Abstract: A field programmable gate array (FPGA) including a configurable interconnect fabric connecting a plurality of logic blocks, the configurable interconnect fabric and the logic blocks being configured to implement a data masking circuit configured to: receive input data including data values at a plurality of indices of the input data; select between a data value of the data values and an alternative value using a masking multiplexer to generate masked data, the masking multiplexer being controlled by a mask value of a plurality of mask values at indices corresponding to the indices of the input data; and output the masked data. In some examples, the configurable interconnect fabric and the logic blocks are further configured to implement a mask generation circuit configured to generate the mask values. In some examples, the mask values are received from external memory.

Abstract: Methods, systems, and computer programs are presented for analyzing a program to be executed on a computer to detect vulnerability for malicious attacks using the program. One method includes an operation for performing dynamic vulnerability detection of a driver when the driver is loaded in a computing system. The dynamic vulnerability detection comprises detecting at least one offset made available by the driver for access to the driver, and detecting application programming interface (API) calls made by the driver. Further, the method includes performing static vulnerability detection of the driver by analyzing binary code of the driver. The static vulnerability detection comprises determining the at least one offset available for access to the driver, and identifying vulnerable code paths to functions accessing kernel functionality.

Abstract: Techniques are described herein that are capable of translating an edit from a child computer language to a parent computer language while maintaining a semantic meaning of the edit. Parent code that is based on the parent computer language is compiled, which automatically triggers generation of child code that is mapped to the parent code and that is based on the child computer language. A determination is made that the edit, which is not mapped to the parent code, is implemented in the child code to provide edited child code. The parent code is updated to include a change that is based on the semantic meaning of the edit. The updated parent code is configured such that compilation of the updated parent code automatically triggers generation of an updated version of the child code that includes the semantic meaning of the edit.

Abstract: A method, computer program product, and computing system for enabling a user to select a plurality of functional modules from a library of functional modules; and enabling the user to visually arrange the plurality of functional modules to form a conversational application; wherein the conversational application includes a contingency platform configured to enable an administrator of the conversational application to activate a contingency plan at some point-in-time after the deployment of the conversational application.

Abstract: A serverless query processing system receives a query and determines whether the query is a recurring query or a non-recurring query. The system may predict, in response to determining that the query is the recurring query, a peak resource requirement during an execution of the query. The system may compute, in response to determining that the query is the non-recurring query, a tight resource requirement corresponding to an amount of resources that satisfy a performance requirement over the execution of the query, where the tight resource requirement is less than the peak resource requirement. The system allocates resources to the query based on an applicable one of the peak resource requirement or the tight resource requirement. The system then starts the execution of the query using the resources.

Abstract: This disclosure describes how to identify objects in an augmented reality environment. More specifically, the various systems and methods described herein describe how an augmented reality device can recognize objects within a real world environment, determine where the object is located, and also identify the various surfaces of the object in real time or substantially real time.

Abstract: Unauthorized use of user credentials in a network is detected. Data indicative of text strings being used to access resources in the network is accessed. Regex models are determined for the text strings. Troupings of the regex models are determined based on an optimization of a cumulative weighted function. A regex model having a cumulative weighted function that exceeds a predetermined threshold is identified. An alert is generated when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.

Abstract: A computing device is provided, including a battery, a processor configured to receive electrical power from the battery via a voltage regulator, and one or more additional electronic components configured to receive electrical power from the battery. The computing device may further include a first current detector configured to detect a total battery discharge current. The voltage regulator may be configured to receive a first analog current signal from the first current detector, convert the first analog current signal into first digital current data, and transmit the first digital current data to the processor. The processor may be further configured to determine a difference between the total battery discharge current and an available electric current limit for the battery. In response to at least determining the difference, the processor may be further configured to adjust one or more performance parameters of the processor such that the difference is reduced.

Abstract: A method and system for transforming an input image via a plurality of image transformation stylizers includes receiving the input image; providing the input image, information about the plurality of image transformation stylizers and at least one of user data, history data, and contextual data to a trained machine-learning (ML) model for selecting a subset of the plurality of image transformation stylizers; receiving as an output from the ML model the subset of image transformation stylizers; executing the subset of the image transformation stylizers on the input image to generate a plurality of transformed output images; ranking the plurality of transformed output images based on at least one of the input image, the user data, the history data, and the contextual data; and providing the ranked plurality of transformed output images for display.

Abstract: Systems and methods directed to formulating and suggesting a subject line based on content of an email message are provided. More specifically, content corresponding to one or more portions of an email may be received, where the content may be utilized to determine one or more email topics and at least one intent of the email. An intent of the email may correspond to whether an action is to be performed, whether a question is presented, whether a request for time is present, and/or any other request on the part of the recipient or the sender. Based on the intent of the email and the one or more topics, a subject line suggestion may be formulated and presented to a user.

Abstract: Computer servers configured to perform digital image processing are discloses herein. In one embodiment, upon receiving a transcription command, a computer server performs text recognition based on patterns in a digital image to generate digital text data corresponding to the digital image. The computer server can then determine a content format of the digital text data based on the imported digital image and automatically apply the determined content format to the generated digital text data. The digital data can then be inserted into an electronic document.

Abstract: A hypothesis stitcher for speech recognition of long-form audio provides superior performance, such as higher accuracy and reduced computational cost. An example disclosed operation includes: segmenting the audio stream into a plurality of audio segments; identifying a plurality of speakers within each of the plurality of audio segments; performing automatic speech recognition (ASR) on each of the plurality of audio segments to generate a plurality of short-segment hypotheses; merging at least a portion of the short-segment hypotheses into a first merged hypothesis set; inserting stitching symbols into the first merged hypothesis set, the stitching symbols including a window change (WC) symbol; and consolidating, with a network-based hypothesis stitcher, the first merged hypothesis set into a first consolidated hypothesis.

Abstract: Described are examples for providing a system for managing configuration and policies for a virtualized wide area network (vWAN) support on a wide area network (WAN). The vWAN includes a plurality of virtual network entities associated with geographic locations including the physical computing resources of the WAN and virtual connections between the virtual network entities. The system includes a network safety component for managing configurations and policies of the vWAN on the WAN. The network safety component receives a change to a policy or configuration of the vWAN from an operator of a network connected to the vWAN. The network safety component evaluates a set of safety rules for the operator based on the change and a network state of a physical WAN underlying the vWAN. The network safety component generates an error message in response to at least one of the set of safety rules failing the evaluation.

Abstract: Methods and devices for an automated Internet of Things (IoT) certification service to verify plug and play capabilities of one or more IoT devices for use with a cloud service provider may include receiving a device identification of an IoT device to certify with the cloud service provider. The methods and devices may include receiving a selection of one or more certification tests to perform to plug and play capabilities of the IoT device. The methods and devices may include performing the one or more certification tests. The methods and devices may include generating a device certification for the plug and play capabilities of the IoT device in response to the one or more certification tests passing.

Abstract: Embodiments described herein are directed to detecting data inconsistencies within a distributed database and identifying the cause thereof. For example, lineage events are emitted from different components of the distributed system that operate on various data files. A consistency checking engine analyzes these events and detects inconsistencies with respect to the data files. The embodiments described herein checks the integrity of the database and assists in understanding the root cause in case of a corruption. Moreover, it provides the timeline for the corruption and whether it is repairable or not. These properties enable determining the right time to restore the customer's database or the right set of actions to repair the corruption. In case of repairable corruption, the correct compensating repair actions may be applied.

Abstract: In an example embodiment, a deep learning algorithm is introduced that operates directly on a raw sequence of user activity in an online network. This allows the system to scalably leverage more of the available signal hidden in the data and stop adversarial attacks more efficiently than other machine-learned models. More particularly, each specific request path is translated into a standardized token that indicates the type of the request (e.g., profile view, search, login, etc.). This eliminates the need for human curation of features. Then, the standardized request paths are standardized to integers based on the frequency of that request path across all users. This allows information about how common a given type of request is to be provided to the machine-learned model. The integer array is the activity sequence that is fed into the deep learning algorithm.

Abstract: A method and system for receiving data relating to one or more activities performed by a user on a document within a specific time period, the one or more activities being performed by using an application, analyzing the data to identify a category of user activity based at least on the type of activity performed on the document, and transmitting a signal to a device for storage in association with the document, the signal including the identified category.

Abstract: The present disclosure relates to methods and systems for configuring service mesh networking resources for dynamically discovered external entities. The methods and systems create custom resource objects for services provided by the external entities and dynamically create service mesh network resources for the custom resource objects. The methods and systems enable communications with the external entities using the service mesh network resources.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for optimizing selection of a cached execution plan to use in processing a parametric query. For example, systems described herein involve training a plan selection model that makes use of machine learning to identify an execution plan from a set of pre-selected execution plans based on predicted cost of executing a query instance in accordance with the selected execution plan (e.g., relative to predicted costs of executing the query instance using other pre-selected execution plans). This application describes features related to lowering costs associated with selecting the execution plan in a way that will continue to be more accurate overtime based on training and refining the plan selection model.

Abstract: Techniques for establishing a network connection with a client device and responding to composite requests from the client device. For a composite request identifying a first action associated with a first data plugin component and a second action associated with a different second data plugin component, the first action is performed by executing a first portion of the data plugin component and transmitting corresponding response data in a first transmission to the client device via the network connection, and the second action is performed by executing a second portion of the data plugin component and transmitting corresponding response data in a second transmission separate from the first transmission to the client device via the network connection.

Abstract: According to examples, an apparatus may include a processor that may identify activities of an entity on resources over a predetermined period of time, in which the entity is to use permissions assigned to the entity over the resources to perform the identified activities. The processor may also identify which of a plurality of groups of permissions includes the permissions the entity used to perform the identified activities and may determine permutations of the identified plurality of groups of permissions. The processor may further calculate respective scores for each of the determined permutations to identify permutations of the groups of permissions having the lowest scores and may output information pertaining to the determined permutations having the lowest scores.

Abstract: A method and system for displaying an image in a communication thread accessible to a first and second user are disclosed, including receiving an indication of a selection of a first image by the first user for display in the communication thread, analyzing user attribute settings of the first user or the second user to determine if at least one of the first user or the second user has a user attribute setting corresponding to a customizable aspect of the selected first image, and causing, based on the analyzing, in different first and second modes, one of the selected first image or a modified image based on the selected first image to be displayed in the communication thread.

Abstract: A first data link and a second data link are established between two endpoints. For each of the first and second data links, a first metric is determined based on a first scaling factor for characterizing how quickly link health degrades over time, and a time at which a most recent packet was received on the respective data link. A second metric indicative is determined based on a second scaling factor for controlling how often to probe the first and second data links in addition to regular traffic. Based on the first and second metrics, one of the first or second data links is selected for sending a data packet.

Abstract: Embodiments detect identity attacks by comparing usage of compromised passphrases or other weak credentials in failed sign-in attempts to access restriction conditions. A restriction threshold amount of weak credential failed sign-ins (WCFSI) or a WCFSI increase indicates an identity attack, such as a password spray attack. Going beyond the mere number of failed sign-ins by also considering credential strength allows embodiments to detect attacks sooner than other approaches. An embodiment may also initiate or impose defenses by locking accounts, blocking IP addresses, or requiring additional authentication before access to an account is allowed. Weak credentials may include short passwords, simple passwords, compromised passwords, or wrong usernames, for instance. Password strength testing may be used for attack detection in addition to preventive use on passwords proposed by authorized users. Familiar and unfamiliar traffic source locations may be tracked, as sets or individually.

Abstract: Systems and methods are described for facilitating operation of a plurality of computing devices. Data indicative of enumerated resources of a computing device is collected. The data is collected without dependency on write permissions to a file system of the one computing device. A condition of the computing device is determined based on historical data associated with enumerated resources of other computing devices. The identified condition can be updated as updated historical data becomes available. A communication to the computing device may be sent based on the identified condition.

Abstract: Embodiments of the present disclosure include systems and methods for packing tokens to train sequence models. In some embodiments, a plurality of datasets for training a sequence model is received. Each dataset in the plurality of datasets includes a sequence of correlated tokens. A set of training data is generated that includes a subset of a sequence of tokens from a first dataset in the plurality of datasets and a subset of a sequence of tokens from a second, different dataset in the plurality of datasets. The sequence model is trained using the set of training data.

Abstract: A method and system for managing delivery of a content stream to a plurality of devices participating in an online conference session, including delivering, to each of the devices, the content stream associated with the online conference session at a first signal quality, receiving an indication signal indicating that a first device is to broadcast the content stream, responsive to the indication signal, increasing a signal quality of the content stream delivered to the first device from the first signal quality to a second signal quality, wherein the second signal quality is higher than the first signal quality, delivering the content stream to the first device at the second signal quality, and delivering the content stream to the rest of the devices at the first signal quality or a third signal quality, wherein the third signal quality is lower than the first signal quality.

Abstract: This disclosure describes systems and methods for protecting commercial off-the-shelf software program code from piracy. A software program may include an executable file having code and data. A platform may modify the executable file such that the data may be placed at a location in memory that is an arbitrary distance from the code. The platform may modify the executable file to include a separation header. The separation header may indicate that the data can be placed at an arbitrary distance in the memory from the code. The separation header may indicate that the code should be loaded into a hardware enclave and that the data should be loaded outside of the hardware enclave. The platform may encrypt the code and provide it to a computing device. The computing device may load the encrypted code into the hardware enclave but load the data into memory outside the hardware enclave.

Abstract: Described are examples for providing intent based network slice management using a management data analytics function (MDAF) to predict deficiencies. A network management system receives an intent for a network slice constituent. The network management system configures computing resources for the network slice constituent to satisfy the intent based on expected performance of the computing resources. The network management system receives feedback with respect to actual performance of the network slice constituent. The network management system determines, based on analysis of the feedback by a management data analytics function (MDAF), a predicted deficiency of the network slice constituent not being able to satisfy the intent. The network management system modifies the configuration of the computing resources based on the feedback and the predicted deficiency to satisfy the intent.

Abstract: Described herein is a mechanism for visual recognition of items or visual search using Optical Character Recognition (OCR) of text in images. Recognized OCR blocks in an image comprise position information and recognized text. The embodiments utilize a location-aware feature vector created using the position and recognized information in each recognized block. The location-aware features of the feature vector utilize position information associated with the block to calculate a weight for the block. The recognized text is used to construct a tri-character gram frequency, inverse document frequency (TGF-IDP) metric using tri-character grams extracted from the recognized text. Features in location-aware feature vector for the block are computed by multiplying the weight and the corresponding TGF-IDF metric. The location-aware feature vector for the image is the sum of the location-aware feature vectors for the individual blocks.

Abstract: A client application is specified by a target tenant and represented in an OAuth provider, along with a corresponding secret. A source tenant consents to permissions to be executed by the client application on a resource of the source tenant. A target service uses the secret to obtain an access token from an authorization server coupled to the source tenant and uses the access token to obtain access, specified by the permissions, to the resource served by a source service acting on behalf of the source tenant.

Abstract: Methods, systems and computer program products are described to improve machine learning (ML) model-based classification of data items by identifying and removing inaccurate training data. Inaccurate training samples may be identified, for example, based on excessive variance in vector space between a training sample and a mean of category training samples, and based on a variance between an assigned category and a predicted category for a training sample. Suspect or erroneous samples may be selectively removed based on, for example, vector space variance and/or prediction confidence level. As a result, ML model accuracy may be improved by training on a more accurate revised training set. ML model accuracy may (e.g., also) be improved, for example, by identifying and removing suspect categories with excessive (e.g., weighted) vector space variance. Suspect categories may be retained or revised. Users may (e.g., also) specify a prediction confidence level and/or coverage (e.g., to control accuracy).

Abstract: Systems and methods are directed to email threading based on machine learning determined categories and features. A network system accesses a plurality of emails addressed to a user. The network system then classifies, using a machine learning model, each email into at least one of a plurality of categories. For a category of the plurality of categories, one or more feature values are extracted from each email in the category. Based on the category and the extracted feature values, the network system groups messages having a same feature value in the same category together into a single email thread. Information related to the single email thread is then presented at a client device of the user.

Abstract: The present disclosure relates to a method of manufacturing a nanowire structure. According to an exemplary process, a substrate is firstly provided. An intact buffer region is formed over the substrate, and a sacrificial top portion of the intact buffer region is eliminated to provide a buffer layer with a planarized top surface. Herein, the planarized top surface has a vertical roughness below 10 ?. Next, a patterned mask with an opening is formed over the buffer layer, such that a portion of the planarized top surface of the buffer layer is exposed. A nanowire is formed over the exposed portion of the planarized top surface of the buffer layer through the opening of the patterned mask. The buffer layer is configured to have a lattice constant that provides a transition between the lattice constant of the substrate and the lattice constant of the nanowire.

Abstract: A method of data communication includes receiving, by a first wireless access gateway (WAG), at least a first data packet corresponding to a first data flow transmitted from user equipment (UE) and receiving, by a second WAG, at least a second data packet transmitted from the UE. In response to receiving the second data packet, the second WAG determines an identity of the first WAG, and in response to determining the identity of the first WAG, the method includes establishing a tunnel connection between the first WAG and the second WAG. After establishing the tunnel connection, the method includes receiving by the second WAG at least a third data packet corresponding to the first data flow transmitted from the UE, and the second WAG transmits to the first WAG, via the tunnel connection, the third data packet.

Abstract: A system and method for boosting items or news posts in a news feed on an organization news site. A boost module allows an organization communicator or administrator to set boost parameters for a selected news post. The boost parameters may include boosting a news post until it is viewed, boosting for a number of impressions, boosting until a particular date, and setting a rank for the news post relative to other boosted items. Boosting a news post may be done when the news post is created and published or after it has been published. Boosted items or news posts may include an icon or symbol to indicate the item is boosted in the user's newsfeed.

Abstract: Systems are provided for facilitating the building and use of models used to make data preparation recommendations. The systems identify ground truth from a plurality of notebooks and utilizes the ground truth to generate the corresponding data preparation recommendation models. The data preparation recommendation models are used to predict accurate (e.g., useful and relevant) data preparations steps based on user input and user notebook data. The data preparation computing system generates a recommendation prompt based on output from the data preparation recommendation model that can be viewed and/or selected by the user to be applied to the user's notebook data.

Abstract: An initial mesh is received comprising a hand of a subject. The initial mesh includes a plurality of vertices. A smoothed mesh is generated, and a discrete curvature of the smoothed mesh is determined for each vertex. One or more candidate finger vertices are identified based upon a determination that the discrete curvature for each of the one or more candidate vertices is greater than or equal to a threshold curvature. One or more seed vertices are identified from among the one or more candidate finger vertices based upon a determination that the discrete curvature for one or more other vertices within a neighborhood of each seed vertex is greater than or equal to the threshold curvature. Dilation is performed on the one or more seed vertices to grow one or more patches from the one or more seed vertices. The one or more patches are deprioritized for mesh simplification.

Abstract: Disclosed speech recognition techniques improve user-perceived latency while maintaining accuracy by: receiving an audio stream, in parallel, by a primary (e.g., accurate) speech recognition engine (SRE) and a secondary (e.g., fast) SRE; generating, with the primary SRE, a primary result; generating, with the secondary SRE, a secondary result; appending the secondary result to a word list; and merging the primary result into the secondary result in the word list. Combining output from the primary and secondary SREs into a single decoder as described herein improves user-perceived latency while maintaining or improving accuracy, among other advantages.

Abstract: Non-transform blocks of video content may be coded by selectively changing a scanning order. in some implementations, an encoder or decoder may perform a scanning process on a block according to a scanning order. When the block has not been transformed, the encoder or decoder may selectively change the scanning order to a different order. For example, if the block is associated with a particular type of prediction, the scanning order may be changed to a different order. In another example, if the non-transform block has a size that is smaller than a predetermined size, the scanning order may be changed to a different order.

Abstract: A technique is described herein for assisting a user in editing a file. The technique involves producing current context information that includes an input message and selected file content. The input message describes a user's editing objective, while the selected file content describes a portion of the file to which the editing objective is to be applied. The technique then requests a pattern-completion engine to generate edit information based on the current context information. The edit information describes one or more changes to the selected file content that satisfy the objective of the user. The pattern-completion engine uses a machine-trained autoregressive text-completion model that is trained on revision history information. The model can be trained in a process that incorporates various tests to ensure that the edit information that is generated works as expected, satisfies various performance metrics, and fulfills the editing objectives of the user.

Abstract: Selectively updating branch predictors for loops executed from loop buffers is disclosed herein. In some aspects, a branch predictor update circuit of a processor is configured to detect a loop comprising a plurality of loop instructions in an instruction stream, and to determine that the loop is stored within a loop buffer circuit of the processor. The branch predictor update circuit is further configured to determine a count of potential history register updates to the history register for the plurality of loop instructions, and to determine whether the count of potential history register updates exceeds a size of the history register. The branch predictor update circuit is also configured to, responsive to determining that the count of potential history register updates does not exceed the size of the history register, update a branch predictor of the branch predictor circuit based on the plurality of loop instructions.

Abstract: A synthetic world interface may be used to model digital environments, sensors, and motions for the evaluation, development, and improvement of computer vision and speech algorithms. A synthetic data cloud service with a library of sensor primitives, motion generators, and environments with procedural and game-like capabilities, facilitates engineering design for a manufactural solution that has computer vision and speech capabilities. In some embodiments, a sensor platform simulator operates with a motion orchestrator, an environment orchestrator, an experiment generator, and an experiment runner to test various candidate hardware configurations and computer vision and speech algorithms in a virtual environment, advantageously speeding development and reducing cost. Thus, examples disclosed herein may relate to virtual reality (VR) or mixed reality (MR) implementations.

Abstract: A thermal component has a shield portion and a heat exchanger portion. The shield portion includes a plurality of cells adapted to inhibit radio radiation (RF) having a frequency within a target frequency range, while the heat exchanger portion includes a plurality of elongated channels, each one of the elongated channels being physically connected to and in fluid communication with at least one corresponding cell of the plurality of cells.

Abstract: Techniques are described herein that are capable of performing automatic graph-based detection of potential security threats. A Bayesian network is initialized using an association graph to establish connections among network nodes in the Bayesian network. The network nodes are grouped among clusters that correspond to respective intents. Patterns in the Bayesian network are identified. At least one redundant connection, which is redundant with regard to one or more other connections, is removed from the patterns. Scores are assigned to the respective patterns in the Bayesian network, based on knowledge of historical patterns and historical security threats, such that each score indicates a likelihood of the respective pattern to indicate a security threat. An output graph is automatically generated. The output graph includes each pattern that has a score that is greater than or equal to a score threshold. Each pattern in the output graph represents a potential security threat.

Abstract: Techniques are described herein that are capable of establishing multiple infrastructure connections to multiple access points via a single wireless network interface controller (WNIC). Capability information is analyzed to determine combination(s) of identified frequency bands over which the WNIC is capable of communicating simultaneously. Availability information is analyzed to determine signal qualities associated with respective available frequency bands. A primary infrastructure connection is established to a first access point via the WNIC based at least in part on a first frequency band associated with the first access point being included among the identified frequency bands and being associated with a relatively high signal quality.

Abstract: Example solutions are disclosed for performing a distributed data query for a connected data set, such as a property graph or a relational database, distributed across a plurality of regions (e.g., different geographic regions) under data flow limitations. For a restrictive limitation, a first region stores a data entity that is subject to a data flow limitation, and a second region stores only a reference to the data entity (e.g., a pseudonymous reference). The query is executed in the first region, and at least a partial representation of the state is injected into the query for execution in the second region. The query locates the reference to the data entity in the second region, and the state of the query from the second region is returned. Query results from the plurality of regions are synthesized into a final result. Further solutions address prohibitive limitations when references are not permitted.

Abstract: Embodiments described herein are directed to configuring managed virtual machines. For instance, a management service (e.g., a mobile device manager) may provide configuration settings to a parent virtual machine. Upon successful application of the configuration settings, the parent virtual machine notifies a configuration service that it is in a steady state and provides the configuration settings to the configuration service. The configuration service notifies a cloud-based service (e.g., a virtual desktop service) that it is configured to instantiate virtual machines. The notification informs the cloud-based service that it is permitted to instantiate child virtual machines. Responsive to receiving the notification, the cloud-based service instantiates child virtual machine(s) as needed.

Abstract: The combination of active and reference haptics on an electronic device, such as a wearable display device, can convey information to a user without requiring the user to look at the device. An electronic device may include a housing, a display disposed in the housing and including an interface surface arranged for user contact and a reference haptic. The interface surface includes an active haptic output that provides a time-dependent haptic output and a reference haptic disposed on the housing or the interface surface to provide a time-independent haptic output related to the time-dependent haptic output.

Abstract: The disclosure is directed towards the real-time detection and mitigation of security threats to a domain name system (DNS) for a communication network. A graph-theoretic method is applied to detect compromised DNS assets (e.g., DNS servers and web servers that DNS servers map domain names to). A graph is generated from domain name resolution (DNR) transactions. The nodes of the graph represent the DNS assets and edges between the nodes represent the DNR transactions. The graph is analyzed to detect features that signal compromised assets. The detection of such features serves to act as a binary classifier for the represented assets. The binary classifier acts to classify each node as non-compromised or compromised. The analysis is guided by supervised and/or unsupervised machine learning methods. Once the assets are classified, DNR transactions are analyzed in real-time. If the transaction involves a compromised asset, an intervention is performed that mitigates the threat.