Abstract: A computer-implemented method includes receiving training data that includes a plurality of API requests from a plurality of client devices. The method includes generating a plurality of permissible API sessions based on the training data. Each of the permissible API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device. The method includes applying a sequence embedding technique to the plurality of permissible API sessions to generate a plurality of embeddings and applying a dimensionality reduction technique to the plurality of embedding to generate a plurality of compact embeddings. The method includes storing each of the compact embeddings in a space partitioning data structure at storage locations within the space partitioning data structure that are determined based on similarities between the compact embeddings.

Abstract: Systems and methods for authenticating a user are disclosed.

Abstract: Systems and methods are disclosed for switching between batch processing and real-time processing of time series data, with a system being configured to switch between a batch processing module and a real-time processing module to process time series data. The system includes an orchestration service to indicate when to switch, which may be based on a switching event identified by the orchestration service. In some implementations, the orchestration service identifies a switching event in incoming time series data to be processed. When a batch processing module is to be used to batch process time series data, the real-time processing module may be disabled, with the real-time processing module being enabled when it is used to process the time series data. In some implementations, the real-time processing module includes the same processing models as the batch processing module such that the two modules' outputs have a similar accuracy.

Abstract: Certain aspects of the present disclosure provide techniques for predicting activity within a software application using a machine learning model. An example method generally includes generating a multidimensional time-series data set from time-series data associated with activity within a software application. The multidimensional time-series data set generally includes the time-series data organized based on a plurality of time granularities. Using a machine learning model and the generated multidimensional time-series data set, activity within the software application is predicted for one or more time granularities of the plurality of time granularities. Computing resources are allocated to execute operations using the software application based on the predicted activity within the software application.

Abstract: Certain aspects of the present disclosure provide techniques for training and using predictive models to predict the occurrence of an event within a software application. An example method generally generating a spatially sampled data set for a set of users of a software application. The spatially sampled data set includes, for each respective user of the set of users, an amount of time the user has spent, a number of discrete portions of the software application the user has visited, and an indication of whether the user has completed a defined task. A spatio-temporally sampled data set for users in the spatially sampled data set is generated, including, for each respective user in the spatially sampled data set, a plurality of candidate timestamps. A predictive model is trained based on the spatio-temporally sampled data set.

Abstract: A method including receiving a user input for input to a language processing machine learning model (MLM). The method also includes generating modified inputs that are based on, and semantically related to, the user input. The method also includes executing the MLM to generate model outputs of the MLM. The MLM takes as input instances of each of the modified inputs. The method also includes sampling the model outputs using a statistical sampling strategy to generate sampled model outputs. The method also includes clustering the sampled model outputs into clusters. Each cluster of the clusters represents a distinct semantic meaning of the sampled model outputs. The method also includes generating a confidence metric for the user input. The confidence metric includes a predictive entropy of the clusters. The method also includes routing the user input based on whether the confidence metric satisfies or fails to satisfy a threshold value.

Abstract: A method comprising generating, during multiple user sessions of a first user with a software application, first clickstream data from the multiple user sessions, and extracting, from the first clickstream data, a first plurality of task instances of the first user performing a first plurality of tasks. The method also includes decomposing, from the first clickstream data, each task instance of the first plurality of task instances into a first plurality of steps to obtain a first plurality of decomposed task instances. The first plurality of steps in the first plurality of decomposed task instances are each associated with a timestamp. The method further includes training a first user model with the first plurality of decomposed task instances to learn a user optimal order to perform the first plurality of tasks and presenting, to the first user, the user optimal order to perform the first plurality of tasks.

Abstract: Certain embodiments of the present disclosure provide techniques for identifying and blocking anomalous transactions within a computing system. An example method generally includes selecting a set of accounts for analysis. For each respective account, an anomaly score is calculated based on an account number associated with the respective account and transaction amounts associated with the respective account. An aggregated anomaly score is generated for each respective account provider of a plurality of account providers based on the anomaly score associated with each respective account. The aggregated anomaly score for each respective account provider is normalized based on a historical minimum and historical maximum anomaly score for the respective account provider. One or more account providers that are potential targets of anomalous activity are identified.

Abstract: Systems and methods for tracking anonymous visitors of an online website or mobile app are disclosed. The browsing activity by an anonymous visitor of the online website or mobile app is converted into features and a visitor-identifier associated with the browsing activity generated by the anonymous visitor is determined. The features are stored with the visitor-identifier in a super-visitor-state before the visitor-identifier is associated with a super-visitor-identifier. After the visitor-identifier is associated with the super-visitor-identifier, the features are stored with the super-visitor-identifier in the super-visitor-state. After the visitor-identifier is associated with the super-visitor-identifier, the features associated with the visitor-identifier in the super-visitor-state may be combined, e.g., aggregated, with the features associated with the super-visitor-identifier and the visitor-identifier may be removed from the super-visitor-state.

Abstract: Described herein are example implementations for handling of phishing attempts. A system receives a request to perform an electronic transaction, with the request including information regarding a user account. The system generates one or more probabilities of the request being valid based on the request and processing of a plurality of electronic transactions associated with one or more user accounts, identifies whether the request is valid based on the one or more probabilities, and in response to identifying that the request is not valid, provides an indication that the request is not valid.

Abstract: Certain aspects of the present disclosure provide techniques for privacy preserving sharing and validation of sensitive information in a computing environment. An example method generally includes generating a hashed value of a sensitive data item. A set of modulo values is calculated for the hashed value of the first sensitive data item using a set of prime numbers between an upper bound number and a lower bound number. A request to validate the first sensitive data item is transmitted to a target computing system. The request includes the set of prime numbers and the set of modulo values. An indication of whether a match was found for each respective modulo value in the set of modulo values is received from the target computing system, and a request associated with the first sensitive data item is processed based on the indication.

Abstract: Certain aspects of the present disclosure provide techniques for efficient data parity. Embodiments include receiving, by a first data consuming component, from a publication service, a plurality of database change records indicating changes to an underlying data source. Embodiments include updating, by the first data consuming component, a secondary data store based on the plurality of database change records. Embodiments include selecting a sample subset of the plurality of database change records based on one or more conditions. Embodiments include, for each respective database change record in the sample subset that has already been consumed by a second data consuming component that updated a primary data store based on one or more database change records: comparing the respective database change record to first data from the primary data store that corresponds to the respective database change record and making a parity determination based on the comparing.

Abstract: Certain aspects of the present disclosure provide techniques for configuring a software application through a remote configuration service. An example method generally includes receiving, from a remote configuration service, a declarative construct. Generally, the declarative construct includes a definition of a workflow in an application to be executed within a player application deployed on a client device. Information associated with the definition of the workflow is extracted by parsing the declarative construct according to a schema defining a format of the declarative construct. The workflow is executed in the player application based on the extracted information defining functionality of the workflow.

Abstract: Systems and methods dynamically extracting n-grams for automated vocabulary updates. Text is received. An n-gram extracted from the text is matched to a canonical n-gram from a vocabulary to identify a tag for the text. An n-gram weight is computed for the n-gram extracted from the text. The n-gram weight may be computed by adjusting a term frequency of the n-gram. A relevancy score is computed for the tag using the n-gram weight and using an n-gram frequency of the canonical n-gram. The relevancy score is computed by dividing the n-gram weight by a value proportional to the n-gram frequency of the canonical n-gram. The relevancy score of the n-gram is presented.

Abstract: Certain aspects of the present disclosure provide techniques for generating a user interface to prompt users of a software application to perform an action in the software application. The method generally includes generating historical transaction time gap data for transactions in the account. A probability distribution is generated based on the historical time gap data. The probability distribution represents a probability that a transaction related to the account has been performed after an elapsed time from a previous transaction. A probability that an unrecorded transaction exists for an account based on the probability distribution and a time difference between a most recent transaction and a current time. The probability that an unrecorded transaction exists is determined to exceed a threshold probability, and a user interface is generated and displayed to a user of the software application including a prompt for the user to enter new transactions for the account.

Abstract: Incoming data requests from the perspective of the data lake, are gathered and analyzed to determine the usage of the data. Using the perspective of the data lake avoids the technical challenge of analyzing data usage by different computation points, which are at different locations, perform hard-to-track different operations, and are often reachable only through complicated access protocols. Another technical challenge of mapping between an object path and a table path is solved by generating object path datasets and table path datasets at different levels of abstractions. A comparison is performed, iteratively, from a lower level of granularity and the granularity is increased in the progressive steps. Matches from iterations are unionized to generate a final matching data. Observability metrics are generated using final matching data and are used to perform downstream operations such as controlling data table access, moving data tables to cold storage, decommissioning unused pipelines, etc.

Abstract: Certain aspects of the present disclosure provide techniques for managing a search engine based on search performance metrics. An example method generally includes dividing a set of search history data into a first subset of search history data and a second subset of search history data. The first subset of data is associated with interaction with search results, and the second subset of data is associated with non-interaction with search results. A first quality score is generated for searches in the first subset of data. A second quality score is generated for searches in the second subset of data based on different search intents identified for each temporally related group in the second subset of data. An overall quality score is generated for a search engine, and one or more actions with respect to the search engine are taken based on the overall quality score.

Abstract: Certain aspects of the present disclosure provide techniques for enumerating relationships in an object graph using traversal context objects that are decoupled from the implementation details of an object graph and the objects stored therein. An example method generally includes receiving a request to traverse an object graph, the object graph including a plurality of objects. A root context object is generated, and a traversal context object associated with a root node of the object graph is generated. The traversal context object is linked to the root context object and added to a traversal data structure. The graph is traversed by adding and removing traversal context objects to and from the traversal data structure until a terminating event occurs.

Abstract: Aspects of the present disclosure provide techniques for classifying a trip. Embodiments include receiving, from a plurality of users, a plurality of historical trip records. Each of the plurality of historical trip records may comprise one or more historical trip attributes and historical classification information. Embodiments include training a predictive model, using the plurality of historical trip records, to classify trips based on trip records. Training the predictive model may comprise determining a plurality of hot spots based on the historical trip records, each of the plurality of hot spots comprising a region encompassing one or more locations, and associating, in the predictive model, the plurality of hot spots with historical classification information. Embodiments include receiving, from a user, a new trip record comprising a plurality of trip attributes related to a trip and using the predictive model to predict a classification for the trip based on the trip record.

Abstract: A server computer hosting an extended reality world receives a first transmission over a communication network from a computing device associated with a user, the first transmission including a request for the user to access the extended reality world. The server computer transmits a presentation of the extended reality world to the communication device over the communications network based at least in part on the request, and displays the presentation of the extended reality world on the computing device, where the presentation includes at least an avatar associated with the user. The server computer receives a command for the avatar to store a phrase selected by the user in a location associated with a virtual object within the extended reality world. The server computer displays, within the presentation of the extended reality world on the computing device, the avatar storing the phrase at the location in the extended reality world.