Abstract: Methods, systems, and computer-readable media that manage cloud computing environments. A pool manager creates a pool of cloud computing environments according to a pool specification specifying a headroom threshold of the pool. The pool manager receives, from a requester computer, a request to claim a cloud computing environment. The pool manager determines that one or more cloud computing environments are available. In response, the pool manager provides to the requesting computer credentials for accessing the cloud computing environment. The pool manager designates the cloud computing environment as claimed and unavailable to other requester computers until receiving a notification indicating that the cloud computing environment is unclaimed. The pool manager ensures that the correct number of environments are available on a pre-determined schedule.

Abstract: Methods, systems, and computer programs encoded on computer storage media, for processing user-defined functions in containers. One example system receives a query written in a primary query language that calls a user-defined function. The system assigns primary segment hosts to process portions of the query written in the primary query language and assigns first containers to process the call to the user-defined function. The primary segment hosts provide to the first containers the user-defined function and one or more arguments in the call to the user-defined function. The first containers execute the user-defined function. The primary segment hosts receive an initial result of the call to the user-defined function computed by the first containers. The primary segment hosts compute a final result of the query using the initial result. The primary segment hosts provide the final result of the query in response to receiving the query.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media for a platform orchestrator to use verified add-on resources. One of the methods includes receiving, by a platform orchestrator, an add-on resource API command that references an add-on resource installed on one or more software platforms launched by the platform orchestrator. A request to execute the add-on resource API command is provided to a platform controller of a software platform of the one or more software platforms launched by the platform orchestrator. The add-on resource API command is executed including identifying one or more instances of the add-on resource referenced by the add-on resource API command that are executed as workloads on the software platform launched by the platform orchestrator.

Abstract: Systems, methods, and computer program products for estimating a Bayesian hierarchical regression model using parallelized and distributed Gibbs sampling are described. The techniques can be implemented to solve use cases where there is a response variable, e.g., number of store visits or web page visits, which is a variable of interest, and multiple explanatory variables, e.g., locations, temperatures, or prices, that may predict the response variable. The disclosed techniques build a model that explains and quantifies effects of the explanatory variables on the response variable on a distributed system. For instance, the disclosed techniques can build a model which has the capability to estimate that an X-degree increase in temperature at a certain time of year predicts a Y-percent increase in store visits. This estimation process is performed in parallel on multiple nodes of the distributed system.

Abstract: Systems, methods, and computer program products for an application to securely record and propagate an invocation context for invoking other applications are described. The applications being invoked not only receive a user's authentication token, but also authentication tokens of an entire invocation chain. Accordingly, the applications being invoked can verify a chain of custody through verification of nested, cryptographically signed payloads of a chain of authentication tokens. An application can thus verify identities of each application in the chain of custody, as well as the invocation contexts (e. g. the HTTP request method and path) in which each application in the chain invoked the next application.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating recipes having platform-independent, resource-agnostic commands for performing work in a cloud computing platform. One of the systems includes a plurality of executors, each executor being operable to receive a recipe comprising one or more platform independent, resource agnostic commands, each command corresponding to a requested service to be performed by an execution engine on an underlying computing platform, translate each platform independent, resource agnostic command of the recipe into one or more platform independent, resource specific requests that satisfy the requested service on the underlying computing platform and make each of the one or more platform independent, resource specific requests to one of the one or more execution engines using a platform independent execution engine application programming interface (API).

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for clustering and visualizing textual data. A data clustering and visualization system clusters large volumes of semi-structured and unstructured textual data into categories. Each category can include a group of similar alerts and incidents. The categories are then graphically presented.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for precisely tracking memory usage in a multi-process computing environment. One of the methods includes implementing an instance of a memory usage tracker (MUT) in each process running in a node of a computer system. A MUT can maintain an account of memory usage for each of multiple logical owners running on a process on which the MUT is running. The MUT can determine an actual memory quota for each owner, and enforce the actual memory quota of the owner. Enforcing the actual memory quota of the owner can include receiving each memory allocation request, checking each allocation request and a current state of the account against the actual quota, approving or rejecting each allocation request, communicating the approval or rejection to an underlying memory manager, and updating the owner account for each approved allocation request.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media for using certificate injection tasks to generate containers having corresponding digital certificates. One of the methods includes receiving, by the distributed computing system, a source container image. A certificate injection task is executed, including: launching a container instance from the source container image and executing injection code within an execution environment of the launched container instance that writes one or more digital certificates to one or more corresponding locations within a file system of the execution environment. An output container image having the one or more digital certificates is then generated.

Abstract: Methods, systems, and computer-readable media for on-demand resource provisioning for service instances. An on-demand service broker provisions IaaS resources at service instance creating time. The service broker provides a catalog listing one or more service plans, each service plan corresponds to a set of available resources. A user device selects a respective service plan that matches specific needs of an application that consumes the resources. The service broker generates a deployment manifest based on the selected service plan. The service broker then submits the deployment manifest to a deployment system. The deployment system provisions the resources to the service instance according to the manifest generated by the service broker.

Abstract: A cloud computing environment provides the ability to deploy a web application that has been developed using one of a plurality of application frameworks and is configured to execute within one of a plurality of runtime environments. The cloud computing environment receives the web application in a package compatible with the runtime environment and dynamically binds available services by appropriately inserting service provisioning data into the package. The cloud computing environment then packages an instance of the runtime environment, a start script and the package into a web application deployment package, which is then transmitted to an application. The application container unpacks the web application deployment package, installs the runtime environment, loads the web application package into the runtime environment and starts the start script, thereby deploying the web application in the application container.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating an object graph from records of a relational database. One of the methods includes receiving a request to populate a software object with values from a plurality of tables represented in a graph, the plurality of tables stored in a relational database maintained by a database management system, each table comprising one or more respective tuples of values; generating a single query statement that, when executed by the database management system, causes the database management system to retrieve the values from the plurality of tables represented in the graph as a result set; querying the relational database using the single query statement to obtain the result set; and populating the software object with one or more values of the result set.

Abstract: A policy engine is situated within the communications path of a cloud computing environment and a user of the cloud computing environment to comply with an organization's policies for deploying web applications in the cloud computing environment. The policy engine intercepts communications packets to the cloud computing environment from a user, such as a web application developer, for example, in preparation for deploying a web application in the cloud computing environment. The policy engine identifies commands corresponding to the communications packets and directs the communications packets to appropriate rules engines corresponding to such commands in order to execute rules to comply with an organization's policies. Upon completion of execution of the rules, the communications packets are forwarded to the cloud computing environment if they comply with the policies.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for implementing a configuration container that can store user configuration files. One of the methods includes receiving a request to launch a configuration container from a configuration container image. A configuration container is launched using the configuration container image and a persistent storage volume is attached to the configuration container. A plurality of user configuration files are copied into the persistent storage volume. A configuration file is received for launching a workload on a container orchestration platform, wherein the configuration file includes a reference to the configuration container. A request to launch the workload on the container orchestration platform using the configuration file is received. A plurality of containers are provisioned and the workload is launched using the plurality of containers.

Abstract: Methods, systems, and computer-readable media for on-demand resource provisioning for service instances. An on-demand service broker provisions IaaS resources at service instance creating time. The service broker provides a catalog listing one or more service plans, each service plan corresponds to a set of available resources. A user device selects a respective service plan that matches specific needs of an application that consumes the resources. The service broker generates a deployment manifest based on the selected service plan. The service broker then submits the deployment manifest to a deployment system. The deployment system provisions the resources to the service instance according to the manifest generated by the service broker.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for automatic text report concept generation. Generating concepts from text reports includes receiving a collection of text reports; performing a clustering process for a plurality of different cluster sizes; evaluating each of the plurality of different cluster sizes to select an optimal cluster size; generating, from the collection of text reports, clusters using the selected optimal cluster size; aggregating text associated with text reports in each cluster; maintaining a training dataset comprising the aggregated text; and generating a predictive model from the training dataset to generate a concept for an input text report.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for using reactive programming operators to implement resource pooling. One of the methods includes receiving a first request, from a client application, for a poolable object in a resource pool and maintained by a resource pool manager, wherein the request indicates an operation mode specifying how the resource pool manager should release the poolable object back into the resource pool; generating a plurality of reactive programming operators comprising a poolable object listener publisher and a subscriber that is configured to subscribe to the poolable object listener publisher; evaluating the reactive programming operators in an upstream subscription ordering of the reactive programming operators to obtain a poolable object from the resource pool; and releasing the poolable object back to the resource pool according to the operation mode of the request.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for routing events of an event stream in a stream processing system. One of the methods includes receiving, by a router, an event stream of events; identifying, for each event, by the router, a respective partition of context data that includes context data related to the event and providing the event to a respective local modeler that stores the partition of context data identified for the event in operational memory of the local modeler; processing, by each local modeler, events received from the router and aggregating information associated with each event to generate aggregated information; providing, by one or more of the local modelers, to a central modeler, the respective aggregated information; and determining, by the central modeler, a plurality of parameters of a machine learning model using the received aggregated information.