Abstract: This disclosure describes a system for determining an estimated user departure time from a materials handling facility. For example, a user may enter a materials handling facility to pick one or more items from the materials handling facility. Those items may be provided to an agent for processing, such as packing, while the user picks other items within the materials handling facility. To ensure that the items are processed in a timely manner and made available to the user when the user is ready to depart from the materials handling facility, the implementations discussed determine an anticipated user departure time and compare that time with an estimated processing time needed to process the items.

Abstract: Techniques are described for monitoring and analyzing input/output (I/O) messages for patterns indicative of ransomware attacks affecting computer systems of a cloud provider, and for performing various remediation actions to mitigate data loss once a potential ransomware attack is detected. The monitoring of I/O activity for such patterns is performed at least in part by I/O proxy devices coupled to computer systems of a cloud provider network, where an I/O proxy device is interposed in the I/O path between guest operating systems running on a computer system and storage devices to which I/O messages are destined. An I/O proxy device can analyze I/O messages for patterns indicative of potential ransomware attacks by monitoring for anomalous I/O patterns which may, e.g., be indicative of a malicious process attempting to encrypt or otherwise render in accessible a significant portion of one or more storage volumes as part of a ransomware attack.

Abstract: Techniques are generally described for performing outfit recommendation using a recurrent neural network. In various examples, a computing device may receive a first state vector representing an outfit comprising at least one fashion item. First image data depicting a second fashion item of a first item category may be received. A machine learning mode may generate a first output feature vector based on the first state vector, the first image data, a first attribute vector, and the first item category. The first output feature vector may be compared to other feature vectors representing other fashion items in the first category to determine distances between the first output feature vector and the other feature vectors. A set of fashion items may be recommended based on the distances between the first output feature vector and the other feature vectors.

Abstract: Systems and methods utilize network destination identifiers, such as IP addresses, that are simultaneously advertised from multiple locations. The network destination identifiers may be announced in multiple geographic regions. Network traffic routed to devices advertising the network destination identifiers may be routed to appropriate endpoints. When a device receives such traffic, it may send the traffic to an endpoint in a network served by the device. In some instances, such as when such an endpoint is not available, the network traffic may be sent to another network that is served by another device that advertises the network destination identifiers.

Abstract: Disclosed are systems and methods that detect segments of video, such as HDR video, that include content, such as edges and details in dark scenes, that cannot be presented on some displays. Output models for different display types, such as edge-lit LCD, backlit LCD, etc., may be created and used to process video with respect to those different display types to determine if segments of the video cannot be presented on the display type at the pixel brightness values indicated in the video. In some implementations, HDR video may also or alternatively be compared to SDR video to determine segments of the video that are of interest, especially in low light scenes.

Abstract: Systems and methods are provided to implement a fast recovery process in a partitioned replicated data store. In some embodiments, the data store is configured to store an object in a plurality of partitions and replicate data in each partition in a group of replica nodes to satisfy a durability model. In response to a replica failure, the data store performs a split operation to create a plurality of new partitions. The partition's data is split into subsets corresponding to the new partitions. The subsets are transmitted, in parallel, from the surviving replica nodes of the partition to new replica nodes in the new partitions. The new partitions then replicate respective subsets of data in their respective replication groups using a chained replication technique. The recovery process allows the data store to return into compliance with the durability model more quickly, by parallelizing the copying of data.

Abstract: Techniques for a service provider network to divide computing resources of availability zones into smaller, isolated partitions (or “cells”), and manage the placement of virtual computing resources into the cells to reduce overconsumption of computing resources in the cells while ensuring ensure resiliency and availability. As virtual computing resources are launched into cells, or migrated between cells, the service provider network may load balance the virtual computing resources on a per-user basis to ensure resiliency and availability across the cells. Further, the service provider network may monitor the number of mutations (e.g., an operation that affects the state of a virtual computing resource) in each cell, as well as utilization rates of the underlying computing resources, and load balance virtual computing resource to maintain stable mutation rates and reduce over utilization (and/or under-utilization) of computing resources.

Abstract: Dynamic transcoding can be used to provide supplemental content, selected to be played during breaks in a stream of primary content, that has the same format as the primary content. It can be desirable to provide supplemental content that is personalized. This may include additional content or advertising that may be of interest or relevance to a viewer. In many instances, the supplemental content will come from a different source and thus can be in a different format. Approaches in accordance with various embodiments can take advantage of dynamic transcoding of the supplemental content to provide properly formatted supplemental content through the same stream as the primary content. A custom manifest can be provided to the media player that points to the transcoded supplemental content. At an appropriate break in the playback, the media player can use the manifest to obtain the formatted supplemental content.

Abstract: Techniques for implementing a local neural network and global decoding scheme for quantum error correction of circuit-level noise within quantum surface codes such that the decoding schemes have fast decoding throughout and low latency times for quantum algorithms are disclosed. A local neural network decoder may be pre-trained via a supervised learning technique such that the local neural network decoder may be applied for error correction in the presence of circuit-level noise in arbitrarily sized surface codes in a local decoding stage. Prior to a global decoding stage, an intermediate stage may be used to remove vertical pairs of highlighted vertices within the matching graph, which may reduce a syndrome density within the matching graph to allow for faster decoding at the global decoding stage. Such an intermediate stage may include application of a syndrome collapse or vertical cleanup technique.

Abstract: Techniques are described and relate to anisotropic pooling for contextual embedding of a protein sequence. In an example, a system receives a first biological sequence and determines a sequence arrangement that comprises a component of the first biological sequence and a second biological sequence of components. By using an artificial intelligence (AI) model, the system determines a third sequence that comprises a contextual embedding vector corresponding to the component of the first biological sequence. The AI model generates the third sequence based at least in part on the sequence arrangement and by at least using a convolution and anisotropic pooling.

Abstract: A data storage system having an intermediary server including an input interface, a memory and an output interface. The input interface configured to establish, via one or more programmatic interfaces, a connection with a client device to receive data for upload to a storage server and measure an input rate of the data received from the client device. The memory configured to store the data in a buffer as the data is received. The output interface configured to establish a connection with the storage server, determine an output rate for sending the data from the buffer to the storage server based at least in part on the input rate and a timeout value for the storage server, and send the data from the buffer to the storage server at the output rate.

Abstract: Systems and methods for providing cryptographic services. A cryptography service obtains a request to provision a computing device to perform cryptographic operations. The cryptography service generates executable code for a protected execution environment. The computing device obtains and executes the executable code. The computing device fulfills requests for cryptographic operations in the protected execution environment.

Abstract: Techniques for an objection detection feature are described herein. Images of an object captured by a camera may be received along with information that includes a first timestamp. A presence of the object and a type of the object may be determined based on a computer vision model that uses the images. First RFID data may be received from an RFID sensor from an RFID tag associated with the object. The first RFID data may include a second timestamp and an identifier for the RFID tag. A determination that the object has entered the area may be determined based on the presence of the object within the images, the first RFID data, the first timestamp, and the second timestamp. A threshold for the object may be determined based on the first timestamp, the second timestamp, and one or more policies for the area.

Abstract: A first computing system establishes a cryptographically protected communication session with a second computing system by proposing a hybrid cryptographic scheme. In response to the proposed hybrid cryptographic scheme, a second computing system transmits cryptographic materials to the first computing system, and the first computing system transmits cryptographic materials to the second computing system. Using the cryptographic materials, two or more cryptographic keys are derived. One cryptographic key is used to perform an inner cryptographic operation on one or more data items, and another cryptographic key is used to perform an outer cryptographic operation on the one or more data items that have been cryptographically protected by the inner cryptographic operation.

Abstract: A candidate attribute combination of a first data set is identified, such that the candidate attribute combination meets a data type similarity criterion with respect to a collection of data types of sensitive information for which the first data set is to be analyzed. A collection of input features is generated for a machine learning model from the candidate attribute combination, including at least one feature indicative of a statistical relationship between the values of the candidate attribute combination and a second data set. An indication of a predicted probability of a presence of sensitive information in the first data set is obtained using the machine learning model.

Abstract: The following description is directed to a logic repository service. In one example, a method of a logic repository service can include receiving a first request to generate configuration data for configurable hardware using a specification for application logic of the configurable hardware. The method can include generating the configuration data for the configurable hardware. The configuration data can include data for implementing the application logic. The method can include encrypting the configuration data to generate encrypted configuration data. The method can include signing the encrypted configuration data using a private key. The method can include transmitting the signed encrypted configuration data in response to the request.

Abstract: A system, method and processor that mitigates security vulnerabilities using context-dependent address space hiding. In some embodiments, a hardware mechanism allows a more-privileged software component managing multiple less-privileged software components to blind itself against “out-of-context” less-privileged software components. The hardware mechanism can allow the more-privileged software component to dynamically hide a portion of the more-privileged address space related to the “out-of-context” less-privileged software components, based on knowledge of the “in-context” less-privileged software component. A context register is set with a value from which an address range, within the address space of the more-privileged software component, can be determined, where the address range is associated with a first less-privileged software component can be determined.

Abstract: At an artificial intelligence system, training iterations of a first machine learning model are implemented. In a particular iteration, a group of data items are selected from an item collection using active learning, and respective labels selected from a set of tags are obtained for at least some of the items of the group. Using feature processing elements of a different machine learning model, a respective feature set corresponding to individual labeled items is generated in the iteration, and the feature sets are included in a training set used to train the first machine learning model. A trained version of the first machine learning model is stored after a training completion criterion is met.

Abstract: Techniques for cooperative timing alignment using synchronization pulses are described. The techniques can include generating, at an integrated circuit device, a timing signal, controlling a local count value based on the timing signal, monitoring a synchronization signal of a system comprising the integrated circuit device, detecting a synchronization pulse in the synchronization signal, and aligning the local count value with an implied count value associated with the synchronization pulse in order to align the local count value with those of other integrated circuit devices of the system.

Abstract: This disclosure describes a method for segmenting large MQTT messages that exceed a maximum transport unit (MTU) for MQTT messages into smaller segments and then reassembling the segments into the original MQTT message. More particularly, the techniques and architecture provide two new fields within an existing MQTT message. In configurations, the two new fields may include a universally unique identifier (UUID) and a segment number. These two new fields enable segmentation of arbitrarily large messages at a publisher side of the MQTT message and reassembly of the segments of the large messages at the subscriber side so that the message size limitation may be overcome. This can allow for larger MQTT messages to be transmitted without the increased cost of larger maximum transport units.

Abstract: At a first resource to be used to perform a computing operation, a pair of execution environments is configured. I/O permissions of programs running in the different environments are based on respective sets of constraints. A program performs the operation in one of the environments, with input data being provided to the program from the second environment. A result of the operation is provided to a destination from the second environment.

Abstract: This disclosure describes, in part, techniques for retrieving images based on detecting events. For instance, system(s) may detect an event, such as an event associated with a collection of images for an item. Based on detecting the event, the system(s) may determine an area within a facility, such as an inventory location, for retrieving image data. The system(s) may then determine one or more imaging devices that have field(s) of view of the area. Additionally, the system(s) may score the imaging device(s) based on visibility data associated with the imaging device(s). The system(s) may also determine occlusion data for image data generated by the imaging device(s). Using the scores and the occlusion data, the system(s) may then select image data that represents the area. The system(s) may then store the image data in one or more data stores, such as with the collection of images.

Abstract: A system includes a location controller for a building, a container arranged to store items, and a device attached to the container. The device includes a first radio and a light emitting diode. The first radio emits a signal. The location controller determines a first location of the device in the building based on the signal and communicates, based on the first location of the device in the building, a first instruction to the device indicating that the device should be moved to a second location. The light emitting diode emits light of a first color in response to the first instruction.

Abstract: A multi-sensor input device includes multi-color lights to illuminate a user's hand with various colors of light including visible and infrared, as well as sensors including a photodetector, a red-green-blue (RGB) camera, and an infrared camera. During operation, sensor data generated by the sensors may represent non-biometric input such as a barcode that is printed or shown on another device's display, biometric input such as images of surface and subcutaneous features of the user's hand, and so forth. The biometric input may then be processed to identify the user. The input device also includes antitamper features to improve security. The input device may be used at various locations, such as at an entry portal, point of sale, and so forth.

Abstract: Dynamically re-locating transcoding processes of live content data is described herein. In an example, a computer system causes a first server to execute a first transcode process on a first portion of live stream content. A first output of executing the first transcode process includes first transcoded content. The computer system determines a transcode capacity of one or more servers. The computer system determines that transcoding the live stream content is to be moved to a second server based at least in part on the transcode capacity and a transcode optimization parameter. The computer system causes the second server to execute a second transcode process on a second portion of the live stream content. The second transcode process is equivalent to the first transcode process. A second output of executing the second transcode process includes second transcoded content.

Abstract: A journaled database system may comprise data nodes that maintain a collection of data structured in accordance with a schema. A change to the schema may be applied by a journal module while a journal consumer continues to operate using a prior version of the schema. A buffer may be formed and have stored therein records describing state change instructions according to the prior view of the schema. An index of correspondence between the records in the buffer and in the source journal may be maintained.

Abstract: An edge data pipeline service may build and deploy an edge data pipeline application to an edge device, based on specification provided by a user. The service may receive, from the client, indications for any number of data sources (e.g., cameras, sensors), data sinks (e.g., video files, databases), and application modules (e.g., motiondetect, anomalydetect) to be used by an edge data pipeline application at an edge device. The client may indicate a mapping that maps data sources to data sinks and one or more criteria that, when satisfied, cause an application module to send data from one or more data sources to one or more data sinks according to the mapping. The service builds a package and deploys the package to the edge device, which implements the data pipeline application to route data from sources to sinks.

Abstract: Techniques for analyzing code are described. In some instances, a code analysis service is implemented by one or more electronic devices, the code analysis service including instructions that upon execution cause the code analysis service to: perform a program analysis to mine a code segment of the stored code to generate a descriptor of each input in the code segment that appears to be have insufficient input validation; assess that an input has insufficient validation and determining a classification of input validation to use by determining a category of input validation to apply to the input; acquire suggestion for the determined category; and provide the acquired suggestion for the determined category.

Abstract: Data dividers with partition identifiers are described for use in data analytics for streaming data. A continuous flow of data items received by a network-based data analytics service may be discretized into data buckets based on a time window associated with each of the data buckets receiving the data items from the data stream Data dividers may be generated based on a number of partitions determined to be necessary to implement parallel processing of the data items and each partition may include the data items to be processed as well as a single data divider ordered at the end of the partition such that the data divider is the last item to be processed. In this way, the network-based data analytics service may determine that all of the data items for a given data bucket have been processed once all of the data dividers have been processed.

Abstract: Systems, devices, and methods are provided for training and/or inferencing using a list ordering model. A list ordering model, such as a Markov chain, may be trained using a plurality of lists with location metadata in common, wherein a first list of the plurality comprises items and corresponding competition timestamps. A list ordering model may accept, as an input, a plurality of items, and determine, as an output, an order for the plurality of items. Recommendations may be generated based on the determined order.

Abstract: Systems and methods for integration of speech processing functionality with organization systems are disclosed. For example, a voice interface application may be created to enable a voice interface functionality for devices associated with an organization. Space identifiers of spaces of the organization may be created and associated with the voice interface application. Devices associated with the space identifiers may be enabled for utilizing the voice interface application and may be set up utilizing wireless network identifiers associated with the spaces and/or the organization.

Abstract: Techniques for controlling an interface of a multi-input modality device are described. In an example, a device presents a menu on a display in a first input modality mode of the device. The menu includes graphical user interface (GUI) elements. The first input modality mode corresponds to a first type of input modality. The device receives first input corresponding to a second type of input modality. The device presents the menu on the display in a second input modality mode of the device that corresponds to the second type of input modality. The first input modality mode and the second input modality mode are exclusive to each other and each provide a different menu navigation control. The device changes a presentation of a visual indicator at a first location associated with a first GUI element of the GUI elements in the menu based on the second input modality mode.

Abstract: Techniques are described for facilitating use of software components by software applications in a configurable manner. In some situations, the software components are fee-based components that are made available by providers of the components for use by others in exchange for fees defined by the components providers, and in at least some situations, the software components may have various associated restrictions or other non-price conditions related to their use. The described techniques facilitate use of such software components by software applications in a configured manner. Furthermore, in at least some situation, the execution of such software applications is managed by an application deployment system that controls and tracks the execution of the software application on one or more computing nodes, including to manage the execution of any software components that are part of the software application.

Abstract: An origin server that is implemented within one or more devices within a third party virtual private cloud (VPC) is provided herein. Instead of communicating with various CDNs over a public network, the third party VPC may instead communicate with a managed VPC via a private network. Thus, no gateway, network address translation (NAT), or other such devices may be needed for the third party VPC and the managed VPC to communicate. Rather, a VPC identifier of the managed VPC and a VPC identifier of the third party VPC are used to pair the two VPCs. Once paired, a private route is set up such that points from the private address space of the third party VPC to the private address space of the managed VPC. The managed VPC then communicates directly with the various CDNs via a public network.

Abstract: Systems and methods for device control using near real time learning are disclosed. For example, an automatic action is performed by a target device in response to a predefined condition being met. Thereafter, context data is gathered and utilized to determine whether a negative user reaction has been provided in response to performance of the automatic action. When a negative user reaction is determined, mitigating actions may be taken close in time to when the context data is received to prevent further negative user reactions.

Abstract: Systems and methods are described for implementing a multi-tenant caching service. The multi-tenant caching service provides a scalable infrastructure with dedicated per-tenant cache widths for tenants of a hosted computing environment, and allows tenants to implement a caching layer between cloud-based services that would otherwise need to scale up in response to load. Tenants may also use the service as a public facing endpoint that caches content provided by backend servers. Content provided by the tenants may be distributed and cached across a cell-based architecture, each cell of which may include a set of storage volumes that are partitioned into caches for individual tenants and configured to store a portion of the content provided by that tenant. Eviction policies may be implemented based on tenant cache usage across multiple cells, and geolocation policies may be implemented to ensure that cached content remains within a particular geographic region.

Abstract: A quantum computing service may store, in a cache, one or more compiled files of respective quantum functions included in one or more quantum computing programs received one or more customers. When the quantum computing service receives another quantum computing program, from the same or a different customer, the quantum computing service may determine whether the quantum computing program may include one or more of the quantum functions corresponding to the compiled files in the cache. If so, the quantum computing service may use the compiled files in the cache to compile the quantum computing program.

Abstract: An Identity and Access Management Service implements persistent source values PSVs) for assumed identities. A source value (e.g., an original identifier of an entity) is persisted across assumed identities, facilitating identification of entities (users or applications) responsible for actions taken by the assumed (e.g., alternative) identities. The Manager receives a request to assume an identity. The request includes the entities current credentials and a PSV. The current credentials are authenticated and a persistent source value policy may be relied on to determine whether and/or how to grant the assumed identity. The PSV may be copied from credentials in the request in order to be included in the credentials for the requested identity that the Manager provides in response to the request. Use of the requested credentials, including the PSV, to access services or resources may be logged, the logs including the PSV from the request to assume the identity.

Abstract: A first portion of a video item is transmitted using a first encoding profile. The first encoding profile is a first set of one or more first video representations of the video item having first image quality characteristics. Viewer information including at least one of a viewer quantity for the video item or a viewer playback platform distribution for the video item is receiving during transmitting the video item. A second encoding profile is determined based on the at least one of the viewer quantity or the viewer playback platform distribution. The second encoding profile is a second set of one or more second video representations of the video item having second image quality characteristics. The second image quality characteristics include a selected image quality characteristic that is not included in the first image quality characteristics. A second portion of the video item is transmitted using the second encoding profile.

Abstract: Described are systems and methods that may be used to compare virtual machine manager-level system operations in a host environment to verify to a guest environment, such as a virtual machine, that the requested operations have been performed and the data managed by the host on behalf of the guest is secure. The implementations may include a security monitor that interfaces with a trusted platform module included in a hardware of the host. The security monitor may work with the TPM to verify consistency between a VM operation and a corresponding VMM-level operation of the host. This verification provides transparency that the host machine is complying with its responsibility to properly manage and secure data of the VM.

Abstract: System and methods are provided for detecting, tracking, and managing outages of transaction processors. An indication is received indicating a potential outage associated with a transaction processor computer configured to process transactions of an online retail website. The indication can be received from a threshold monitoring service and/or from a machine-learning detection system. A computing service can be initiated to confirm and track the outage over time. An outage may include a number of situations in which the transaction processor fails to process transactions according to a set of predefined processing parameters. If the outage spans a particular time period, the service can perform a number of remedial actions (e.g., notifying an administrator of the outage, etc.).

Abstract: A connected device at a client network implements a local data classification service for classifying data based on a data classification service of a remote provider network. The local data classification service receives a request to classify data at one or more data sources of the client network. The request is initiated from a client device of the client network according to a management interface for a data classification service of a remote provider network (e.g., using the same API request used by the remote classification service). The local data classification service obtains at least some of the data from the one or more data sources of the client network. The local data classification service classifies the obtained data according to different types of sensitivity using the data classification engine in the execution environment without the data being exposed outside of a data isolation boundary of the client network.

Abstract: A system efficiently selects at least one device from multiple devices based on received audio signals. In some instances, the system receives audio signals from devices that each comprise at least one microphone. A respective audio signal of the audio signals includes a representation of a sound originating from a location. The system then determines a device to be used to respond to the sound. In some instances, the system analyzes times in which the received audio signals that represent the sound are generated and/or volumes of the sound as represented by the received audio signals. The system can then select the device based on the analysis.

Abstract: A service implemented at a first isolated virtual network of a provider network is added to a database of privately-accessible services. Configuration changes that enable network packets to flow between the first isolated virtual network and a second isolated virtual network without utilizing a network address accessible from the public Internet are implemented. Service requests originating at the second isolated virtual network are transmitted to the first isolated virtual network via private pathways of the provider network. Metrics corresponding to service requests directed from the second isolated network to the service are collected and provided to the respective owners of one or both isolated virtual networks.

Abstract: Implementations for selecting an input device based on characteristics of the input signals from those input devices are described. A first input signal is received from a first input device of a participant device participating in a media conference and a second input signal is received from a second input device of the participant device. A first characteristic of the first input signal and a second characteristic of the second input signal are determined. The first characteristic is compared to the second characteristic. It is determined that a quality of the second input signal is greater than a quality of the first input signal based on comparing the first characteristic to the second characteristic. The second input device is selected based on determining that the quality of the second input signal is greater than the quality of the first input signal.