Abstract: Techniques related to a domain-specific language for dataset transformations are disclosed. A server computer may process a table definition composed in a domain-specific language. The table definition may include a sequence of one or more dataset transformations to be performed on one or more source tables to generate a target table. The sequence may include a customized transformation. A source dataset may be provided as input to an implementation of the customized transformation. An output dataset may be generated as a result of executing the implementation. An intermediate table may be generated based on performing at least one dataset transformation on a particular source table. A supplemental portion for the intermediate table may be generated based on performing the at least one dataset transformation on an appended portion of the particular source table. The target table may be generated based on combining the supplemental portion with the intermediate table.

Abstract: In one embodiment, a method comprises creating and storing an ontology for a data store in response to receiving first user input defining the ontology, wherein the ontology comprises a plurality of data object types and a plurality of object property types; creating one or more parser definitions in response to receiving second user input defining the parser definitions, wherein each of the parser definitions specifies one or more sub-definitions of how to transform first input data into modified input data that is compatible with one of the object property types; and storing each of the one or more parser definitions in association with one of the plurality of object property types.

Abstract: Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a tiled display of the groups of related data clusters such that the analyst may quickly and efficiently evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation.

Abstract: In one embodiment, a method comprises creating and storing, in a revisioning database, one or more data objects; wherein a first plurality of the data objects is associated with a base realm representing data shared across all users of the database; wherein a second plurality of the data objects is associated with one or more child realms, wherein each of the child realms represents data local to a project, wherein each of the users is associated with one or more of the child realms; wherein the revisioning database associates each data object to a realm identifier value and to a version identifier value for a plurality of versions of the data object, wherein each of the versions represents a change to the data object by any of a plurality of users; receiving a request from a first user to view a third plurality of data objects in the revisioning database; selecting, based on the base realm, the particular realm, the version identifier value for the data objects in the third plurality, and one or more rules a

Abstract: Techniques related to a domain-specific language for dataset transformations are disclosed. A server computer may process a table definition composed in a domain-specific language. The table definition may include a sequence of one or more dataset transformations to be performed on one or more source tables to generate a target table. The sequence may include a customized transformation. A source dataset may be provided as input to an implementation of the customized transformation. An output dataset may be generated as a result of executing the implementation. An intermediate table may be generated based on performing at least one dataset transformation on a particular source table. A supplemental portion for the intermediate table may be generated based on performing the at least one dataset transformation on an appended portion of the particular source table. The target table may be generated based on combining the supplemental portion with the intermediate table.

Abstract: Systems, methods, and graphical user interfaces are disclosed that assist a user in deconflicting concurrency conflicts in a peering network in which ambiguous concurrency conflicts can arise. In accordance with some embodiments, a method for assisting a user in deconflicting concurrency conflicts is disclosed. The method includes detecting a plurality of ambiguous data conflicts between the local deployment and the peer deployment. The method further includes providing a graphical user interface to a user at the local deployment that allows the user to filter the plurality of ambiguous data conflicts according to a selected data conflict type of a plurality of predefined data conflict types selectable by the user through the graphical user interface. By providing such as graphical user interface, the user can easily filter a large number (e.g., hundreds) of ambiguous concurrency conflicts that may exist at a given time between the local deployment and the peer deployment.

Abstract: Various systems and methods are provided that allow reviewers to properly and timely label communications and easily view such communications. Certain systems and methods organize one or more communications in a tile layout so that reviewers can properly and timely label communications. A reviewer can hover over any of the communications to view more details regarding the communication and/or label the communication. For example, while the cursor is placed over the displayed communication, the reviewer can provide a command, such as a key command. Once the command is provided, the displayed communication is labeled with a label associated with the command.

Abstract: Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.

Abstract: A computer system identifies malicious Uniform Resource Locator (URL) data items from a plurality of unscreened data items that have not been previously identified as associated with malicious URLs. The system can execute a number of pre-filters to identify a subset of URLs in the plurality of data items that are likely to be malicious. A scoring processor can score the subset of URLs based on a plurality of input vectors using a suitable machine learning model. Optionally, the system can execute one or more post-filters on the score data to identify data items of interest. Such data items can be fed back into the system to improve machine learning or can be used to provide a notification that a particular resource within a local network is infected with malicious software.

Abstract: A context-sensitive viewing system is disclosed in which various data visualizations, also referred to a contextual views, of a common set of data may be viewed by a user on an electronic device. Data in the system may comprise data objects and associated properties and/or metadata, and may be stored in one or more electronic data stores. As a user of the system views and manipulates a first contextual view of a set of data objects, one or more other contextual views of the same set of data objects may be updated accordingly. Updates to the secondary contextual views may, in various embodiments, happen real-time. Further, the secondary contextual views may be visible to the user simultaneously with the primary contextual view. A user may switch from one view to another, and may manipulate data in any view, resulting in updates in the other views.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for analyzing various entity data items including users, computing devices, and IP addresses, to detect malfeasance. The data and/or database items may be automatically analyzed to detect malfeasance, such as criminal activity to disguise the origins of illegal activities. Various money laundering indicators or rules may be applied to the entity data items to determine a likelihood that money laundering is occurring. Further, the system may determine one or more scores (and/or metascores) for each entity data item that may be indicative of a likelihood that it is involved in money laundering. Scores/metascores may be determined based on, for example, various money laundering scoring criteria and/or strategies. Account entities may be ranked based on their associated scores/metascores. Various embodiments may enable an analyst to discover various insights related to money laundering.

Abstract: Systems and techniques for searching multiple data sources are described herein. Users may specify searches of multiple data sources to occur on a periodic basis. The searches may be configured to search time or date ranges that have not previously been searched. A user may select the data sources of interest and specify search terms, review and edit previously created searches, and review results of searches. The system automatically performs the specified searches, and notifies the user and/or a team of the user each time new results are found. The system may efficiently search the data sources by storing previous search results and comparing the previous results to current search results to identify new search results.

Abstract: Datasets are annotated with metadata including categories. Each category corresponds to one or more fields. A hierarchy mapping is generated to indicate a hierarchical relationship between different categories. A natural language query specifies a first granularity level indicating a particular category and one or more field values corresponding to the particular category. Based on the hierarchy mapping, one or more categories that are hierarchically related to the particular category are identified. Based on the metadata, two or more datasets that include at least one hierarchically related category is selected. Based on the first granularity level, one or more dataset filters are generated. The one or more dataset filters are translated to a second granularity level corresponding to the at least one hierarchically related category. The translated filters are applied to at least one of the selected datasets. The two or more datasets are joined to generate a composite dataset.

Abstract: Systems and methods are disclosed for key phrase clustering of documents. In accordance with one implementation, a method is provided for key phrase clustering of documents. The method includes obtaining a first plurality of documents based at least on a user input, obtaining a statistical model based at least on the user input, and obtaining, from content of the first plurality of documents, a plurality of segments. The method also includes identifying a plurality of clusters of segments from the plurality of segments, determining statistical significance of the plurality of clusters based at least on the statistical model and the content, and providing for display a representative cluster from the plurality of tokens, the representative cluster being determined based at least on the statistical significance. The method further includes determining a label for the representative cluster based at least on the plurality of clusters and the statistical significance.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network monitoring, user account compromise determination, and user behavior database system. The system monitors network actions of user accounts including user account access across multitudes of network accessible systems, determines user account transitions, and determines different types of high-risk user behavior indicative of compromise. Network actions can be obtained from generated information by the network accessible systems, and correlated across additional data sets including contextual ones. User interfaces are generated describing network actions of user accounts, and are configured for user interaction, which cause generation of updated user interfaces and access to electronic data sources to determine information relevant to the user interaction.

Abstract: Computer implemented systems and methods are disclosed for importing data from electronic data files. In accordance with some embodiments, source electronic data files are received at a data importation system and managed by the data importation system. The data importation system may apply detector/transformer plugins to the received source electronic data files to transform the files for importation into one or more data analysis systems and/or databases. The data importation system may also receive user inputs for mapping source electronic data files to transformation templates. The inputs may include, for example, an assignment of a file format to the source electronic data file, identification of a file type identifier associated with the source electronic data file, and a mapping of a the source electronic data file to a transformation template. The data importation system may store the received inputs as a file type profile in a database.

Abstract: Embodiments of the present disclosure relate to a computer system and interactive user interfaces configured to enable efficient and rapid access to multiple different data sources simultaneously, and by an unskilled user. The unskilled user may provide simple and intuitive search terms to the system, and the system may thereby automatically query multiple related data sources of different types and present results to the user. Data sources in the system may be efficiently interrelated with one another by way of a mathematical graph in which nodes represent data sources and/or portions of data sources (for example, database tables), and edges represent relationships among the data sources and/or portions of data sources. For example, edges may indicate relationships between particular rows and/or columns of various tables. The table graph enables a compact and memory efficient storage of relationships among various disparate data sources.