Abstract: A computer implemented method includes creating a cache within system management memory to cache data from a firmware flash memory to allow access to the cache by system firmware, providing a baseboard management controller ownership of the firmware flash memory in a server, updating the firmware in the firmware flash memory via the baseboard management controller, relinquishing baseboard management controller ownership of firmware flash memory upon completion of updating the firmware, and flushing the cache back to the firmware flash memory in response to baseboard management controller relinquishing ownership of the firmware flash memory.

Abstract: In various examples there is a computer-implemented method of database construction. The method comprises storing a knowledge graph comprising nodes connected by edges, each node representing a topic. Accessing a topic type hierarchy comprising a plurality of types of topics, the topic type hierarchy having been computed from a corpus of text documents. One or more text documents are accessed and the method involves labelling a plurality of the nodes with one or more labels, each label denoting a topic type from the topic type hierarchy, by, using a deep language model; or for an individual one of the nodes representing a given topic, searching the accessed text documents for matches to at least one template, the template being a sequence of words and containing the given topic and a placeholder for a topic type; and storing the knowledge graph comprising the plurality of labelled nodes.

Abstract: In a calibrated phase-locked loop (PLL), a time-to-digital (TDC) converter circuit can be calibrated to a nominal gain by a calibration circuit to achieve a desired jitter response in the PLL. The TDC circuit in the PLL measures a time difference between the reference clock and a feedback signal as a number of time increments, and the calibration circuit adjusts a resolution of the measurement by adjusting the length of the time increments (i.e., resolution). In a Vernier method employed to measure the time difference, the length of a time increment is determined by a delay difference between a first delay of a first delay circuit in a first series of first delay circuits and a second delay of a second delay circuit in a second series of second delay circuits. Adjusting the resolution of the TDC circuit includes adjusting the delay difference between the first delay and the second delay.

Abstract: A computing system including an edge computing device. The edge computing device may include an edge device processor configured to receive edge device contextual data including computing resource availability data. Based at least in part on the edge device contextual data, the edge device processor may select a processing stage machine learning model of a plurality of processing stage machine learning models and construct a runtime processing pipeline of one or more runtime processing stages including the processing stage machine learning model. The edge device processor may receive a runtime input, and, at the runtime processing pipeline, generate a runtime output based at least in part on the runtime input. The edge device processor may generate runtime pipeline metadata that indicates the one or more runtime processing stages included in the runtime processing pipeline. The edge device processor may output the runtime output and the runtime pipeline metadata.

Abstract: The present disclosure provides methods and apparatuses for multi-screen management. In some implementations, a plurality of connection requests may be received from a plurality of screen devices respectively. A screen host unit corresponding to each screen device may be created. A connection of each screen host unit to a corresponding screen device may be established. Screen display data may be transmitted, by at least one screen host unit, to at least one corresponding screen device through at least one corresponding connection respectively. Moreover, in some implementations, a connection request may be transmitted to a screen management hub. A connection to a corresponding screen host unit created by the screen management hub may be established. Screen display data may be received from the screen host unit through the connection. The screen display data may be displayed.

Abstract: A computer device instantiates a first Transport Layer Security (TLS) endpoint having access to a trusted execution environment (TEE) of the processor; generates in the TEE in an endpoint-specific public-private key pair bound to the first TLS endpoint; generates of attestation data verifying that the endpoint-specific public-private key pair was generated in the TEE and is bound to the first TLS endpoint; and signs the attestation data in the TEE using a TEE private key securely embedded in the processor. The device generates a TEE signature using an endpoint-specific private key of an endpoint-specific public-private key pair; and indicates of the attestation data, an endpoint-specific public key of the endpoint-specific public public-private key pair and the TEE signature to a second TLS endpoint within a TLS handshake message exchange between the first TLS endpoint and the second TLS endpoint.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for enabling runtime supply chain security of web applications and the discovery of active malware attacks. For example, a server is configured to receive CSP-based data from browsers executing on various clients. Such data may be received via a browser extension or via a proxy between the web applications and the browsers. Using the CSP-based data, the server generates a database of supply chain inventory. The database specifies resources that are loaded for a particular web application, along with a location from where such resources are loaded. The database further specifies a chain of dependencies between such resources. The database is analyzed to determine whether any such resources have been compromised with malware or whether clients on which such resource have been loaded have been compromised with malware. Responsive to determining such cases, actions(s) may be performed to mitigate the malware.

Abstract: Replication of data from a primary computing system to a secondary computing system. The replication is single-threaded or multi-threaded depending on one or more characteristics of the data to be replicated. As an example, the characteristics could include the type of data being replicated and/or the variability on that data. Also, the multi-threading capabilities of the primary and secondary computing systems are determined. Then, based on the identified one or more characteristics of the data, the primary computing system decides whether to perform multi-threaded replication and the multi-threading parameters of the replication based on the one or more characteristics of that data, as well as on the multi-threading capabilities of the primary and secondary computing system.

Abstract: Systems and methods are directed to a compression scheme for stable universally unique identities in a collaborative editing environment. A client receives edits to a document and immediately creates a local short identity for an element of each edit, whereby the local short identity represents an offset from a base unique identity associated with the client from which a unique identifier assigned to the element is derivable. The local short identity information including the local short identity for each element is transmitted to a server. Subsequently, global short identity information is received from the server from which one or more global short identities that each map to a local short identity of a client of a plurality of clients collaborating on the document can be determined by the client. Each global short identity is a compact identity that is universally unique to the plurality of clients including the client.

Abstract: An online meeting system begins the process of connecting a user to an online meeting when a request is received from a user to start or join the online meeting. In response to the request, a pre-meeting user interface (UI) is displayed having a user interface control which, when activated, enables transmission of audio and/or video data for the online meeting, and prior to activation of the control, connection parameters are shared with an online meeting service to preheat the meeting. In response to activation of the control, transmission of audio and/or video data for the online meeting is enabled.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for managing transmission of retries between computing nodes in a core network environment. For example, systems described herein involve collecting transmission data including timing and failure data for use in generating a retry policy that includes rules and instructions that govern transmission of retries between computing nodes. Once generated, the retry policy may be applied to message packages by selectively transmitting message retries based on specific timing delays that are determined from the collected transmission information. This the generation and implementation of the retry policy may significantly reduce a quantity of retry messages transmitted by computing nodes within a core network architecture, thereby improving network conditions in a variety of ways.

Abstract: A computer-implemented technique is described herein for defining and applying constraints that regulate a supervisee's interaction with applications. In one implementation, the technique provides a user interface presentation to a supervisor that lists a set of applications that run on plural application execution platforms. The user interface presentation also allows the supervisor to set platform-agnostic constraint information for any identified application. The platform-agnostic constraint information, once set for an application, constrains interaction by a supervisee with all versions of that same application. That is, the constraint information is said to be agnostic with respect to platform in the sense that it applies to a variety of application execution platforms that run the application. In one example, the platform-agnostic constraint information specifies a permitted amount of an activity that the supervisee is permitted to perform across all versions of an application.

Abstract: The present disclosure relate to highlighting audience members with reactions to a presenter of an online meeting. Unlike physical, fact-to-face meeting that enables spontaneous interactions among the presenter and the audiences that are collocated with the presenter, presenting materials during an online meeting raises an issue of the present not being able to see real-time reactions or feedback by the audience members. The present disclosure addresses the issue by dynamically determining one or more audience members who indicate reactions during the online meeting or presentation and displaying faces of the one or more audience members under spotlight to the presenter. The presenter sees faces of the audience members with reactions during the online presentation and responds to the audience members and keep the audience engaged. The spotlight audience server analyzes video frames and determines types of reactions of the audience members.

Abstract: A method, computer program product, and computing system for: monitoring a meeting between a patient and a medical entity during a medical encounter; gathering information during the medical encounter, thus generating gathered encounter information; generating medical encounter topical information via artificial intelligence, wherein the medical encounter topical information is based at least in part upon the gathered encounter information and is configured to provide guidance to the medical entity concerning one or more topics to be discussed during the medical encounter; and providing the medical encounter topical information to the medical entity.

Abstract: Methods and systems for detecting personally identifiable information in data associated with a cloud computing system are described. An example method includes ingesting the data associated with the cloud computing system to generate source data. The method includes processing the source data by: performing cell-based de-duplication to generate cell-based de-duplicated data, subjecting the cell-based de-duplicated data to regular expression classification to generate a first subset of initial results, tokenizing the cell-based de-duplicated data to generate tokenized data, and de-duplicating the tokenized data and subjecting de-duplicated tokenized data to a first named entity recognition classification to generate a second subset of the initial results. The method includes cross-referencing the cell-based de-duplicated data and the initial results and subjecting output of the cross-referencing to a second named entity recognition classification to generate final results.

Abstract: A computer system that records a replayable execution trace based on recording cache coherency protocol (CCP) messages into a first trace, and on recording memory snapshot(s) into a second trace. Based on determining that tracing of execution of a first execution context is to be enabled, the computer system initiates logging, into the second trace, of one or more memory snapshots of a memory space of the first execution context, and enables a hardware tracing feature of a processor. Enabling the tracing feature causes the processor to log, into the first trace, CCP message(s) generated in response to one or more memory access into the memory space of the first execution context. After enabling the hardware tracing feature of the processor, the computer system also logs or otherwise handles a write into the memory space of the first execution context by a second execution context.

Abstract: The present disclosure relates to systems, devices, and methods for suggesting geographic results to a user. The systems, devices, and methods may include receiving a prefix for a geographic query and ranking received candidate results for the prefix of the geographic query. The systems, devices, and methods may provide a query expansion based on a highest ranked candidate result. The systems, devices, and methods may determine a likelihood of the user selecting the query expansion, and if the likelihood exceeds a threshold, provide the query expansion.

Abstract: Classifying packages based on generic feature extraction. A computer system identifies a set of training packages, including a first subset known to be malicious, and a second subset known to be benign. The computer system extracts a set of training feature vectors from the set of training packages by inputting each training package to a feature extraction model, which generates a training feature vector for each training package. The computer system trains a classification model using the set of training feature vectors. After training the classification model using the set of training feature vectors, a subject package is classified as malicious or benign based on extracting a feature vector for the subject package by inputting the subject package to the feature extraction model, and inputting the feature vector to the classification model.

Abstract: Techniques for ensuring address translation services (ATS) functionality is used correctly and safely for any type of device that supports ATS, even for devices that might potentially be acting in a rogue manner, are disclosed. A host performs an integrity check on a device that uses ATS to prevent the device from maliciously using a locally cached HPA. The device submits a first ATS-enabled request to the host. The device receives metadata comprising (i) a first integrity check vector (ICV) that is usable to authenticate the device, (ii) the HPA, and (iii) an initialization vector (IV). The device locally caches the metadata in an address translation cache (ATC). The device submits a second ATS-enabled request, which includes the metadata. The host then independently authenticates the device using the received metadata in the request.

Abstract: The techniques disclosed herein enhance the efficiency and functionality of directory systems. This is accomplished by augmenting a primary table with an extended table for storing properties of an associated entity (e.g., a user, a company). A table serves to organize directory data and comprises rows and columns. Each row of the primary table stores an entity with each column storing an associated property. In contrast, the primary table is configured with an extended table in which each row of the extended table stores a property for an associated entity while each column stores additional information for the property such as timestamps and metadata. Storing specific properties in the extended table eliminates empty spaces in the primary table thereby reducing the volume of stored data. Moreover, by including additional data for properties, the extended table enables property-specific features such as search, synchronization, extensibility, and lifecycle management.

Abstract: A wearable device includes multiple subsystems including a processor and a memory device, multiple temperature sensors coupled to sense temperatures of the multiple subsystems, and programming, including an application, stored on the memory device for execution by the processor to perform operations. The operations include receiving temperature information from the multiple temperature sensors corresponding to temperatures associated with the multiple subsystems, processing the temperature information to identify a first subsystem of the multiple subsystems, and providing a notification to the application executing on the processor to mitigate application performance in a manner to reduce heat generated by the first subsystem.

Abstract: Solutions for balancing speed and risk by managing configuration changes include: receiving a second configuration item for displacement, in an exposure group, of a first configuration item; receiving an exposure state, wherein the exposure state indicates an exposure tree comprising a first configuration item branch and a second configuration item branch; determining, based at least on the exposure state: a first portion of the exposure group to continue with the first configuration item, and a second portion of the exposure group to receive the second configuration item; deploying the second configuration item to the second portion of the exposure group, in accordance with the exposure state; receiving, from the central orchestrator, an updated exposure state; and deploying the second configuration item in accordance with the updated exposure state. In some examples, the exposure tree is a hierarchical binary tree. An exemplary configuration item includes a software application version.

Abstract: A computing system is provided, including a camera configured to capture a series of images in a video stream, processing circuitry, and an image processing pipeline including a preprocessing module and an encoder, in which the preprocessing module is configured to receive the video stream from the camera at a camera-native video data rate parameter. The processing circuitry is configured to communicate with a server to establish a joint video communication session with remote client devices and receive a requested video data rate parameter from the server for the video stream captured by the camera. The processing circuitry is further configured to send a command to the preprocessing module to adjust the camera-native video data rate parameter of the video stream to the requested video data rate parameter and preprocess the video stream at the requested video data rate parameter and pass the preprocessed video stream to the encoder.

Abstract: A ground station computing system for communicating with a satellite is provided, including a processor and associated memory storing instructions that cause the processor to execute a software-defined radio (SDR) program. The SDR program is configured to receive signals from a plurality of satellites and determine a doppler shift signature pattern of one of the satellites. The SDR program is further configured to detect, within the received signals from the plurality of satellites, packet preambles from the one of the plurality of satellites, based on correlations between portions of the received signals and the doppler shift signature pattern.

Abstract: Distributed database systems including compute nodes and page servers are described herein that enable compute nodes to pushdown certain query processing compute tasks to the page servers to take advantage of otherwise idle compute resources at the page servers, and to reduce the quantity of data that moves between compute nodes and page servers. A distributed database system includes a page server and a compute node, wherein the page server is configured to maintain multiple versions of stored data objects. The compute node is configured to receive a query and generate a transaction context (TC) and modified table schemas (MTS) scoped to the query, and pushdown the query, TC and MTS to the page server that is configured to determine which data objects at the page server satisfy the query, and for each such object, which version of the object should be returned based on the TC.

Abstract: A method for calibrating a quantum-computing operation comprises: (a) providing a trial control-parameter value to the quantum computer; (b) receiving from the quantum computer a result of a characterization experiment enacted according to the trial control-parameter value; (c) computing a decoder estimate of an objective function evaluated at the trial control-parameter value based on decoding the result of the characterization experiment; (d) consuming the trial control-parameter value and the decoder estimate in a machine trained to return a model estimate of the objective function evaluated at the trial control-parameter value; and (e) selecting a new trial control-parameter value based on the model estimate.

Abstract: A camera assembly for inclusion in a camera is described. The camera assembly includes a lens barrel and a retaining mechanism that is configured to restrict movement of the lens barrel relative to the retaining mechanism. The retaining mechanism is configured to be attached to a mounting surface of a camera enclosure, such that position of the camera assembly remains fixed relative to the camera enclosure.

Abstract: Systems and methods for inviting an external user to join a shared collaborative channel are provided. In particular, a computing device may generate a common channel invitation for one or more users and cause the common channel invitation to be transmitted to the one or more users. The common channel invitation may include an invitation link to a shared collaborative channel and a selectable option to redeem the common channel invitation to the shared collaboration channel. The computing device is further monitor whether the one or more users access the shared collaborative channel via the invitation link, and in response to detecting that at least one of the one or more users is accessing the shared collaborative channel via the invitation link, allow the at least one user to view at least some content of the shared collaborative channel.

Abstract: Techniques for computer memory management are disclosed herein. In one embodiment, a method includes in response to receiving a request for allocation of memory, determining whether the request is for allocation from a first memory region or a second memory region of the physical memory. The first memory region has first memory subregions of a first size and the second memory region having second memory subregions of a second size larger than the first size of the first memory region. The method further includes in response to determining that the request for allocation of memory is for allocation from the first or second memory region, allocating a portion of the first or second multiple memory subregions of the first or second memory region, respectively, in response to the request.

Abstract: A mechanism for repeatedly adjusting communication with a subject head-mounted device based on a changing real time environment of the subject head-mounted device. By utilizing information about the environment context in which the head-mounted device exists, the optimal parameters may be more quickly determined and with less power. The environment context may be generated from sensors on the head-mounted device itself, or from a proximate sensor device. Thus, the communication properties (such as which protocol to use and what parameters) may be quickly determined in time to be useful to maintain a good connection despite movement of the head-mounted device, and despite the connection being dropped and reestablished. Furthermore, limited battery power is more judiciously utilized.

Abstract: A computer implemented method includes receiving a request for device validation, reading a genesis record from a device, the genesis record containing a device identification (ID), an original owner ID, a current owner ID, and a first hash of the device ID, an original owner ID, a current owner ID, and validating, by multiple processing entities having replicated copies of a chain that includes the genesis record and a succeeding transfer block, ownership of the device.

Abstract: Techniques are disclosed for configuring a hardware-based networking device in a virtualized computing network comprising a plurality of servers hosting virtual machines. The hardware-based networking device is configured to provide network interfaces for virtual machines hosted on the plurality of servers to enable virtual network communications within a virtual network in accordance with associated policies that are applied by the hardware-based networking device.

Abstract: An improved human-computer interface (“HCI”) is disclosed herein for viewing a three-dimensional (“3D”) representation of a real-world environment from different, changing, and/or multiple perspectives. An AR device may capture, in real-time, a 3D representation of a scene using a surface reconstruction (“SR”) camera and a traditional Red Green & Blue (“RGB”) camera. The 3D representation may be transmitted to and viewed on a user's computing device, enabling the user to navigate the 3D representation. The user may view the 3D representation in a free-third-person mode, enabling the user to virtually walk or fly through the representation captured by the AR device. The user may also select a floor plan mode for a top-down or isomorphic perspective. Enabling a user to view a scene from different perspectives enhances understanding, speeds trouble-shooting, and fundamentally improves the capability of the computing device, the AR device, and the combination thereof.

Abstract: An enhanced user experience is disclosed herein that provides for gesture-based configuring of pivot tables. In various implementations, a pivot table includes query areas associated with fields of a data table being summarized by the pivot table. Gestures made with respect to an area of the pivot table drive changes in the association of the fields of the data table with the query areas of the pivot table. As user input is received with respect to an area of the pivot table, relevant fields are identified, and new associations are made between the query areas and the fields. The pivot table may then be updated accordingly based on the new associations.

Abstract: Systems, methods, and devices are provided for generating and using text-to-speech (TTS) data for improved speech recognition models. A main model is trained with keyword independent baseline training data. In some instances, acoustic and language model sub-components of the main model are modified with new TTS training data. In some instances, the new TTS training is obtained from a multi-speaker neural TTS system for a keyword that is underrepresented in the baseline training data. In some instances, the new TTS training data is used for pronunciation learning and normalization of keyword dependent confidence scores in keyword spotting (KWS) applications. In some instances, the new TTS training data is used for rapid speaker adaptation in speech recognition models.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for utilizing an interactive graphing system to achieve improved dataset exploration utilizing an intelligent workflow and an interactive user interface. More specifically, the interactive graphing system facilitates generating updated network graphs that include inferred user influences based on implicit user action. Indeed, the interactive graphing system can automatically generate and present a user with an updated network graph that includes added, removed, or subsetted elements and relationships that are otherwise hidden from a user. Additionally, the interactive graphing system facilitates network graph exploration and processing of customized combined network graphs that join otherwise separate network graphs.

Abstract: A wireless networking system is provided. The wireless networking system includes a base station device including processing circuitry configured to detect a transmission rate from a portion of a preamble of an incoming packet transmission signal and adapt a radio configuration to receive a remainder of the incoming packet transmission signal at the transmission rate.

Abstract: Techniques of implementing software filtered non-volatile memory in a computing device are disclosed herein. In one embodiment, a method includes detecting an entry being written to a guest admin submission queue (gASQ) by a memory driver of a virtual machine hosted on the computing device. Upon detecting the entry written to the gASQ by the memory driver, the command in the entry is analyzed to determine whether the command is allowed based on a list of allowed or disallowed commands. In response to determining that the command in the entry is not allowed, without sending the command to the non-volatile memory, generating an execution result of the command in response to the entry being written to the gASQ by the memory driver. As such, potentially harmful commands from the memory driver are prevented from being executed by the non-volatile memory.

Abstract: In non-limiting examples of the present disclosure, systems, methods and devices for filtering predictive text surfacing candidates are provided. A predictive text filtering model may be maintained. The predictive text filtering model may comprise a plurality of terms that are associated in the predictive text filtering model with a precarious classification, and a range of a number of words for filtering cooccurrences of precarious and other precarious or blocklist terms from the plurality of terms. A text input may be processed with a predictive text model. A plurality of surfacing candidates may be determined based on the processing of the text input with the predictive text model. The predictive text filtering model may be applied to a surfacing candidate of the plurality of candidates. The surfacing candidate may be filtered from further processing. At least one non-filtered surfacing candidate may be displayed.

Abstract: Systems and methods are provided for generating and training a relation extraction model configured to extract document-level relations. Systems obtain a knowledge database that comprises a plurality of entity tuples and a plurality of relation types, use the knowledge database to generate annotated relation instances based on relation instances that are identified in a set of unlabeled text, generate a training dataset comprising the annotated relation instances and the set of unlabeled text, and generate the machine learning model via modular self-supervision. Systems and methods are also provided for using a relation extraction model to extract document-level relations in specific use scenarios, such as for extracting drug response relations from full-text medical research articles.

Abstract: Techniques and systems are provided for positioning mixed-reality devices within mixed-reality environments. The devices, which are configured to perform inside out tracking, transition between position tracking states in mixed-reality environments and utilize positional information from other inside out tracking devices that share the mixed-reality environments to identify/update positioning of the devices when they become disoriented within the environments and without requiring an extensive or full scan and comparison/matching of feature points that are detectable by the devices with mapped feature points of the maps associated with the mixed-reality environments. Such techniques can conserve processing and power consumption that would be required when performing a full or extensive scan and comparison of matching feature points. Such techniques can also enhance the accuracy and speed of positioning mixed-reality devices.

Abstract: A system for facilitating intensity image capture and time of flight capture. The system includes an image sensor array comprising a plurality of image sensor pixels, one or more processors, and one or more hardware storage devices storing instructions that are executable by the one or more processors to configure the system to facilitate intensity image capture and time of flight capture by configuring the system to perform interleaved intensity image capture and time of flight capture operations using the image sensor array.

Abstract: An integrated approach is provided to running web applications with various compatibilities that do not require third-party extensions or sacrifice user experience. When a page of an application incompatible with a first browser is to be executed, an instance of a second browser with which the page is compatible is separately invoked and/or executed without opening a window for that second browser. Instead, the second browser opens a page within the window of the first browser. Moreover, rendering and/or contextual information for a page opened via the second browser is provided to the first browser. Such information is utilized by the first browser to provide a visual experience to the user in which the web page is being hosted by the first browser, even though it is in fact being hosted by the second browser.

Abstract: A computing system delegates a request between a first container in user mode of an operating system on a webserver system and a second container in the user mode of the operating system. The operating system includes a kernel. A service in the second container creates a delegation queue in the kernel of the operating system. The service adds an identifier as a property of the delegation queue in the kernel, wherein the identifier is unique across the first container and the second container. A router executing in the first container opens the delegation queue in the kernel using the identifier, responsive to the adding operation. The request is delegated to the service executing in the second container via the delegation queue in the kernel, responsive to the opening operation.

Abstract: Techniques of memory tiering include retrieving, from a first tier in a first memory, data from a data portion and metadata from a metadata portion of the first tier upon receiving a request to read data corresponding to a system memory section. The method can then include analyzing the data location information to determine whether the first tier currently contains data corresponding to the system memory section in the received request. In response to determining that the first tier currently contains data corresponding to the system memory section in the received request, transmitting the retrieved data from the data portion of the first memory to the processor in response to the received request. Otherwise, the method can include identifying a memory location in the first or second memory that contains data corresponding to the system memory section and retrieving the data from the identified memory location.

Abstract: A computing system receives unlabeled datasets based on logon event data. Various features are extracted based on the unlabeled datasets. A probability score based on the various features is generated by unsupervised machine-learning models that have been trained using the unlabeled datasets. The probability score indicates whether the logon event data is anomalous. The probability score is used to label the unlabeled datasets to thereby generate labeled datasets. The various features are extracted based on the labeled datasets. A contribution score based on the various features is generated by supervised machine-learning models that have been trained using a subset of the labeled datasets. The contribution score specifies which of the various features are likely to have caused the logon event data to be labeled as anomalous. Output data is generated specifying features that likely caused the logon event data to be labeled as anomalous.

Abstract: The described technologies enable a computing device to allocate at least a portion of its persistent memory as volatile memory during runtime. At least some implementations create a file in the persistent memory of the computing device. The file is created in the persistent memory of the computing device during runtime of a virtual machine (VM) hosted by the computing device. The file may be allocated to the VM. The file allocated to the VM may be used as volatile memory. For example, the VM may use the file to store temporary data (e.g., volatile data). In some implementations, the temporary data is associated with an application executing in the VM.