Abstract: Technologies are disclosed herein that are directed to the improvement of vulnerability assessment process by avoiding false positive vulnerabilities caused by vendor specific backports of vulnerability fixes that are not considered by conventional vulnerability assessment systems. To secure their software products, vendors identify components that are affected by vulnerabilities used by their products and apply vulnerability fixes introduced by later component versions to those component versions used in their products. This created “gaps” in vulnerable component version ranges provided by public vulnerability intelligence data streams. Vulnerability assessment processes that solely rely on public vulnerability intelligence data incorrectly report vulnerabilities for component versions containing such backported vulnerability fixes.

Abstract: The disclosure relates to a computer-implemented method for extracting data from textual records. The technical problems solved by the disclosure are i) to generate an extraction pattern for extracting a selected data field from a reference record, ii) to improve the robustness of the extraction pattern by reducing its length, and iii) to extract the selected field from a set of records. The solution comprises determining whether the extraction pattern is disjoint to any segment of the preceding pattern; forming a new extraction pattern by inserting the data type for last data field in the preceding pattern at the beginning of the extraction pattern; and repeating the previous steps with the new extraction pattern until the new extraction pattern is disjoint to all segment comprising the preceding pattern.

Abstract: Technologies are disclosed for the automated, rule-based generation of models from arbitrary, semi-structured observation data. Context data of received observation data, like data describing the location of on which a phenomenon was observed, is used to identify related observations, to generate entities in a model describing the observed data and to assign observations to model data. Mapping rules may be used for the on-demand generation of models, and different sets of mapping rules may be used to generate different models out of the same observation data for different purposes. Further, observation time data may be used to observer the temporal evolution of the generated model. Possible use cases of the so generated models include the interpretation of observation data that describes unexpected operation conditions in view of the generated model, or to determine how a monitored system reacts on changing conditions, like increased load.

Abstract: A computer-implemented method is presented for storing log data generated in a distributed computing environment.

Abstract: A computer-implemented method for storing and querying application performance monitoring (APM) data in a database, includes receiving data records of APM data, each data record associated to a key; storing the data records in storage containers in the database, each record stored in one storage container and each storage container identified by a unique storage identifier; assigning a unique index value to each unique key; defining a distribution function mapping the keys to the index values; generating a secondary function to approximate the distribution function; defining a mapping function to map the index values to lists of storage identifiers; and in response to a request to retrieve data records for a specified key or keys, querying the database to identify a list of storage identifiers based on the secondary function and the mapping function and retrieving the data records for the specified key or keys.

Abstract: A computer-implemented method is presented for extracting data from textual records. The objective of the disclosure is to identify the most appropriate pattern in a set of patterns for extracting data from data records and by applying the most appropriate pattern to a plurality of data records, to robustly extract data from textual records.

Abstract: A unified storage format is presented for received observation data records of various formats, including individual observations or histograms and pre-sampled records describing multiple observations. The proposed storage format also supports various data reduction technologies, including coarsening of time and observation value resolutions, where the proposed data reduction technologies retain data describing the quantity of observations. In addition, sampling-based data reduction approaches are described, which at least retain the statistical expectancy value for the number of observations. Further, a definition and storage format for histogram buckets is provided with guaranteed relative error behavior over the whole value range of observation data, that only requires the definition of a number of significant bits for the recording and interpretation of histogram data. The proposed histogram storage scheme is applicable to integer and floating-point observation data.

Abstract: A computer-implemented method is presented for storing log data generated in a distributed computing environment.

Abstract: A computer-implemented method is presented for visualizing log data captured in a computer system. The method includes: receiving a plurality of log records, where each log record includes a severity indicator; grouping log records in the plurality of log records into groups of log records, such that log records in a given group of records are chronological; for each group of log records, extracting one or more templates from a given group of log records, where each template is comprised of a text string representing log records in the given group of log records; for each group of log records, computing a similarity measure between a given group of log records and the remaining groups of log records; and visualizing the groups of log records by projecting each group of log records onto a multi-dimensional plane based on the similarity measures for the groups of log records and connecting projections for the groups of log records in chronological order using a line.

Abstract: The present disclosure relates to the detection of cross-site scripting vulnerabilities in a web application. The objective of the disclosure is to find a computer-implemented method for detecting cross-site scripting vulnerabilities in a web application. The detection of XSS vulnerabilities shall be performed automatically and the number of false positives shall be reduced compared to the prior art.

Abstract: A computer-implemented method is presented for determining primary keys in a table of a database system. The method includes: determining a number of rows in the table; for a given column of the table, generating a probabilistic data structure for the given column, where the probabilistic data structure is partitioned into a plurality of registers and configuration parameters for the probabilistic data structure includes a first recording parameter, base, that controls recording of data into the probabilistic data structure; computing a cardinality estimate for the given column using the probabilistic data structure; computing a ratio between the cardinality estimate for the given column and the number of rows in the table; comparing the ratio to a threshold; and designating the given column as a primary key for the table in response to the ratio being greater than the threshold.

Abstract: A system and method for real-time discovery and monitoring of multidimensional topology models describing structural aspects of applications and of computing infrastructure used to execute those applications is disclosed. Different types of agents are deployed to the monitored application execution infrastructure dedicated to capture specific topological aspects of the monitored system. Virtualization agents detect and monitor the virtualization structure of virtualized hardware used in the execution infrastructure, operating system agents deployed to individual operating systems monitor resource utilization, performance and communication of processes executed by the operating system and transaction agents deployed to processes participating in the execution of transactions, providing end-to-end transaction trace and monitoring data describing individual transaction executions.

Abstract: A prioritized method is presented for updating software in a distributed computing environment. The objective of the disclosure is to find a computer-implemented method for updating software on pods in the distributed computing environment. This is solved by calculating a risk rating for each pod in the manifest, taking into account a vulnerability score of the pod, the minimum number of inbound hops for reaching the pod, and the communication relationship between the given pod and other pods. Pods in the manifest are updated in accordance with the calculated risk ratings.

Abstract: The disclosure concerns the time-based correlation of time series for the root cause analysis of application monitoring data, observability data, and data observability data in the field of application monitoring and observability. The object of the disclosure is to find at least one candidate time series that has a high chance/probability for causing an event in a reference time series. The method shall be time-based and not frequency based. The method includes: constructing a simplified reference time series retaining changes in the reference time series and setting other points to zero; constructing a simplified candidate time series retaining changes in the candidate time series and setting other points to zero; calculating a similarity metric between the simplified candidate time series and the simplified reference time series; and reporting an occurrence of a computing event in response to the similarity metric exceeding a threshold value.

Abstract: A technology is disclosed for estimating the impact that heap memory allocations have on the behavior of garbage collection activities. Allocation monitoring data, including type and size of the allocated object and data describing the code location on which the allocation was performed are gathered. Further, when the allocated object is later reclaimed by garbage collection is recorded. Gathered object allocation and reclaim data are used to estimate for individual allocation sites or types of allocated objects, the number of bytes that are allocated, and the number of bytes that survived a garbage collection run. Allocation activity causing frequently garbage collection runs is identified using allocation size data and the survived byte counts are used to identify allocation activity causing long garbage collection runs. Further allocation monitoring data is correlated with transaction trace data to identify the impact of transactions or transaction classes on garbage collection behavior.

Abstract: Methods and technologies are disclosed for the sketch efficient estimation of large-scale multi-sets in distributed, stream-oriented environments. Sketch updates are idempotent and commutative, to support duplicate set elements and varying element sequences. They are also mergeable to support distributed sketch recording. The recording process uses stepwise approximated geometric distributions, efficiently generated from NLZ values of received sketch updates, by using only multiplications with powers of two and integer additions. Sketch registers are subdivided into a portion storing an observed max update value for the register, and a portion storing set of flag bits indicating observed next smaller update values for the register. A Max Likelihood base sketch data evaluation, based on the assumption of statistically independent sketch registers is proposed.

Abstract: A computer-implemented method is presented for determining primary keys in a table of a database system. The method includes: determining a number of rows in the table; for a given column of the table, generating a probabilistic data structure for the given column, where the probabilistic data structure is partitioned into a plurality of registers and configuration parameters for the probabilistic data structure includes a first recording parameter, base, that controls recording of data into the probabilistic data structure; computing a cardinality estimate for the given column using the probabilistic data structure; computing a ratio between the cardinality estimate for the given column and the number of rows in the table; comparing the ratio to a threshold; and designating the given column as a primary key for the table in response to the ratio being greater than the threshold.

Abstract: The disclosure concerns the time-based correlation of time series for the root cause analysis of application monitoring data, observability data, and data observability data in the field of application monitoring and observability. The object of the disclosure is to find at least one candidate time series that has a high chance/probability for causing an event in a reference time series. The method shall be time-based and not frequency based. The method includes: constructing a simplified reference time series retaining changes in the reference time series and setting other points to zero; constructing a simplified candidate time series retaining changes in the candidate time series and setting other points to zero; calculating a similarity metric between the simplified candidate time series and the simplified reference time series; and reporting an occurrence of a computing event in response to the similarity metric exceeding a threshold value.

Abstract: A serialization data format for the transfer, analysis, and modification of schemaless mass data is proposed. The data format supports stream oriented, pipeline-based processing, and it enables read access of contained data without deserialization, and modification access that only requires the deserialization of portions of structure and meta data. Incoming, semi-structured data records may be transformed into records of the proposed serialization data format, compressed and stored in processing buffers containing multiple of those records. During processing, only individual records are decompressed, and processed records are then compressed and stored in output processing buffers for efficient memory usage.

Abstract: A computer-implemented method is presented for storing and querying records from a data segment. The objective of the disclosure is to find computer-implemented methods for storing and querying records from a data segment that are fast and space efficient storing and querying of APM data stored in a segmented database.