Abstract: Examples for graph database query classification include receiving a graph query and determining if the graph query matches benchmark data. In the event that the graph query does not match benchmark data, the query may be parsed, a canonical internal representation of the query may be determined, the representation may be mapped to a rule, and the query may be classified based on the rule. In the event that the confidence score for the query classification does not exceed a threshold, the query may be sent to a synthetic graph or synopsis for simulation. In some examples, the simulation may include selecting computationally expensive graph operators in the query for simulation.

Abstract: Examples disclosed herein relate to visualization of associations among data records in a security information sharing platform. Some examples may enable creating, in the security information sharing platform, an association between a first data record comprising a security indicator, and a second data record. Some examples may further enable providing a visual representation of the first data record, the second data record, and the association, wherein the first data record represents a first node in the visual representation, the second data record represents a second node in the visual representation, and the association represents an edge that connects the first node and the second node.

Abstract: Examples disclosed herein relate to encryption of community-based security information. Some examples may enable authorizing a user of a community to access an encrypted data item (e.g., at least an encrypted portion of community-based security information of that community) using a decryption key. The community may be generated on a security information sharing platform based on a set of community attributes. The decryption key may comprise a private key corresponding to each user attribute of a set of user attributes that are associated with the authorized user where the set of user attributes satisfy the set of community attributes.

Abstract: An apparatus may include a processor that may access first Information Technology Service Management (ITSM) information of a first ITSM system to be retired. The apparatus may train, based on the first ITSM information, a routing model used to route tickets. New tickets in the second ITSM system may be routed based on the routing model. Results of the routing may be used to retrain the routing model. The apparatus may also determine a knowledge base from the first ITSM information to resolve requests in the second ITSM system. Results of the resolutions requests such as tickets or queries determined from the knowledge base may be used to update/retrain the knowledge base. The second ITSM system may therefore use machine learned models seeded from the first ITSM information and retrain the models based on usage and evaluation of results of routing and resolutions of the second ITSM system.

Abstract: Examples disclosed herein relate to triggering a high availability feature in response to detecting impairment of client experience. Examples include detecting, based on content of interactions between at least one application component and a client, a threshold impairment of an experience of the client in relation to the at least one application component. Examples also include triggering a high availability feature for the at least one application component in response to detecting the threshold impairment.

Abstract: A technique includes determining a statistic for values associated with at least one column of a database based at least in part on a first sample of the values; and determining a degree of change in a second sample of the values relative to the first sample; and estimating a count of unique values for the column(s). The estimation of the count of unique values includes selectively incrementally updating the statistic using the second sample based at least in part on the determined degree of change; and basing estimation of the count at least in part on the updated statistic. The technique further includes processing a query to the database based at least in part on the count.

Abstract: An apparatus may include a processor that may access and analyze a live log stream of activity of the containerized service and determine whether the containerized service is able to provide a capability of the service based on the analysis. For example, the processor may determine whether the containerized service is executing but is in a hung state and cannot provide the capability. To do so, the processor may parse the live log stream for comparison with log patterns that indicate that the service is no longer able to provide the capability. The patterns may be generated based on observations of output by services that are hung or otherwise cannot provide their respective capabilities. The processor may cause the container to be restarted when the analysis indicates that the capability is not being provided by the containerized service, such as when the containerized service is in a hung state.

Abstract: A virtual desktop infrastructure (VDI) server is to receive a request from a client device to access an application on an application server, establish a session between the VDI server and the application server to allow the client device to access the application on the application server via the VDI server, obtain a process identifier of the session, obtain identity information of a user of the client device associated with a communication of the session based on the process identifier, and provide identity details of the user of the client device associated with the communication of the session to a monitor device that monitors access to the application on the application server.

Abstract: In some examples, a window in an image may be identified. At least one property of the window may be identified. Based on the at least one property, whether the window is an error block may be determined.

Abstract: In some examples, for a device that transmitted domain names, a system determines a dissimilarity between the domain names, compares a value derived from the determined dissimilarity to a threshold, and identifies the device as malware infected in response to the comparing.

Abstract: Examples disclosed herein relate to accessing electronic databases. Some examples disclosed herein may include partitioning a computation task into subtasks. A processing node of a computation engine may generate a database query for retrieving an electronic data segment associated with at least one of the subtasks from a database. The database query may include pre-processing instructions for a database management system (DBMS) associated with the database to pre-process the electronic data segment before providing the electronic data segment to the processing node. The pre-processing instructions may include at least one of: filtering, projection, join, aggregation, count, and user-defined instructions. The generated query may be provided to the DBMS.

Abstract: In one example in accordance with the present disclosure, a method for threat score determination includes detecting a change in malicious activity for a security object. The method also includes identifying an indicator that provides contextual information for the security object and determining a linked resource that is associated with a database record of the security object. The method also includes determining a first threat score associated with the security object and determining a relationship between the linked resource and the security object. The method also includes determining a second threat score associated with the linked resource based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.

Abstract: In one example, a system for topic image flows can include a processing resource and a non-transitory computer readable medium having stored thereon instructions to cause the processing resource to generate an image flow of a plurality of topic headers when a user scroll speed of a document including text exceeds a threshold scroll speed, receive a selection of a topic header from the plurality of topic headers, and display, on a user interface, a portion of the document that corresponds to the selected topic header from the plurality of topic headers.

Abstract: In some examples, with respect to hash offset based key version embedding, data that is to be encrypted may be ascertained, and a key, including a key version, that is to be used to encrypt the ascertained data may be ascertained. Encrypted data may be generated by encrypting the ascertained data based on the ascertained key, and hashed encrypted data may be generated by performing a hash operation on the encrypted data. Further, offset hashed encrypted data may be generated by embedding the key version into the hashed encrypted data, and the offset hashed encrypted data including the embedded key version may be stored.

Abstract: Examples relate to detecting vulnerabilities in a web application. One example enables identifying a set of inputs in a web application input form. The set of inputs may be categorized based on a set of predetermined conditions. The set of inputs may be scored based on the categorization. A subset of the set of inputs may be determined to be a set of parameters of interest for the web application based on the scored set of inputs.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Examples disclosed herein relate, among other things, to a method. The method may obtain a time series comprising a plurality of data points associated with a sub-segment of a segment, obtaining a plurality of weights associated with a plurality of data point pairs from the plurality of data points, and based on the plurality of weights and the plurality of data point pairs, determine whether the time series comprises a trend. Based on a determination that the time series comprises a trend, the method may calculate a trend score for the trend based on at least one characteristic of at least one of the segment and the sub-segment, and provide the trend for display.

Abstract: Example embodiments relate to parallelizing structured query language (SQL) user defined transformation functions. In example embodiments, a subquery of a query is received from a query engine, where each of the subqueries is associated with a distinct magic number in a magic table. A user defined transformation function that includes local, role-based functionality may then be executed, where the magic number triggers parallel execution of the user defined transformation function. At this stage, the results of the user defined transformation function are sent to the query engine, where the query engine unions the results with other results that are obtained from the other database nodes.

Abstract: The life cycle of an application can be shortened by initiating the creation of a mock-up test script before the development of an application is complete. The concurrent creation of the mock-up test script and the application can reduce a time associated with the life cycle of an application. Mock-up test script creation is based on the user interface (UI) specification and a mock-up graphical user interface (GUI) without business logic. Test script creation can include associating a functional specification and a UI specification with a proposed application and creating a mock-up GUI for testing based on the UI specification. Test script creation can include developing an application based on the proposed application that includes a logic based on the functional specification and a GUI based on the UI specification and creating a mock-up test script based on the mock-up GUI and not based on the logic, the functional specification, and the GUI.

Abstract: Examples relate to automated multi-credential assessment in a system. One example enables auditing an application by sending a first request for an action to be performed in the application, the first request based on a first privilege level, where the first privilege level corresponds with a first level of access to the application, and sending a second request for the action to be performed in the application, where the second request based on a second privilege level different from the first privilege level. The second privilege level may corresponds with a second level of access to the application different from the first level of access. The first request and second request may be performed, and the results of the performed first request and second request may be combined. The combined results may be made available.