Abstract: Techniques for cross-ACL multi-master replication are provided. The techniques allow a replication site in a multi-master replication system implementing an asynchronous replication protocol and an access control policy to appropriately apply received data change updates to data maintained at the site even where a data change update is missing information because of the implemented access control policy.

Abstract: Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.

Abstract: The display of a multi-column table can be optimized. For example, a container, such as a multi-column table, can have a first container width. The container includes first text, second text, and a divider, such as an icon, whitespace, or text, between the first text and the second text. The first text, the second text, and the divider can have a combined text width. The container can be resized to a second container width that is smaller than the first container width. If it is determined that the combined text width is then greater than the second container width, the first text, the second text, or both can be abbreviated until the combined text width is less than the second container width.

Abstract: Techniques are disclosed for prioritizing a plurality of clusters. Prioritizing clusters may generally include identifying a scoring strategy for prioritizing the plurality of clusters. Each cluster is generated from a seed and stores a collection of data retrieved using the seed. For each cluster, elements of the collection of data stored by the cluster are evaluated according to the scoring strategy and a score is assigned to the cluster based on the evaluation. The clusters may be ranked according to the respective scores assigned to the plurality of clusters. The collection of data stored by each cluster may include financial data evaluated by the scoring strategy for a risk of fraud. The score assigned to each cluster may correspond to an amount at risk.

Abstract: One embodiment of the present invention sets forth a method for generating a new workflow for an application. The method includes generating a parameter tree related to a current workflow, wherein the parameter tree includes a different node corresponding to each parameter included in one or more documents associated with the current workflow, modifying a value associated with a first node included in the parameter tree based on an input, wherein the first node corresponds to a first parameter included in a first document associated with the current workflow, evaluating a second document associated with the current workflow based on the modified value associated with the first node, and generating the new workflow based on the evaluated second document.

Abstract: A system and a method enable an information analyst to use a stand-alone computer-based investigation application to conduct a disconnected investigation on shared database data in a remote location where network access to a shared data repository of the system might be only periodically available, unreliable, or non-existent. In addition, the system and method enable the disconnected investigation to incrementally incorporate ongoing updates made to the shared repository of data, and to periodically publish interim or final results of the disconnected investigation to the shared data repository. A disconnected investigation can be conducted entirely at the disconnected investigation location without having any network connectivity to the shared repository of data.

Abstract: An interactive, customizable, user interaction data analysis system is disclosed. The system may be configured to provide cohort-based analysis and/or graphical visualizations of user interaction data to a system operator. User interaction data may be obtained, for example, as users interact with one or more software applications. In various embodiments, interactive and customizable visualizations and analysis provided by the system may be based on user interaction data aggregated across groups of users (also referred to as cohorts of users), across particular time frames, and/or from particular software and/or computer-based applications. According to various embodiments, the system may enable insights into, for example, user interaction patterns, the frequency of software application features accessed, the performance of various aspects of software applications, and/or crashes of software applications, among others.

Abstract: An interactive data object map system is disclosed in which large amounts of geographical, geospatial, and other types of data, geodata, objects, features, and/or metadata are efficiently presented to a user on a map interface. The interactive data object map system allows for rapid and deep analysis of various objects, features, and/or metadata by the user. A layer ontology may be displayed to the user. In various embodiments, when the user rolls a selection cursor over an object/feature an outline of the object/feature is displayed. Selection of an object/feature may cause display of metadata associated with that object/feature. The interactive data object map system may automatically generate feature/object lists and/or histograms based on selections made by the user. The user may perform geosearches, generate heatmaps, and/or perform keyword searches, among other actions.

Abstract: A data analysis system is proposed for providing fine-grained low latency access to high volume input data from possibly multiple heterogeneous input data sources. The input data is parsed, optionally transformed, indexed, and stored in a horizontally-scalable key-value data repository where it may be accessed using low latency searches. The input data may be compressed into blocks before being stored to minimize storage requirements. The results of searches present input data in its original form. The input data may include access logs, call data records (CDRs), e-mail messages, etc. The system allows a data analyst to efficiently identify information of interest in a very large dynamic data set up to multiple petabytes in size. Once information of interest has been identified, that subset of the large data set can be imported into a dedicated or specialized data analysis system for an additional in-depth investigation and contextual analysis.

Abstract: Computer-implemented systems and methods are disclosed for distance and congestion-aware resource deployment. In some embodiments, a method is provided to estimate a vehicle deployment region. The method includes constructing a graph data structure using at least in part a single invocation of a form of Dijkstra's algorithm. The method additionally includes partitioning an angular space centered on a vehicle location into a plurality of angular space regions, the vehicle location corresponding to a current or potential location of the vehicle.

Abstract: Techniques are disclosed for generating a collection of clusters of related data from a seed. Doing so may generally include retrieving a seed and adding the seed to a first cluster and include retrieving a cluster strategy referencing one or more data bindings. Each data binding specifies a search protocol for retrieving data. For each of the one or more data bindings, data parameters input to the search protocol are identified, the search protocol is performed using the identified data parameters, and data returned by the search protocol is evaluated for inclusion in the first cluster.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Abstract: Techniques for cross-ACL multi-master replication are provided. The techniques allow a replication site in a multi-master replication system implementing an asynchronous replication protocol and an access control policy to appropriately apply received data change updates to data maintained at the site even where a data change update is missing information because of the implemented access control policy.

Abstract: When an authentication attempt is made to gain access to a secure environment is made, a notification is transmitted to the user associated with the user identification used in the authentication attempt. If the user who receives the notification did not make the authentication attempt, then the user alerts the appropriate parties of a breach in security.

Abstract: One embodiment of the present invention sets forth a method for generating a new workflow for an application. The method includes generating a parameter tree related to a current workflow, wherein the parameter tree includes a different node corresponding to each parameter included in one or more documents associated with the current workflow, modifying a value associated with a first node included in the parameter tree based on an input, wherein the first node corresponds to a first parameter included in a first document associated with the current workflow, evaluating a second document associated with the current workflow based on the modified value associated with the first node, and generating the new workflow based on the evaluated second document.

Abstract: A computer-based investigative analysis system is disclosed in which a user can share results of an investigation with other users in a way that allows the sharing user to visualize how the results will be shared before they are shared. The results are shared in the form of a visual graph having nodes, edges, and other presentation elements. The nodes represent data objects that are the subject of the investigation and the edges represent connections between the data objects. The graph is shared in the form of an automatically generated redacted graph omitting nodes, edges, and presentation elements for which the other users do not have permission to view. Before sharing the graph, the sharing user is presented with a visualization of the automatically generated redacted graph providing the user an opportunity to confirm that sharing the redacted graph will not constitute an unauthorized information leakage.

Abstract: A system and method providing cross-ontology multi-master replication is described. In a first embodiment a method for cross-ontology multi-master replication comprising the steps of: obtaining, at an importing site, an exporting site ontology and a set of one or more database changes; wherein the exporting site ontology defines a set of one or more data types; and after mapping the exporting site ontology to an importing site ontology, incorporating the set of one or more database changes into a database including mapping each of one or more data types of the set of data types to a data type defined by the importing site ontology using an ontology map.

Abstract: A context-sensitive viewing system is disclosed in which various data visualizations, also referred to a contextual views, of a common set of data may be viewed by a user on an electronic device. Data in the system may comprise data objects and associated properties and/or metadata, and may be stored in one or more electronic data stores. As a user of the system views and manipulates a first contextual view of a set of data objects, one or more other contextual views of the same set of data objects may be updated accordingly. Updates to the secondary contextual views may, in various embodiments, happen real-time. Further, the secondary contextual views may be visible to the user simultaneously with the primary contextual view. A user may switch from one view to another, and may manipulate data in any view, resulting in updates in the other views.

Abstract: Techniques are disclosed for prioritizing a plurality of clusters. Prioritizing clusters may generally include identifying a scoring strategy for prioritizing the plurality of clusters. Each cluster is generated from a seed and stores a collection of data retrieved using the seed. For each cluster, elements of the collection of data stored by the cluster are evaluated according to the scoring strategy and a score is assigned to the cluster based on the evaluation. The clusters may be ranked according to the respective scores assigned to the plurality of clusters. The collection of data stored by each cluster may include financial data evaluated by the scoring strategy for a risk of fraud. The score assigned to each cluster may correspond to an amount at risk.

Abstract: A batching module that inspects call stacks within a stack evaluator to identify current expressions that can be evaluated in batch with other expressions. If such expressions are identified, the corresponding stacks are blocked from further processing and a batch processing request for processing the expressions is transmitted to the application server. The application server processes the expressions in batch and generates a value for each of the expressions. The blocked stacks are then populated with the values for the expressions.