Abstract: A hierarchical representation of entities relate to development of at least one product. A portion of a document is selected. For the selected portion of the document, an indication associated with at least one of the entities in the hierarchical representation is received. Based on the received indication, a link is created between the selected portion of the document and the at least one of the entities in the hierarchical representation.

Abstract: According to examples, an apparatus may include a processor and a non-transitory computer readable medium on which is stored machine readable instructions that may cause the processor to identify Internet protocol (IP) addresses and connection attributes associated with the IP addresses. The instructions may also cause the processor to train a machine learning model using the IP addresses as inputs to the machine learning model and connection contexts as outputs of the machine learning model. The machine learning model may learn a first weight matrix corresponding to the IP addresses and a second weight matrix corresponding to the connection contexts. In addition, the connection contexts may be concatenations of the connection attributes associated with a corresponding IP address.

Abstract: Network communication events are filtered to remove the network communication events having a predicted unrelatedness to beaconing. Each network communication event has a timestamp, a source entity, and a destination entity. The filtered network communication events are aggregated by unique source entity-destination entity pairs. For each unique source entity-destination entity pair, the network communication events are timestamp-sorted, time differentials between the timestamps of adjacent network communication events are calculated, and a beacon likelihood metric is calculated from the calculated time differentials. Which of the unique source entity-destination entity pairs are indicative of beaconing are identified based on the beacon likelihood metric calculated for each unique source entity-destination entity pair.

Abstract: Recommending analytic tasks based on similarity of datasets is disclosed. One example is a system including a data processor, a matching module, and a recommendation module. The data processor receives an incoming dataset via a processing system, and generates a feature vector for the incoming dataset. The matching module determines similarity measures between the generated feature vector and representative feature vectors for a plurality of datasets in a data repository, and selects at least one dataset of the plurality of datasets based on the similarity measures. The recommendation module identifies at least one analytic task associated with the selected dataset, and recommends, to a computing device via the processing system, the at least one analytic task to be performed on the incoming dataset.

Abstract: In one example implementation, a log analysis system can comprise an activity engine to monitor user activity of a computer system, a baseline engine to generate an expected baseline of a log, and an abnormality engine to compare the log to the expected baseline to identify an abnormality, compare the abnormality to a user activity volume based on a correlation between the user activity volume and the log activity, and classify the log.

Abstract: According to examples, an apparatus may include a memory on which is stored instructions that when executed by a processor, cause the processor to cluster a set of data points into a hierarchy of a plurality of clusters, in which each level of the hierarchy includes a different number of the plurality of clusters. The processor may also select a number of the plurality of clusters to be used in modeling behaviors of the plurality of clusters and for each cluster of the selected number of the plurality of clusters, determine a distribution type of the cluster. The processor may further merge the distribution types of the clusters to generate a mixture model, identify an event, evaluate the event based on the generated mixture model to determine whether the event is likely anomalous, and based on a determination that the event is likely anomalous, execute a response action.

Abstract: According to examples, an apparatus may include a processor and a memory on which are stored machine-readable instructions that when executed by the processor, may cause the processor to track traffic events and user interface (UI) events in parallel and record a first event of a hybrid test script. The first event may be recorded in a traffic mode to record one or more of the traffic events. The processor may transition from the traffic mode to a UI mode and, responsive to the transition from the traffic mode to the UI mode, may share session data between the traffic events and the UI events. Based on the session data, the processor may record a second event of the hybrid test script in the UI mode.

Abstract: An example method comprises performing for each class from a plurality of classes: constructing binary training set for the class, the binary training set including labeled cases for that class from the main training set other labeled cases from the main training set; training classifier for the class on the binary training set; computing a local calibration threshold using scores of the labeled cases in the binary training set; and adjusting all scores of the label cases in the binary training set with the local calibration threshold to meet a global decision threshold. The method also comprises determining, with the processor, a global hierarchical calibration threshold by using the adjusted scores for all classes to optimize a performance measurement of all trained classifiers. The method further comprises classifying, with the processor, a new case by using a previously trained classifier, a local calibration threshold, and the global hierarchical calibration threshold.

Abstract: Examples herein disclose via use of a physical processor, detecting a specific application programming interface (API) call to interact with an application running on a production server. Based on the detection of the specific API call, die examples assist, using the physical processor, a scanning session based on the specific API call Using the physical processor, the examples identify a modification to the application based on the scanning session.

Abstract: A first device nonce and a first Hash based Message Authentication Code (HMAC) of the first device nonce using an old password as a key is received. The received first HMAC is compared to a computed second HMAC of the received first device nonce using a stored old password as the key for a match. In response to the match, a third HMAC of a second device nonce using the stored old password as the key is computed. A change password acknowledgement message is sent to the first device that comprises the second device nonce and the third HMAC. A final secret is computed using a second device secret and the first device nonce. A new password using a key derivation function that uses the old password and the final secret is computed. Thus, a new password is generated without sending the password over a network.

Abstract: An apparatus may include a processor that may be caused to receive an authentication request to authenticate a user. The authentication request may include a one-time username associated with an identity of the user and a secret credential of the user. The processor may further identify, in a user registry, a unique user identifier based on the one-time username, and authenticate the user based on the unique user identifier and the secret credential. The apparatus may update the user registry to prevent the one-time username from being used again to identify the user for authentication.

Abstract: According to examples, an apparatus may include a processor that may automatically restore a backup copy from a remote backup storage system to a user device without a user request to do so. For example, the apparatus may, at various times without user intervention, determine whether a restoration of a backup copy of local data is to be performed based on various criteria for automatically restoring the backup copy without a user request to do so. Based on satisfaction of the criterion, the apparatus may restore the backup copy to the original location of the local data (to immediately replace the local data) and/or to a temporary location accessible to the apparatus (such as via onboard storage) from which the backup copy may replace the local data at a later time (such as on-demand).

Abstract: To write forgettable data to a blockchain, the forgettable data is transmitted to a server, from which encrypted data corresponding to the forgettable data are received. A hash of the forgettable data is generated. A data block including the encrypted data and control data including the hash is added to the blockchain.

Abstract: Example implementations relate to comparable UI object identifications. Some implementations may include a data capture engine to capture data points during test executions of the application under test. The data points may include, for example, test action data and application action data. Additionally, some implementations may include a data correlation engine to correlate each of the data points with a particular test execution of the test executions, and each of the data points may be correlated based on a sequence of events that occurred during the particular test execution. Furthermore, some implementations may also automatically identify, based on the correlated data points, a set of comparable UI objects.

Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. Contextual information is determined for the alert, the determined contextual information comprising spatial and temporal distributions of previous instances of the alert or similar alerts. The contextual information is communicated for use in addressing the issue in the computing arrangement.

Abstract: This document describes debugging multiple instances of code by detecting a variance in thread patterns of threads of execution relative to the multiple instances of executing code. A first instance of the code is executed and a first thread pattern is identified indicative of a first plurality of threads of execution of the first instance of the code. A second instance of the code is executed, the second instance of the code beginning executing prior to the first instance of the code completing executing, and a second thread pattern is identified indicative of a second plurality of threads of execution of the second instance of the code. A comparative representation of the first thread pattern and the second thread pattern is generated relative to each other. A variance between the first thread pattern and the second thread pattern relative to the comparative representation is identified, the variance typically being indicative of a bug in the code.

Abstract: A log event cluster analytics management method may involve storing a first portion of an entire cluster dictionary in a transient memory, storing at least a second portion of the entire cluster dictionary in a persistent database and comparing a new log event message to the first portion of the overall cluster dictionary. In response to not assigning the new log event message to any cluster in the first portion of the entire cluster dictionary in the transient memory, selecting a subset of clusters of the at least second portion of the cluster dictionary in the persistent database, comparing the new log event message to a cluster of the selected subset of clusters and assigning the new log event message to the cluster of the selected subset of clusters based upon the comparison.

Abstract: A technique includes performing optimistic concurrency control to process a request associated with a transaction to change a schema of an object. Performing the optimistic concurrency control includes locally modifying the object to change the schema of the object based on the request; after locally modifying the object, locking a global catalog to block the object from being globally modified; validating the locally modified object based on the global catalog; and committing the modified object to a globally shared storage in response to the modified object being validated.

Abstract: In examples, a system adaptively orders a set of regular expressions based on frequencies that respective regular expressions of the set of regular expressions match a set of messages, the adaptive ordering to produce an adaptively ordered set of regular expressions. The system determines, for a first message of the set of messages, whether a plurality of regular expressions of the adaptively ordered set of regular expressions match the first message. The system constructs a bi-directional graph representing the plurality of regular expressions that match the first message, and classifies a second message based on the adaptively ordered set of regular expressions and the bi-directional graph.

Abstract: A token generating organization may include distributed tokenization systems for generating tokens corresponding to sensitive information. Sensitive information may include sensitive numbers such as social security numbers, credit card numbers or other private numbers. A tokenization system may include multiple physically distinct hardware platforms each having a tokenization server and a database. A tokenization server may run portions of a sensitive number through a predetermined number of rounds of a Feistel network. Each round of the Feistel network may include tokenizing portions of the sensitive number using a fractional token table stored an associated database and modifying the tokenized portions by reversibly adding portions of the sensitive number to the tokenized portions. The fractional token table may include partial sensitive numbers and corresponding partial tokens.