Abstract: A computer system identifies malicious Uniform Resource Locator (URL) data items from a plurality of unscreened data items that have not been previously identified as associated with malicious URLs. The system can execute a number of pre-filters to identify a subset of URLs in the plurality of data items that are likely to be malicious. A scoring processor can score the subset of URLs based on a plurality of input vectors using a suitable machine learning model. Optionally, the system can execute one or more post-filters on the score data to identify data items of interest. Such data items can be fed back into the system to improve machine learning or can be used to provide a notification that a particular resource within a local network is infected with malicious software.

Abstract: A computer system is configured to generate alerts related to malicious activity on an audited computing system. The computing system is provided with instructions to receive activity information associated with activity of an entity performed in an audited computing network, access contextual information associated with the entity, determine, based on the contextual information, a set of weights associated with the activity information and combine the weight and the entity activity information to generate a risk score. In response to the risk score satisfying a threshold value, the computer system may generate an alert, and, in response to receiving a user input associated with the alert, update the set of weights. In certain embodiments, the updated weights may be used for determining the risk score of future alerts.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

Abstract: In one embodiment, a method comprises creating and storing, one or more data objects; wherein a first plurality of the data objects is associated with a base set of data representing data shared across a plurality of users; wherein a second plurality of the data objects is associated with one or more child sets of data, wherein each of the child sets of data represents data local to a project, wherein each of the users is associated with one or more of the child sets of data; wherein each data object is associated to an identifier value and to a version identifier value for a plurality of versions of the data object, wherein each of the versions represents a change to the data object by any of a plurality of users; receiving a request from a first user to view a third plurality of data objects; selecting, based on the base set of data, the particular set of data, the version identifier value for the data objects in the third plurality, and one or more rules associated with the particular set of data and the f

Abstract: A system for troubleshooting network problems is disclosed. A model can use demographic information, network usage information, and network membership information to determine an importance of a problem. The importance of the problem for the user who reported the problem, a number of other users affected by the problem, and the importance of the problem to the other users can be used to determine a priority for resolving the problem. Before and after a work order is executed to resolve the problem, network metrics can be gathered, including aggregate network metrics, and automatically presented in various user interfaces. The analysis of the metrics can be used to update a database of which work orders are assigned in response to which problems.

Abstract: An apparatus, and a method, performed by one or more processors are disclosed. The method may comprise receiving a build request associated with performing an external data processing task on a first data set, the first data set being stored in memory associated with a data processing platform to be performed at a system external to the data processing platform. The method may also comprise generating a task identifier for the data processing task, and providing, in association with the task identifier, the first data set to an agent associated with the external system with an indication of the data processing task, the agent being arranged to cause performance of the task at the external system, to receive a second data set resulting from performance of the task, and to provide the second data set and associated metadata indicative of the transformation.

Abstract: A computer system may generate alerts related to a potential cyber attack an resource of an organization. The computer system may receive activity information associated with activity on a computer network of the organization, access contextual information about the resource, determine, based on the contextual information, select, based at least in part on the contextual information, one or more indicators that are indicative of a cyber attack against the resource to form a second plurality of indicators, and generate, based at least in part on the second plurality of indicators and the contextual information, a risk score, wherein the risk score indicates a probability that the resource is at risk of a cyber attack. In response to the risk score satisfying a threshold value, the computer system may generate an alert. Alerts may be presented using a graphical user interface. Analysts' actions may be tracked for review.

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Abstract: Embodiments of the present disclosure relate to a computer system and interactive user interfaces configured to enable efficient and rapid access to multiple different data sources simultaneously, and by an unskilled user. The unskilled user may provide simple and intuitive search terms to the system, and the system may thereby automatically query multiple related data sources of different types and present results to the user. Data sources in the system may be efficiently interrelated with one another by way of a mathematical graph in which nodes represent data sources and/or portions of data sources (for example, database tables), and edges represent relationships among the data sources and/or portions of data sources. For example, edges may indicate relationships between particular rows and/or columns of various tables. The table graph enables a compact and memory efficient storage of relationships among various disparate data sources.

Abstract: Techniques for improving database searches are described herein.

Abstract: A system is configured to provide a dashboard creation system. Panels associated with queries for retrieving information from a database are shown in a user interface. Various other user interfaces show query code, panel display settings, function code, dependencies, etc. Queries in a first query format access a data source. Queries in a second query format access a cache database that is synchronized with the data source.

Abstract: Systems and methods are provided for obtaining one or more source code files that correspond to a software program. At least one first software package that is separately executable from the software program is obtained, the first software package including one or more source code files. At least one first callable library for the first software package and at least one first invocation mechanism for calling the first callable library are generated. A composite software program that is capable of invoking at least the software program and the first callable library for the first software package using the first invocation mechanism is generated.

Abstract: Systems and methods are provided for generating one or more interface objects for facilitating remote interaction between one or more client systems and a server system over a communication network, the one or more interface objects generated from a same interface definition object. The one or more interface objects are stored. A service request is received from a particular client system of the one or more client systems over the communication network. A particular interface object is selected from the one or more interface objects based on the service request. The service request is processed using the particular interface object.

Abstract: Systems and methods are provided for obtaining a build object over a communication network, the build object comprising at least a portion of a first build. The build object is stored locally. A build modification object is obtained over the communication network, the build modification object comprising a change between the first build and a second build. The build object updated using the build modification object obtained over the communication network. At least a portion of the updated build object is provided to a first peer build system over the communication network.

Abstract: One embodiment of the present invention sets forth a method for generating a new workflow for an application. The method includes generating a parameter tree corresponding to a current workflow, wherein the current workflow comprises a first document and a second document; modifying a first node of the parameter tree that corresponds to a first parameter of the first document to generate modifications of a first parameter value of the first document; and propagating modifications of the first parameter value to a second parameter of the second document to generate the new workflow; wherein the method is performed using one or more computers.

Abstract: A method of generating a supplemental user interface is disclosed. At a client system, it is detected that an alert identifying a suspicious activity that is to be reviewed by a user of the client system has been received. A template for a user interface is accessed. The template includes database queries and instructions for presenting data items derived from query results corresponding to the database queries in the user interface. The instructions include a mapping of the data items to data fields of the user interface. Data items derived from the query results are presented in the user interface based on the instructions included in the template. An audit log is updated based on an acceptance by the user of the data items presented in the user interface.

Abstract: Systems and methods are provided for generating reports reflecting a visualization of, e.g., a dataset on which data analysis has been performed. The data analysis performed on the dataset may be an aggregation of data analysis functionality provided by applications or tools. Dataset visualization is realized in a workspace implemented by a separate application or tool. Potential conflicts regarding updating one or more elements of the dataset are reconciled by implementing a dual operational transform system and method. A global state of the dataset may be determined by a first operational transform system and method, while a local state of the dataset may be determined by a second operational transform system and method. The local state of the dataset may be updated through operational transforms exchanged between the first and second operational transform systems that align the local state of the dataset with the global state of the dataset.

Abstract: Approaches for displaying a user interface including a map based on interaction data are disclosed. A set of interaction data and can be acquired and stored in a data structure. This data can be associated with a plurality of consuming entities that may have purchased something during these interactions. A set of provisioning entities can be determined based on spending or purchasing habits of the consuming entities. Based on this set of provisioning entities, a user interface can be generated which may include various shapes similar to a heat map. These shapes can indicate an average amount spent in a particular neighborhood, among other attributes.

Abstract: In one embodiment, a data processing method comprises generating impression estimate data that specifies an estimated total number of impressions of a plurality of non-program media items that are possible during future transmission of a plurality of media programs via a plurality of media channels; based on the impression estimate data, generating campaign data specifying a target number of impressions of a particular non-program media item and specifying one or more particular media channels to receive the particular non-program media item; based on the campaign data, and based upon transmission schedule data that specifies future times of transmission of the plurality of media programs via the plurality of media channels, automatically determining digitally stored promotional schedule data that specifies a plurality of times to transmit the particular non-program media item to achieve the target number of impressions; wherein the method is performed by one or more computing devices.

Abstract: Computer-implemented systems and methods are disclosed to interface with one or more storage devices storing a plurality of documents, wherein each of the plurality of documents is associated with one or more tags of one or more predefined hierarchies of tags, wherein the one or more hierarchies of tags include multiple dimensions. In accordance with some embodiments, a method is provided to identify one or more documents from the data storage devices. The method comprises acquiring, via an interface, a selection of one or more tags of the one or more predefined hierarchies of tags. The method further comprises identifying one or more documents from the data storage devices in response to the selection, the identified one or more documents having tags that have a relationship with the selected tags, and providing data corresponding to the identified documents for displaying in the interface.