Abstract: Systems and methods are provided for performing constraint driven database searching. At least one constraint is received for a search of one or more databases comprising one or more datasets, each comprising multiple entry fields. The one or more databases comprising the one or more datasets may be accessed and searched based on the constraint to identify one or more dataset entries that contain the at least one constraint in one of multiple entry fields. A visual representation of the identified dataset entries may be provided to the user as results of the constraint driven database search. Additional constraints may be accepted to further narrow the results of constraint driven database search. The results may be exported and made accessible for later retrieval and/or cached for use in subsequent searches.

Abstract: A computer system identifies malicious Uniform Resource Locator (URL) data items from a plurality of unscreened data items that have not been previously identified as associated with malicious URLs. The system can execute a number of pre-filters to identify a subset of URLs in the plurality of data items that are likely to be malicious. A scoring processor can score the subset of URLs based on a plurality of input vectors using a suitable machine learning model. Optionally, the system can execute one or more post-filters on the score data to identify data items of interest. Such data items can be fed back into the system to improve machine learning or can be used to provide a notification that a particular resource within a local network is infected with malicious software.

Abstract: The programming notebook system, methods, and user interfaces described herein provide software developers with enhanced tools by which a programming notebook workflow and session history associated with code cells in a programming notebook may be tracked and maintained. As a developer progresses through a development workflow, the developer can select an option to save a program code card representing some or all of the program code cell inputs. A card editor user interface may present an aggregated listing of all program code the developer has provided across multiple code cells during the current session which the developer can edit, refine, and/or comment. The card editor may also allow the developer to add associated user interface code to display a UI component associated with the program code card, and allow the developer to add a description and tags for the card so that the card can be searched for and reused.

Abstract: Computer implemented systems and methods are disclosed for automatically clustering and canonically identifying related data in various data structures. Data structures may include a plurality of records, wherein each record is associated with a respective entity. In accordance with some embodiments, the systems and methods further comprise identifying clusters of records associated with a respective entity by grouping the records into pairs, analyzing the respective pairs to determine a probability that both members of the pair relate to a common entity, and identifying a cluster of overlapping pairs to generate a collection of records relating to a common entity. Clusters may further be analyzed to determine canonical names or other properties for the respective entities by analyzing record fields and identifying similarities.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network monitoring, user account compromise determination, and user behavior database system. The system monitors network actions of user accounts including user account access across multitudes of network accessible systems, determines user account transitions, and determines different types of high-risk user behavior indicative of compromise. Network actions can be obtained from generated information by the network accessible systems, and correlated across additional data sets including contextual ones. User interfaces are generated describing network actions of user accounts, and are configured for user interaction, which cause generation of updated user interfaces and access to electronic data sources to determine information relevant to the user interaction.

Abstract: Computer-implemented systems and methods are disclosed for constructing a parser that parses complex data. In some embodiments, a method is provided for receiving a parser definition as an input to a parser generator and generating a parser at least in part from the parser definition. In some embodiments, the generated parser comprises two or more handlers forming a processing pipeline. In some embodiments, the parser receives as input a first string into the processing pipeline. In some embodiments, the parser generates a second string by a first handler and inputs the second string regeneratively into the parsing pipeline, if the first string matches an expression specified for the first handler in the parser definition.

Abstract: Systems and methods are disclosed for visual definitions of data associations. In accordance with one implementation, a method is provided for visual definitions of data associations. The method includes obtaining and displaying a first sample document, receiving a first input indicating selection of one or more objects within the first sample document, and determining a first set of one or more characteristics shared by the selected objects. The method also includes identifying, within one or more target documents, one or more target objects characterized by the first set of one or more characteristics, and storing object data associated with the target objects.

Abstract: Systems and techniques for indexing and/or querying a database are described herein. Multiple, large disparate data sources may be processed to cleanse and/or combine item data and/or item metadata. Further, attributes may be extracted from the item data sources. The interactive user interfaces allow a user to select one or more attributes and/or other parameters to present visualizations based on the processed data.

Abstract: Systems and methods are disclosed for collocation detection. In accordance with one implementation, a method is provided for collocation detection. The method includes obtaining a first object observation that includes a first object identifier, a first observation time, and a first observation location. The method also includes obtaining a second object observation that includes a second object identifier, a second observation time, and a second observation location. In addition, the method includes associating the first observation with a first area on a map, associating the second observation with a second area on the map, and determining whether a potential meeting occurred between objects associated with the first object identifier and the second object identifier based on the first and second observation times, and the first and second areas.

Abstract: Example embodiments described herein pertain to a geospatial interface system configured to cause display of geospatial data within a graphical user interface at a client device, receive data points from multiple data sources, unify the data points, and present the unified data points as interactive graphical elements within the graphical user interface, in a presentation layer separate from the geospatial data. In example embodiments, the geospatial interface system may be or include a group of one or more server machines configured to provide one or more geospatial data display, indexing, and management services. A client device may accordingly display a graphical user interface generated by the geospatial interface system.

Abstract: Approaches for analyzing entity performance are disclosed. A first set of data and a second set of data can be stored in a data structure. This data can be associated with a plurality of interactions, and can be modified to include additional interactions. These interactions can involve consuming entities and provisioning entities. The modified data structure can be queried to retrieve information associated with one or more entities. After information is retrieved, it can be provided to a user.

Abstract: A data integration system provides a secondary validation data store that may be used as a staging area for testing and validating data integrations for a set of structured data. Ontology data that defines a schema for integrated data may be modified and tweaked. The secondary validation data store is more efficient than a production system for such schema modifications. Once the ontology data is satisfactory, the structured data and the ontology data may be loaded into a production system.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for a checkout system executable code monitoring, and user account compromise determination system. The system monitors executable code initiating and executing on checkout systems, including determining hashes of the executable code. The system determines whether the executable code is malicious based on the hash, and associated information of the executable code. Additionally, the system monitors user access to checkout systems, and determines user accounts associated with being compromised. User interfaces are generated describing checkout systems associated with a risk of being compromised, and are configured for user interaction, which cause generation of updated user interfaces and access to electronic data stores to determine information relevant to the user interaction.

Abstract: Systems and methods are provided for generating reports reflecting a visualization of, e.g., a dataset on which data analysis has been performed. The data analysis performed on the dataset may be an aggregation of data analysis functionality provided by applications or tools. Dataset visualization is realized in a workspace implemented by a separate application or tool. Potential conflicts regarding updating one or more elements of the dataset are reconciled by implementing a dual operational transform system and method. A global state of the dataset may be determined by a first operational transform system and method, while a local state of the dataset may be determined by a second operational transform system and method. The local state of the dataset may be updated through operational transforms exchanged between the first and second operational transform systems that align the local state of the dataset with the global state of the dataset.

Abstract: Techniques for cross-ACL multi-master replication are provided. The techniques allow a replication site in a multi-master replication system implementing an asynchronous replication protocol and an access control policy to appropriately apply received data change updates to data maintained at the site even where a data change update is missing information because of the implemented access control policy.

Abstract: Aspects of the present disclosure relate to systems and methods for receiving, managing, and displaying annotations on documents in real-time. A user (e.g., an author of a document) uploads a document into a real-time annotation system, which may then generate a composite presentation based on the uploaded document. The composite presentation includes all the content of the document presented in a specially configured graphical user interface to receive and manage annotations from a plurality of user devices.

Abstract: Aspects of the present disclosure relate to computer system security. A machine accesses a set of records corresponding to a set of users having access to a computer system. The machine stores, for each user in the set of users, a baseline profile representing baseline activity of the user with respect to a set of data sources of the computer system. The machine monitors activity of the set of users with respect to the set of data sources. The machine determines, based on monitoring the activity of the set of users, that a user action of a specified user, with respect to one or more data sources from the set of data sources, is anomalous relative to the baseline profile of the specified user. The machine provides a digital transmission representing the anomalous user action.

Abstract: Methods and systems are disclosed for controlling user creation of data resources on a software platform for storing and executing data resources for multiple users. The methods and systems may be performed using one or more processors or special-purpose computing hardware, and may comprise receiving from a user a user request to create a data resource on the software platform, the user request comprising, or identifying, a specification indicative of the data resource and a user identifier associated with said external user. A further operation may comprise performing verification of said user using the user identifier to determine if said user is permitted to create or modify the data resource indicated in the specification in accordance with a predetermined set of permissions.

Abstract: A security system detects anomalous activity in a network. The system logs user activity, which can include ports used, compares users to find similar users, sorts similar users into cohorts, and compares new user activity to logged behavior of the cohort. The comparison can include a divergence calculation. Origins of user activity can also be used to determine anomalous network activity. The hostname, username, IP address, and timestamp can be used to calculate aggregate scores and convoluted scores.

Abstract: Aspects of the present disclosure involve a data audit system to generate and cause display of a tracking interface at a client device, wherein the tracking interface is configured to facilitate the visualization of tracking data retrieved from multiple sources. The audit system is configured to access a data source to retrieve tracking data that includes an associated asset identifier that identifies a subject of the tracking data, to link the retrieved tracking data to a data object at a database of the audit system based on the asset identifier, and to generate and cause display of a visualization of the tracking data within a tracking interface.