplicative of any other identifiers in the probabilistic data structure.

Abstract: A monitoring system is configured for de-duplicating data for storing in a database. The monitoring system is configured for receiving a message including a sequence of fields and corresponding field values; generating an entry in a first mapping table that associates each unique field and each unique field value of the message to a corresponding index value that is unique; generating a first vector including index values; ordering the index values of the vector, the ordered index values indicating a structure of the message; generating an entry in a second mapping table that associates the structure of the message with a structure index value; generating a second vector including the structure index value and an ordered set of index values representing the field values; and storing, in a database, the second vector.

Abstract: Methods and systems are configured for monitoring operations of a computing device by associating threads executing in a user space with kernel events in a kernel space. The systems and methods are configured for detecting a kernel event in the kernel space of the computing device; in response to detecting the kernel event, accessing, from a mapping table that maps a computing thread in the user space to a span that is active on the computing thread, a base address of a memory in the user space of the computing device, the memory storing a span identifier for each span in the user space, the span comprising one or more operations of a computing thread that is active in the user space; accessing, based on the base address, a span identifier in the memory; and associating the span identifier with the kernel event.

Abstract: A compact data structure generation engine can be used to generate a compact data structure that represents performance data for high-scale networks. The compact data structure representing the performance data can be used to monitor the operation performed on or by a computer system to identify potentially anomalous conditions. In response, a corrective action can be taken to address the issue. This can be useful, for example, in improving the efficiency, effectiveness, and reliability of the computer system during operation.

Abstract: Monitoring a performance of one or more computing systems includes configuring, by at least one processor, a sampling window for sampling exceptions data generated by at least one application instance being executed by a computing device, the exceptions data indicating an occurrence of at least one operation performed by the application instance. Configuring the sampling window comprises determining a number of exceptions generated for a prior sampling window, determining a computing bandwidth that is available for monitoring the exceptions, and controlling a sampling rate of the sampling window based on the number of exceptions and the computing bandwidth. The monitoring includes receiving, during the sampling window, the exceptions data generated by the at least one application instance, sampling, based on the sampling rate, the exceptions data, and generating, based on the sampling, summary data representing the exceptions data.

Abstract: A ring replication system receives and redundantly stores electronic data for access by users. Two or more storage devices are configured in a ring and circulate received data to each other. At least one such device receives incoming data records from an external source. One storage device is designated as the ordering device for assigning a sequence order to each data record, and the assigned sequence order is circulated around the ring. After confirming that the assigned sequence order has been indexed within each storage device on the ring, data records may then be accessed by users. One or more access portals may be coupled to one or more storage devices in the replication ring for providing users with access to stored data records. Data records are accessed in accordance with the assigned sequence order. A related method for redundant storage of data records is also disclosed.

Abstract: Methods and systems are configured for tracking content represented in a resource. A modified version of structure data of a resource that includes at least one element is received. Each element represents content of the resource in the structure data. Each element includes a portion of the structure data that defines the content. Data specifying a target element of the structure data is received. A plurality of locators for the target element are obtained. A locator of the plurality is derived as a function of a frequency that one or both of attributes and classes of the target element appear in the structure data and includes a subset of the attributes and the classes, the subset uniquely identifying the target element. The plurality of locators including the locator are applied to a modified version of the structure data to extract a modified version of the target element.

Abstract: A non-transitory computer readable storage medium has instructions executed by a processor to host a composite window collection for a group of collaborators. The composite window collection includes individual windows controlled by individual collaborators and the group of collaborators observe the composite window collection from different computers connected via a network. A composite window collection session recording is formed. The composite window collection session recording is augmented with metadata to form a collaboration recording. Storage rules are applied to the collaboration recording. A request for the collaboration recording is received from a user. The user is prompted for metadata filtering criteria. A filtered collaboration recording is constructed in accordance with the metadata filtering criteria. The filtered collaboration recording is supplied to the user.

Abstract: A data structure is provided that identifies relationships between entities of an infrastructure of a computing system and that is configured to update in response to changes in the infrastructure of the computing system. The data structure includes vertices and edges, where each vertex of the data structure represents an entity of the infrastructure, and where each edge of the data structure represents a relationship between entities of the infrastructure. When usage data are received, the usage data are analyzed to determine a correlation between a first operation specifying a first entity and a second operation specifying a second entity. An edge between the first entity specified by the first operation and the second entity specified by the second operation is generated. Event data comprising usage data specifying either the first entity or the second entity is generated.

Abstract: An anomaly detection platform can be used to monitor the operation performed on or by a computer system to identify potentially anomalous conditions. In response, a corrective action can be taken to address the issue. This can be useful, for example, in improving the efficiency, effectiveness, and reliability of the computer system during operation.

Abstract: A method for processing a data stream to identify a structure of the data stream includes receiving the data stream a sequence of characters, retrieving a set of rules for encoding characters into at least one token, and parsing the data stream. Parsing includes generating a plurality of tokens according to the set of rules. Each token represents a corresponding portion of the sequence of characters. Parsing includes forming a sequence of tokens from the plurality of tokens and assigning at least one attribute value describing the corresponding portion of the sequence of characters of the corresponding token to which the attribute value is assigned. The sequence of tokens are assigned to a cluster by determining that the sequence of tokens matches a pattern by which the cluster is characterized. The sequence of tokens is merged with the cluster. A representation of the cluster is output.

Abstract: A compact data structure generation engine can be used to generate a compact data structure that represents performance data for high-scale networks. The compact data structure representing the performance data can be used to monitor the operation performed on or by a computer system to identify potentially anomalous conditions. In response, a corrective action can be taken to address the issue. This can be useful, for example, in improving the efficiency, effectiveness, and reliability of the computer system during operation.

Abstract: A data structure is provided that identifies relationships between entities of an infrastructure of a computing system and that is configured to update in response to changes in the infrastructure of the computing system. The data structure includes vertices and edges, where each vertex of the data structure represents an entity of the infrastructure, and where each edge of the data structure represents a relationship between entities of the infrastructure. When usage data are received, the usage data are analyzed to determine a correlation between a first operation specifying a first entity and a second operation specifying a second entity. An edge between the first entity specified by the first operation and the second entity specified by the second operation is generated. Event data comprising usage data specifying either the first entity or the second entity is generated.