Abstract: Systems and methods are disclosed for news events detection and visualization. In accordance with one implementation, a method is provided for news events detection and visualization. The method includes, for example, obtaining a document, obtaining from the document a plurality of tokens, obtaining a document vector based on a plurality of frequencies associated with the plurality of tokens, obtaining one or more clusters of documents, each cluster associated with a plurality of documents and a cluster vector, determining a matching cluster from the one or more clusters based at least on the similarity between the document vector and the cluster vector of the matching cluster, and updating a database to associate the document with the matching cluster.

Abstract: A history preserving data pipeline computer system and method. In one aspect, the history preserving data pipeline system provides immutable and versioned datasets. Because datasets are immutable and versioned, the system makes it possible to determine the data in a dataset at a point in time in the past, even if that data is no longer in the current version of the dataset.

Abstract: Techniques are described for facilitating performing computer-implemented financial analysis. A metric that transforms one or more time series into an output object is identified. The one or more time series are determined based on one or more input objects. The metric is applied using the one or more time series, thereby generating a particular value for the output object. One of the metric and the particular value for the output object is stored in a physical storage device.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed to assist in detection of financial malfeasance. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data (such as trades, emails or chat messages) and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster, and the clusters may be displayed and ranked based on their scores. Various embodiments may enable an analyst to review clusters of trades, emails and/or chat messages that are the most likely to reveal financial malfeasance.

Abstract: A data analysis system is proposed for providing fine-grained low latency access to high volume input data from possibly multiple heterogeneous input data sources. The input data is parsed, optionally transformed, indexed, and stored in a horizontally-scalable key-value data repository where it may be accessed using low latency searches. The input data may be compressed into blocks before being stored to minimize storage requirements. The results of searches present input data in its original form. The input data may include access logs, call data records (CDRs), e-mail messages, etc. The system allows a data analyst to efficiently identify information of interest in a very large dynamic data set up to multiple petabytes in size. Once information of interest has been identified, that subset of the large data set can be imported into a dedicated or specialized data analysis system for an additional in-depth investigation and contextual analysis.

Abstract: In one embodiment, a method comprises creating and storing an ontology for a data store in response to receiving first user input defining the ontology, wherein the ontology comprises a plurality of data object types and a plurality of object property types; creating one or more parser definitions in response to receiving second user input defining the parser definitions, wherein each of the parser definitions specifies one or more sub-definitions of how to transform first input data into modified input data that is compatible with one of the object property types; and storing each of the one or more parser definitions in association with one of the plurality of object property types.

Abstract: Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyzes (also referred to herein as “summaries” or “conclusions”) of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Abstract: Various systems and methods are provided that graphically allow health insurance company personnel to identify patient diagnoses that are not accounted for by the health insurance company. Furthermore, the various systems and methods graphically allow health insurance company personnel to identify patients that have not submitted claims for documented ailments or conditions. Thus, the health insurance company may be able to improve its chances of receiving transfer payments from other health insurance companies and/or receiving higher star ratings.

Abstract: Techniques are disclosed for prioritizing a plurality of clusters. Prioritizing clusters may generally include identifying a scoring strategy for prioritizing the plurality of clusters. Each cluster is generated from a seed and stores a collection of data retrieved using the seed. For each cluster, elements of the collection of data stored by the cluster are evaluated according to the scoring strategy and a score is assigned to the cluster based on the evaluation. The clusters may be ranked according to the respective scores assigned to the plurality of clusters. The collection of data stored by each cluster may include financial data evaluated by the scoring strategy for a risk of fraud. The score assigned to each cluster may correspond to an amount at risk.

Abstract: A computer-based crime risk forecasting system and corresponding method are provided for generating crime risk forecasts and conveying the forecasts to a user. With the conveyed forecasts, the user can more effectively gauge both the level of increased crime threat and its potential duration. The user can then leverage the information conveyed by the forecasts to take a more proactive approach to law enforcement in the affected areas during the period of increased crime threat.

Abstract: A mobile data analysis system is provided that enables mobile device location tracking, secure messaging, and real-time sharing of intelligence information, among other features. In one embodiment, a method and apparatus is provided for creating data objects from one or more digital images captured by a mobile device. A computing device receives a first digital image file comprising first image metadata, wherein the first image metadata includes one or more image properties each having an image property value. The computing device transforms one or more of the image property values of the one or more image properties into one or more particular values. The computing device populates one or more data object property values of a data object with the one or more particular values. The computing device stores the data object in a data repository.

Abstract: Embodiments of the present disclosure relate to a computer system and interactive user interfaces configured to enable efficient and rapid access to multiple different data sources simultaneously, and by an unskilled user. The unskilled user may provide simple and intuitive search terms to the system, and the system may thereby automatically query multiple related data sources of different types and present results to the user. Data sources in the system may be efficiently interrelated with one another by way of a mathematical graph in which nodes represent data sources and/or portions of data sources (for example, database tables), and edges represent relationships among the data sources and/or portions of data sources. For example, edges may indicate relationships between particular rows and/or columns of various tables. The table graph enables a compact and memory efficient storage of relationships among various disparate data sources.

Abstract: According to certain aspects, a computer system may be configured to aggregate and analyze data from a plurality of data sources. The system may obtain data from a plurality of data sources, each of which can include various types of data, including email data, system logon data, system logoff data, badge swipe data, employee data, job processing data, etc. associated with a plurality of individuals. The system may also transform data from each of the plurality of data sources into a format that is compatible for combining the data from the plurality of data sources. The system can resolve the data from each of the plurality of data sources to unique individuals of the plurality of individuals. The system can also determine an efficiency indicator based at least in part on a comparison of individuals of the unique individuals that have at least one common characteristic.

Abstract: A mapping system comprising processes for creating and displaying structured geotagged data using interactive digital geographic imagery is disclosed. In one embodiment, a mapping system comprises processes and logic for creating a geo tag for structured data. A user creates a geo tag for a property of an object by selecting a geographic location on an interactive digital map and selecting the property of the object from a dialog presented to the user in response to selecting the geographic location. In this way, the user can more quickly and easily create structured geotagged data than can be accomplished using typical approaches requiring the user to manually enter geographic coordinates to associate a geographic location with structured data.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes accessing information describing network traffic between network devices. A network topology of the network is determined based on the information describing network traffic, where the network topology includes nodes connected by an edge to one or more other nodes, and each node is associated with a network device and each edge represents two nodes that can communicate with each other. User account access information indicating access rights and/or access records may be overlaid on the network topology and the system can provide various visualizations of the network topology to illustrate security risks associated with specific user accounts or nodes, identify compromise values/likelihoods/risks of particular user accounts and/or network accounts, and identify network segmentation issues, among others.

Abstract: Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.