Abstract: A method includes estimating a number of threads to execute batch job within maximum completion time by executing a thread estimation algorithm. Executing the thread estimation algorithm includes: determining, using an ML model, a collection of one or more combinations, each including an estimated number of threads and an actual completion time for processing the batch job using the estimated number of threads, the actual completion time being less than or equal to the maximum completion time, and saving the collection including the one or more combinations in a list of threads and completion times. The list of threads and completion times is used to select, based on a list of cloud virtual machines available for use, an optimal virtual machine or an optimal virtual machine combination, the optimal virtual machine or the optimal virtual machine combination being capable of executing the batch job within the maximum completion time.

Abstract: Techniques are described for providing session management functionalities using an access token (e.g., an Open Authorization (OAuth) access token). Upon successful user authentication, a session (e.g., a single sign-on session) is created for the user along with a user identity token that includes information identifying the session. The user identity token is presentable in an access token request sent to an access token issuer authority (e.g., an OAuth server). Upon receiving the access token request, the user identity token is parsed to identify and validate the session against information stored for the session. The validation can include various session management-related checks. If the validation is successful, the token issuer authority generates the access token. In this manner, the access token that is generated is linked to the session. The access token can then be used by an application to gain access to a protected resource.

Abstract: A secure, modular multi-tenant machine learning platform is configured to: receive untrusted code supplied by a first tenant; perform a security scan of the untrusted code to determine whether the untrusted code satisfies a set of one or more security requirements; responsive to determining that the untrusted code satisfies the security requirement(s): deploy the untrusted code to a runtime execution environment; deploy a machine learning model associated with the first tenant to the runtime execution environment, the untrusted code being configured to perform one or more functions using the machine learning model; receive a set of untrusted code supplied by a second tenant; perform a security scan of the untrusted code to determine whether the untrusted code satisfies the security requirement(s); and responsive to determining that the untrusted code does not satisfy the security requirement(s): refraining from deploying the untrusted code to a runtime execution environment.

Abstract: A system synchronizes a server-side DOM tree and a browser-side DOM tree with one another. Server may receive from a browser, a hash value of the browser-side DOM tree, and a server-side update instruction for applying a first server-side update to the server-side DOM tree to synchronize with a first browser-side update by the browser to the browser-side DOM tree. The server may identify the server-side DOM tree based on the hash value. The server may execute upon the server-side DOM tree, the first server-side update and a second server-side update that is triggered by the first server-side update. The server may compute a browser-side update instruction for applying a second browser-side update to the browser-side DOM tree to synchronize with the server-side DOM tree. The server may transmit the browser-side update instruction to the browser, and the browser may apply the second browser-side update to the browser-side DOM tree.

Abstract: Techniques are disclosed for generating a topology of components based on a set of components provided by a user. The system identifies, for each particular component of the first set of components, one or more characteristics. The characteristics may include at least one of: a rule associated with the particular component, a requirement associated with the particular component, a data input type corresponding to the particular component, and data output type corresponding to the particular component. Based on the characteristics, the system determines that an additional component not included in the first set of components is required for connecting the first set of components. The system selects the additional component and determines a topology of components that includes the first set of components and the additional component. The system also determines a dataflow between components in the topology of components.

Abstract: A client cookie management system is disclosed that includes capabilities for securely managing a session between a web-based application and a user interacting with the web-based application using session cookies. The system receives a request from a user to access a resource provided by a web server and forwards the request to the web server. The web server generates a session cookie comprising a session identifier associated with a session created for the user. The system receives the session cookie from the web server and generates a new session cookie comprising a new session identifier and transmits the new session cookie to the client application. The system receives a second request to access a different resource from the client application. The second request comprises the new session cookie. Upon determining that the new session cookie is not modified, the system transmits the second request to the web server.

Abstract: A computing network includes nodes of different work groups. Nodes of a work group are dedicated to transactions of the work group. If a node of a first work group is predicted to have an idleness window, a second work group may borrow the node to execute a transaction of the second work group. At least a subset of steps of the transaction may be categorized into a step group. Trees of a transaction may be categorized into one or more tree groups. A node is selected for executing a transaction, if the predicted idleness duration of the node is sufficient relative to the predicted runtime of the transaction, the step group, and/or tree group. A credit system is maintained. A first work group transfers a credit to a second work group when borrowing a node of the second work group for executing a transaction of the first work group.

Abstract: Disclosed is an improved approach to implement cursor sharing in database systems, where a server-side mapping of cursor identifiers to SQL is maintained to allow for continued use of client-side statement caches even after connections and database sessions are returned to shared pools and then subsequently re-assigned. This avoids the need to clear the statement cache across session releases to the database session pools. Instead, applications can retain their statement cache while still leveraging the benefits of server based pooling solutions.

Abstract: Embodiments predict errors using database validation rules. Validation rules can be defined that include business logic for validating transactions performed on a database with a data model. Transactions can be performed using the database, where the database is in a post-transaction state after performance of the transactions. The database can be validated in the post-transaction state by performing the defined business logic for a subset of validation rules, where at least one validation rule fails to validate. Using a trained machine learning model, one or more errors for one or more future transactions can be predicted, the predicted errors being based on the at least one failed validation rule.

Abstract: Techniques for configuring autosave triggers in a computing environment based on environment and data conditions are disclosed. A system trains a machine learning model based on data attributes and environmental attributes to generate autosave value triggers for a computing environment. The autosave value triggers are triggered by different conditions. For example, one autosave trigger may be triggered when an error condition is detected. Another may be triggered when a certain number of operations are performed. The machine learning model generates autosave trigger values scores for one or more autosave triggers. The system may implement the autosave triggers in the computing environment based on the autosave trigger values.

Abstract: Operations include determining whether to cache resources accessed by a query based on the execution time of the query. The system identifies a set of executions of a same query. The system determines a cumulative execution time for the set of executions of the same query. If the cumulative execution time exceeds a threshold value, then the system caches a resource used for execution of the query.

Abstract: Systems, methods, and other embodiments associated with branch prediction in workflows are described. In one embodiment, a branch predictor is configured to make branch predictions at decision elements of a workflow that executes serially, by at least: monitoring the workflow to identify when a decision element is encountered during execution. In response to encountering a first decision element in the workflow that includes a plurality of branch paths: (i) executing a prediction that predicts a resulting path of the first decision element to predict a first user interface from a plurality of possible user interfaces that are associated with the workflow; and (ii) pre-building the first user interface into memory including a structure and content configured for being rendered on a display. The pre-built first user interface is then displayed on a display device when the workflow reaches a first terminal element associated with the first user interface.

Abstract: Techniques are disclosed for generating a message stream configured to indicate a source of the various messages within the message stream. In particular, the indicators identify which interface the messages were received at a terminal (e.g., of a mobile handset). The terminal receives messages on various interfaces, and separates the messages received via different interfaces with interface switch indicators within the message stream. In one embodiment, the smart card receives a message stream that includes sets of messages and interface switch indicators therein. The smart card delivers messages from the message stream to a single logical partition of the smart card up until an interface switch indicator is identified in the message stream. From that point, the smart card delivers messages from the message stream to a different logical partition of the smart card up until another interface switch indicator is identified in the message stream.

Abstract: A computer measures for each column in many rows, a respective frequency of statements that filter the column in a workload of database statements, a respective count of distinct values used for filtration on the column in each statement individually, a respective frequency of each of the counts of distinct values used for filtration on the column across all of the database statements, and a respective value range of the column for each of many storage zones. A respective efficiency is measured for each of many distinct interleaved sorts. Each interleaved sort uses a respective distinct subset of the columns. Each interleaved sort is based on portions of each of the values for each row in a sampled subset of rows in each column of the subset of the columns of the interleaved sort. Efficiency measurement is based on frequencies of statements, value ranges of columns for each storage zone, and frequencies of counts of distinct values.

Abstract: A new type of table join operation, outer semi join (OSJ), is provided, which can be used by an optimizer layer and an execution layer of a database management system (DBMS). OSJ combines the semantics of both left outer-join and semi-join. The concept of an anti-join marker (AJM) is also introduced, which specifies whether a matching row was not found between joined tables for each result row in an OSJ operation. The OSJ operation supports unnesting of a class of disjunctive ANY, ALL, EXISTS, NOT EXISTS, IN, and NOT IN subqueries for execution plan optimization. The disjunction may contain filter predicates. For unnesting, OSJ avoids the need of using a distinct operator on the right table and also supports using inequality (e.g. >, >=, <, <=) in connecting or correlating conditions of subqueries, rather than being limited to equality only.

Abstract: Techniques discussed herein relate to improved data recovery techniques within cloud computing environments. The disclosed techniques utilize consistency groups that are identified for volumes corresponding to a compute instance. A plurality of resource identifiers uniquely identifying a respective cloud computing resource of the cloud computing environment can be maintained. A cloud computing instance corresponding to a resource identifier may be identified and volume metadata associated with that resource identifier is obtained. The volume metadata identifying at least one of a block volume or boot volume. A consistency group is generated for the identified volume devices for the computing instance and one or more schedules can be generated with which various snapshots of the volume devices of the group are to be subsequently generated.

Abstract: Database transaction records that are received for committing data to a database may be associated with one or more validation tasks. When one of the validation tasks fails, the fault is detected and processing of the transaction record is halted. Instead of terminating the transaction record and requiring the submitting system to reinitiate the process, the system may use a mapping table to determine whether an automatic resubmission is possible. A new transaction record may be generated that copies an invocation context from the original transaction record, and portions of the transaction payload may be copied to the new transaction record with changes that ensure the new transaction record will pass the validation tasks. The new transaction record can then be submitted through the same interface that received the original transaction record, and the original transaction record can be removed from a transaction data store.

Abstract: A graph processing engine is provided for executing a graph query comprising a parent query and a subquery nested within the parent query. The subquery uses a reference to one or more correlated variables from the parent query. Executing the graph query comprises initiating execution of the parent query, pausing the execution of the parent query responsive to the parent query matching the one or more correlated variables in an intermediate result set, generating a subquery identifier for each match of the one or more correlated variables, modifying the subquery to include a subquery aggregate function and a clause to group results by subquery identifier, executing the modified subquery using the intermediate result set and collecting subquery results into a subquery results table responsive to pausing execution of the parent query, and resuming execution of the parent query using the subquery results table.

Abstract: Techniques are described herein for performing thread-local garbage collection. The techniques include automatic profiling and separation of private and shared objects, allowing for efficient reclamation of memory local to threads. In some embodiments, threads are assigned speculatively-private heaps within memory. Unless there is a prior indication that an allocation site yields shared objects, then a garbage collection system may assume and operate as if such allocations are private until proven otherwise. Object allocations in a private heap may violate the speculative state of the heap when reachable outside of the thread. When violations to the speculative state are detected, an indication may be generated to notify the garbage collection system, which may prevent thread-local memory reclamation operations until the speculative state is restored.

Abstract: Layouts for elements of a flowchart or flow diagram may use recursive algorithms that trace along each parent-child pathway to ensure that child elements always occur after parent elements in a horizontal spacing. Vertical spacing requirements may then be calculated for each element, along with a vertical space above a center line and a vertical space below a center line for each element. These vertical spacing requirements may then be used by a recursive algorithm to assign vertical positions to each of the elements. The vertical spacing may ensure that lanes created for each branch element are not crossed by later elements in the process flow, which ensures that connections between elements may be clearly distinguished from each other.

Abstract: An identity service in a cloud environment is communicatively coupled to a proxy key vault in the cloud environment and to an external key manager (EKM) located outside of the cloud environment. The identity service receives a token request for a communication credential from the proxy key vault and verifies the request based on a client credential associated with the proxy key vault. The identity service generates the client credential and signs the communication credential with a private key associated with the EKM. The identify service transmits the signed communication credential to the proxy key vault. The communication credential can be used to substantiate cryptographic operation requests to the EKM.

Abstract: A database manager is disclosed that retrieves database records having binary encoded data from a database and instantiating objects in an in-memory database. Binary encoding compresses data, allowing many subrecords to be stored a single blob field of a database record. Retrieving chunks from storage reduces transfer time by reducing the size of data and the number of operations needed to retrieve all the subrecords. The database manager receives database access requests from a database application. Changes made to the database objects and committed by the application are written back to the persistent database as versioned delta records. In a subsequent session, loading the database from storage includes first loading the most recent snapshot record, then applying changes to the data stored in delta records. The changes stored in the delta records are applied to the data in the snapshot record in the order in which they were made.

Abstract: Techniques for extracting information from unstructured documents that enable an ML model to be trained such that the model can accurately distinguish in-distribution (“in-D”) elements and out-of-distribution (“OO-D”) elements within an unstructured document. Novel training techniques are used that train an ML model using a combination of a regular training dataset and an enhanced augmented training dataset. The regular training dataset is used to train an ML model to identify in-D elements, i.e., to classify an element extracted from a document as belonging to one of the in-D classes contained in the regular training dataset. The augmented training dataset, which is generated based upon the regular training dataset may contain one or more augmented elements which are used to train the model to identify OO-D elements, i.e., to classify an augmented element extracted from a document as belonging to an OO-D class instead of to an in-D class.

Abstract: A key management service (KMS) in a cloud computing environment has an internal vault for cryptographic operations by an internal cryptographic key within the cloud environment and a proxy key vault communicatively coupled to an external key manager (EKM) that stores an external cryptographic key. The KMS uses a provider-agnostic application program interface (API) that permits the cloud service customer to use the same interface request and format for cryptographic operation requests regardless of whether the request is for an operation directed to an internal vault or to an external vault and regardless of the particular vendor of the external key management service operating on the external hardware device.

Abstract: The present disclosure relates to systems and methods for an adaptive pipelining composition service that can identify and incorporate one or more new models into the machine learning application. The machine learning application with the new model can be tested off-line with the results being compared with ground truth data. If the machine learning application with the new model outperforms the previously used model, the machine learning application can be upgraded and auto-promoted to production. One or more parameters may also be discovered. The new parameters may be incorporated into the existing model in an off-line mode. The machine learning application with the new parameters can be tested off-line and the results can be compared with previous results with existing parameters. If the new parameters outperform the existing parameters as compared with ground-truth data, the machine learning application can be auto-promoted to production.

Abstract: A data hierarchy including individual data nodes may be used to represent a wide variety of data collections. Requests to change or add nodes in the data hierarchy may be received from many different sources over time. Instead of considering these change requests individually, an interface allows a plurality of change requests to be consolidated together into a single consolidated request. The consolidated request may be displayed in an interface such that changes from each of the original requests may be displayed together in an interface so that a cumulative effect of each of the change requests may be considered before the data changes are committed to the underlying data structure. The consolidated request may maintain links and update underlying data objects representing each of the original requests to provide a record of actions related to the consolidated request.

Abstract: A method for delegated authorization at a security edge protection proxy (SEPP) includes intercepting, from a consumer network function (NF) that does not support access token based authorization, a service based interface (SBI) service request for accessing a service provided by a producer NF that requires access token based authorization. The method further includes operating as an access token authorization client to obtain a first access token on behalf of the consumer NF. The method further includes using the first access token to enable the consumer NF to access the service provided by the first producer NF. The SEPP may also operate as an access token authorization server on behalf of an NRF that does not support access-token-based authorization.

Abstract: Methods, systems, and computer readable media for identifying roaming messages at network functions in a home public land mobile network (PLMN). A method includes receiving, at a home security edge protection proxy (SEPP) for the home PLMN, a request message from a consumer network function in a visitor PLMN and adding, at the home SEPP, a header to the request message indicating that the request message originated in the visitor PLMN. The method includes receiving, at a producer network function in the home PLMN, the request message and determining, at the producer network function, that the request message originated in the visitor PLMN by finding the header indicating that the request message originated in the visitor PLMN. The method includes applying, at the producer network function, a roaming-specific policy while processing the request message in response to determining that the request message originated in the visitor PLMN.

Abstract: The present disclosure relates to systems and methods for an intelligent assistant (e.g., a chatbot) that can be used to enable a user to generate a machine learning system. Techniques can be used to automatically generate a machine learning system to assist a user. In some cases, the user may not be a software developer and may have little or no experience in either machine learning techniques or software programming. In some embodiments, a user can interact with an intelligent assistant. The interaction can be aural, textual, or through a graphical user interface. The chatbot can translate natural language inputs into a structural representation of a machine learning solution using an ontology. In this way, a user can work with artificial intelligence without being a data scientist to develop, train, refine, and compile machine learning models as stand-alone executable code.

Abstract: The disclosed system produces synthetic signals for testing machine-learning systems. During operation, the system generates a set of N composite sinusoidal signals, wherein each of the N composite sinusoidal signals is a combination of multiple constituent sinusoidal signals with different periodicities. Next, the system adds time-varying random noise values to each of the N composite sinusoidal signals, wherein a standard deviation of the time-varying random noise values varies over successive time periods. The system also multiplies each of the N composite sinusoidal signals by time-varying amplitude values, wherein the time-varying amplitude values vary over successive time periods. Finally, the system adds time-varying mean values to each of the N composite sinusoidal signals, wherein the time-varying mean values vary over successive time periods.

Abstract: A method for sharing key identification (key ID) and public certificate data for access token verification comprises, at a network function (NF) repository function (NRF) including at least one processor, receiving, from a producer NF, an NF registration message including key ID version information. In response to detecting the key ID version information, sending, to the producer NF, an NF registration response message including a current key ID version value, at least one digital certificate, and at least one corresponding public key to the producer NF.

Abstract: An instruction is received to define or modify a permission constraint corresponding to one or more file. A period of time is determined, where the period is one during which the defined or modified permission constraint is to apply to the one or more files. It is determined that the one or more files are to be deleted following completion of the period of time. A permission-instruction data set representing the permission constraint and a flag indicating that the one or more files are to be deleted following completion of the period of time are stored in a data store. It is detected that the period of time has ended. The one or more files are deleted in response to the detection.

Abstract: Techniques are described herein for function-level limiting of privileges for a target application. Privileges dependencies for different functions of an application are determined based on static evaluation of the code base. A call graph with nodes representing the application functions is established, and the nodes are associated with the determined privilege dependencies. The graph is modified using iterative backward dataflow analysis to associate the nodes in the graph with privileges that are reachable from each node. Transition-edges are identified within the graph, where a transition-edge connects nodes having different sets of privileges. Function calls implementing the identified transition-edges are replaced, in instructions for the application (e.g., bytecode or machine code), with calls to wrapper functions.

Abstract: A processor may receive a request for a query item may include a plurality of identifying markers, relating to data associated with the query item. A machine learning model, trained to identify similar items according to the plurality of identifying markers, may then process the plurality of identifying markers and provide a list of one or more similar items and respective similarity distances. The processor may access a respective entity profile including one or more scenario scores for each of the similar items. The processor may then calculate an entity score for each respective entity profile using the respective similarity distances and the scenario scores. The processor may then generate an entity list by ranking the respective entities associated with each respective entity profile using the entity score. The processor may then output the entity list to the client device.

Abstract: Techniques are disclosed for eliding load and store barriers while maintaining garbage collection invariants. Embodiments described herein include techniques for identifying an instruction, such as a safepoint poll, that checks whether to pause a thread between execution of a dominant and dominated access to the same data field. If a poll instruction is identified between the two data accesses, then a pointer for the data field may be recorded in an entry associated with the poll instruction. When the thread is paused to execute a garbage collection operation, the recorded information may be used to update values associated with the data field in memory such that the dominated access may be executed without any load or store barriers.

Abstract: A method for identifying alternate delivery endpoints for mobile originated data and monitoring reports in a communications network includes establishing, by a network exposure function (NEF) in a communications network, priority rules in a priority configuration database that define routing priority indicators corresponding to a plurality of applications functions (AFs) and receiving a service request or notification request message directed to one of the plurality of AFs from a consumer network function (NF) in the communications network. The NEF accesses a context database to validate context information associated with a destination AF belonging to the plurality of AFs. If the destination AF is unavailable or is not in proximity to the NEF, an event notification request message associated with the service request or notification request message is directed to a prioritized AF specified in the priority configuration database, wherein the prioritized AF is a peer of the destination AF.

Abstract: A client-side spreadsheet with client-side worksheets is constructed. The constructing includes structuring worksheet relationships between the client-side worksheets of the client-side spreadsheet in accordance with data object relationships of data objects of a server-side data structure. A determination is made that an operation has been selected for performing on data of at least one of the client-side worksheets. User input operative to initiate performance of the at least one of the client-side worksheets is detected. Implementation of the operation is initiated in accordance with the worksheet relationships and the data object relationships.

Abstract: Systems, methods, and other embodiments associated with migrating key-value data to a relational database. A method comprises retrieving a namespace from a key-value store and querying the key-value store for a kind category associated with the namespace. The key-value store is accessed and data entities are retrieved that are associated with the kind category that is defined with the namespace identifier. Property names and associated property values are identified in the data entities. The method generates a relational database model including a table; assigns the namespace identifier as schema of the table and assigns the kind category as a table name; builds the table in the relational database model by defining a plurality of columns, wherein a column is defined for each different property name identified from the data entities; and migrates data from the data entities to rows in the table in the relational database model.

Abstract: Techniques are disclosed for partitioning received data for use in a data stream. Data is received during a period of time at a device, such as a data partitioner. The device a) determines that a first subset of the data is for a first system component, b) a second subset of the data is for a second system component, and c) a third subset of the data is for the first system component. Also, determines that a first stream partition is mapped to the first system component and a second stream partition is mapped to the second system component. Based on these determinations, the device assigns the first and third subsets of the data to the first stream partition and the second subset of the data to the second stream partition. Thereafter, the device transmits a stream that includes the first stream partition and the second stream partition.

Abstract: A method for handling hacker intrusion in NF profile management at an NRF includes receiving, at the NRF and from a consumer NF, an NF register request message including an NF profile of the consumer NF, setting and storing an NF profile version number for the NF profile, and communicating the NF profile version number to the consumer NF. The consumer NF stores the NF profile version number and transmits a request for initiating an NF update or NF heart-beat service operation to the NRF. The NRF receives the request for initiating the NF update or NF heart-beat service operation, increments the NF profile version number, and communicates the incremented NF profile version number to the consumer NF. The consumer NF receives the incremented NF profile version number, determines that an NF profile version mismatch has occurred, and, in response, initiates an NF profile corrective action with the NRF.

Abstract: Adaptive data collections may include various type of data arrays, sets, bags, maps, and other data structures. A simple interface for each adaptive collection may provide access via a unified API to adaptive implementations of the collection. A single adaptive data collection may include multiple, different adaptive implementations. A system configured to implement adaptive data collections may include the ability to adaptively select between various implementations, either manually or automatically, and to map a given workload to differing hardware configurations. Additionally, hardware resource needs of different configurations may be predicted from a small number of workload measurements. Adaptive data collections may provide language interoperability, such as by leveraging runtime compilation to build adaptive data collections and to compile and optimize implementation code and user code together.

Abstract: Techniques are disclosed for understanding the visual structure and patterns of documents and detecting anomalies in data of the documents based on the understanding of the visual structure and patterns of the documents. In one aspect, a computer-implemented method is provided that includes accessing a set of documents, converting the set of documents to a set of images in a binary format, generating a common feature template based on the set of images, comparing each image from the set of images to the common feature template to identify images with at least one anomalous feature, and outputting the images with at least one anomalous feature.

Abstract: Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer, where the traffic is generated by a customer network of the customer, such as a customer tenancy or an on-premise network. The traffic can be destined to the target service. The traffic can be tagged by the customer network (e.g., by a gateway of the customer network). The customer network can be associated with the egress policy. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy on the traffic that the target service is receiving.

Abstract: Techniques for placing content in virtual universes at locations contextually compatible with the content are disclosed. A system trains a machine learning model to identify virtual environments compatible with content based on attributes representing contexts of the environments. Using the machine learning model, the system determines a contextual environment for a target content item. The system selects the particular contextual environment for placement of the target content item based on the compatibility score.

Abstract: A system may display a Graphical User Interface including a source region presenting a plurality of source data-serialization elements and a destination region presenting a plurality of destination data-serialization elements. The system may receive a user input associating a first destination data-serialization element, of the plurality of destination data-serialization elements, and a first source data-serialization element of the plurality of source data-serialization elements. Responsive to receiving the user input, the system may generate and store a mapping expression that defines a mapping association between the first source data-serialization element and the first destination data-serialization element. The system may present in a mapping region of the GUI displayed concurrently with the source region and the destination region, a mapping element representing the mapping association between the first source data-serialization element and the first destination data-serialization element.

Abstract: Techniques for processing incomplete service requests are disclosed. A system identifies reference service requests similar to the information of an incomplete service request received from a user. Using an adversarial domain adapter, the system generates an enhanced service augmenting the incomplete service request with predicted information. The system then identifies a subset of the reference service requests meeting a similarity threshold with the enhanced service request. The system processes the incomplete service request based on the subset of the set of reference service requests.

Abstract: Techniques for generating and presenting search filter recommendations are disclosed. A system determines a composition of search filter tiles, including a relative number of machine learning-generated search filter tiles and non-machine learning-generated search filter tiles, based on recommendation criteria. The recommendation criteria include an amount of user search history data that exists. The system applies search filter recommendation policies to generate a set of search filter recommendations, including hard-coded search filters, search filter recommendations generated by a user-specific machine learning model, search filter recommendations generated by a machine learning model trained on data from multiple different users, and algorithm-based recommendations. The system generates different sets of search filter recommendations made up of different ratios of recommendations from different sources based on determining if search filter criteria are met.

Abstract: Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer tenancy, where the traffic is generated by a multi-tenancy service. The traffic can be destined to the target service. The traffic can be tagged by the multi-tenancy service with information indicating that the traffic is egressing therefrom on behalf of the customer tenancy. The customer tenancy can be associated with the egress policy. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy on the traffic that the target service is receiving.

Abstract: A reconciliation engine and data reconciliation techniques are disclosed that partially use machine learning and natural language processing techniques to overcome challenges associated with traditional manual reconciliation engines and data reconciliation techniques without compromising the accuracy and handle the complexity of the features. In one aspect, a computer-implemented method is provided that includes: accessing a source and target table, performing intra-reconciliation on the source table, grouping the source and target table based on system configurations, reconciling data is iterated over each group, where the reconciling data includes: finding, using a machine learning model, a closest match for each group, and outputting the closest match for each group.

Abstract: Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer, where the traffic is generated by a customer network of the customer, such as a customer tenancy or an on-premise network. The traffic can be destined to the target service. The traffic can be tagged by the customer network (e.g., by a gateway of the customer network). The customer network can be associated with the egress policy. The customer can define the egress policy at different granularity levels by using different attributes. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy, based on the customer-defined attributes, on the traffic that the target service is receiving.