Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for creating and using virtual email addresses for user privacy protection and data security are described. In one aspect, a method includes receiving, from a user device and at an identity server, login credentials for a first email address mapped to a first set of user information values, detecting, by the identity server, a trigger event, in response to detecting the trigger event, creating, by the identity server, a new virtual email address separate from the first email address and mapped to a second set of user information values different from the first set of user information values, detecting, by the identity server, a request for credentials from a requesting entity, and in response to detecting the request, transmitting, by the identity server, the new virtual email address as new login credentials to the requesting entity.

Abstract: Systems and methods monitor performance of a computing platform, including identifying infrastructure components associated with computing platforms of an organization, identifying component dependency between different infrastructure components across all system resources an enterprise network, and correlating the performance of an infrastructure component with business related KPIs for the platform. The platform management system generates a metadata representative of each the computing platform so that a graphical user interface (GUI) can provide real-time or near real-time data analytics to client devices, within a private enterprise cloud network. The performance platform management system may automatically take actions in response to identified infrastructure issues based on predetermined resolution procedures, individual configurations (based on permissions), or client interaction through the GUI.

Abstract: A processor may identify that content is generated for a communication between IoT devices. The processor may identify a source device and a target device of the IoT devices. The processor may analyze the content. The processor may determine a sensitivity of the content. The processor may assign, based on the determining, a security level to either of the source device or the target device.

Abstract: Filesystem driver software can receive a file access request indicating that an application process is requesting to access a target file in a filesystem, Network filter driver software can receive a connection establishment request indicating that the application process running on the processing apparatus is requesting to establish a connection over a network with a target endpoint. According to the present disclosure, one or both of: a) the filesystem driver software is configured to grant or deny the file access request in dependence on state information from the network filter driver software, and/or b) the network filter driver software is configured to grant or deny the connection establishment request in dependence on state information from the filesystem driver software.

Abstract: In a Byzantine computing environment in which a database is sharded or partitioned among multiple clusters of computing nodes, consensus for and execution of data transactions (e.g., transactions that require and/or affect data of one or more shards) are achieved in a resilient manner Within some clusters, multiple primary replicas concurrently propose transactions for processing in parallel by all replicas. For some multi-shard transactions, shards involved in the transactions may be logically ring-ordered; each shard in turn achieves consensus among its nodes to commit the transactions, and then executes its portion of the operation after consensus is obtained among all shards. For some other multi-shard transactions, involved shards first determine whether local data constraints are satisfied, after which data modifications are made in parallel.

Abstract: A device may calculate, based on network data associated with a network, key performance indicators (KPIs) for the network. The device may aggregate a first set of KPIs to generate a first aggregated KPI associated with a first functionality of the device and a second set of KPIs to generate a second aggregated KPI associated with a second functionality of the device. The device may receive a selection of a particular KPI from the first aggregated KPI, the first set of KPIs, the second aggregated KPI, or the second set of KPIs. The device may parse text data corresponding to a set of rules, utilized to calculate the particular KPI, to generate a parsed set of rules, and may identify particular metrics utilized to calculate the particular KPI. The device may provide one or more timeline views of the particular metrics correlated with the particular KPI.

Abstract: Systems and methods for performing anomalous activity monitoring for a service provider network are disclosed. In response to receiving an activity log, a machine learning-based activity monitor may parse the activity log into segments, generate event objects from a segment of the activity log, encode the event objects, and then reconstruct the event objects based on decoding the encoded event objects. The encoding and decoding may be performed based on a model that was trained using training data with no known malicious activity. The event objects may comprise at least two or more event defining characteristics and an event count. By comparing the reconstructed event objects to corresponding initial versions of the event objects, the machine learning-activity monitor may determine an anomaly score and may provide an indication of events determined to be anomalous based on the score.

Abstract: Described are techniques for shared library customization. The techniques include generating a customized library for a container image associated with an application and a shared library. The customized library includes a subset of the shared library with functionalities utilized by the application retained in the customized library and functionalities not utilized by the application removed from the customized library. The techniques further include executing the application on a deployed container image, where the application utilizes the customized library.

Abstract: Methods and systems are disclosed for a digital signature system using scalable servers. The system includes scalable frontend servers to communicate with applications servers and scalable backend servers to communicate with remote security devices. When a user, and their remote security device(s), is registered with the system, the remote security device(s) is/are assigned to a backend server. A total public key is generated by cryptographically embedding the unique identifier of the assigned backend server into a combined public key associated with the remote security device(s). When a signature request including the total public key is received at the frontend server, the unique identifier is extracted and the signature request is forwarded to the backend server that corresponds with the unique identifier.

Abstract: There is provided mechanisms for cyberattack identification in a network environment. A method is performed by a security analytics module. The method comprises obtaining logged events. The events having occurred and are logged in the network environment. Each logged event is associated with a cyber security deviation score and cyber security deviation statistics. The method comprises matching each logged event to a cyber-attack lifecycle phase by comparing characteristics of each logged event, as given by the cyber security deviation statistics, to known cyberattack lifecycle phases. The method comprises linking together the logged events by forming at least one chain of the logged events. Each chain corresponds to one type of cyberattack as given by combinations of the known cyberattack lifecycle phases. The cyber security deviation scores and cyber security deviation statistics are updated based on how the logged events are linked together.

Abstract: A noisy neighbor in a cloud multitenant system can present resource governance issues. Usage quotas can be applied, and traffic can be throttled to mitigate the problem. Network traffic can be monitored from routers of a software defined data center (SDDC) configured to process network traffic for machines of different tenants. By default, the network traffic from the routers can be processed via a first edge router for the SDDC. A second edge router can be deployed for the SDDC in response to the network traffic from a particular router exceeding a threshold. Network traffic from the particular router can be processed via the second edge router while the remaining traffic can continue to be processed via the first edge router.

Abstract: Filesystem driver software can receive a file access request indicating that an application process is requesting to access a target file in a filesystem, Network filter driver software can receive a connection establishment request indicating that the application process running on the processing apparatus is requesting to establish a connection over a network with a target endpoint. According to the present disclosure, one or both of: a) the filesystem driver software is configured to grant or deny the file access request in dependence on state information from the network filter driver software, and/or b) the network filter driver software is configured to grant or deny the connection establishment request in dependence on state information from the filesystem driver software.

Abstract: A first power storage pack wiredly transmits identification information retained in the first power storage pack to a charging device when the first power storage pack is detached from an electric movable body. The charging device wiredly transmits the identification information received from the first power storage pack to a second power storage pack. The controller of the second power storage pack transmits via near-field communication a signal including the identification information received from the charging device. The electric movable body collates whether or not the identification information included in the received signal matches the identification information retained in the first power storage pack.

Abstract: Aspects of the disclosure relate to enhanced tracking of data over an asset lifecycle. A computing platform may receive, via the communication interface, user account information as part of an onboarding process in which a first user account is created. The computing platform may then compute, using a cryptographic hash function, a first hash value associated with the first user account, wherein the first hash value provides a trackable, immutable code corresponding to the first user account. Thereafter, the computing platform may monitor one or more events in a transaction activity pool. Upon detecting a new activity associated with the first user account in the transaction activity pool, the computing platform may append the new activity to a record in a trackable log linked to the first hash value.

Abstract: The disclosure herein describes platform-level migration for deep learning training (DLT) jobs from a checkpointed stated between a source node and a destination node. The checkpointing is performed through capturing GPU state (e.g., device state) and CPU state (e.g., host state). The GPU state includes GPU data (e.g., model parameters, optimizer state, etc.) that is located in the GPU and GPU context (e.g., the default stream in GPU, various handles created by libraries). Restoring the DLT job on the destination node involves resumption of processing of a destination GPU at the same checkpointed state.

Abstract: A behavioral sensor for creating consumable events can include: a feature extractor coupled to receive an event stream of events performed by a circuit, wherein the feature extractor identifies features of a particular event of the event stream and associates the particular event with a time; and a classifier coupled to receive the features of the particular event from the feature extractor, wherein the classifier classifies the particular event into a classified event associated with the time using predefined categories based on the received features of the particular event; whereby the classified event and subsequent classified events extracted from the event stream within a time frame are appended in a time series forming the consumable events.

Abstract: A method for telemetry analysis of a digital twin includes analyzing network traffic sent or received by a host network. Entities exchanging data with the host network are identified. A plurality of applications within the host network used for sending or receiving the exchanged data may be identified. A digital twin of the host network is developed based upon the identified entities exchanging data with the host network and the applications within the host network used for sending or receiving the exchanged data. Stimuli may be applied to the digital twin, and the likelihood of a change in state within the host network is assessed based upon the applied stimuli.

Abstract: Techniques for Qprints using telemetry-based similarity for DNS are provided. In some embodiments, a system/process/computer program product for Qprints using telemetry-based similarity for DNS in accordance with some embodiments includes aggregating a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data; clustering the DNS related query data; and generating similarity clusters for domains based on their DNS related query data. For example, the set of network related event data can include passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.

Abstract: The communication control apparatus (10) performs a receiving process, a counting process, and a determination process. The receiving process is a process for receiving a request packet to query a predetermined server. The counting process is a process for counting, based on a source address of the request packet, in multiple stages corresponding to different ranges of address areas that include the source address. The determination process is a process for determining an address area corresponding to a stage, from the multiple stage, in which a count value by the counting process exceeds a predetermined threshold value as an unauthorized access address area.

Abstract: A method is implemented by a controller executed on at least one processor. The method provides pre-authorized access to a robotic process automation for a resource associated with a job. The method includes causing, by the controller, the robotic process automation to assume a user identity during an authentication flow to enable access by the robotic process automation to a resource. The method includes issuing, by the controller, tokens to the robotic process automation during the authentication flow. The method includes enabling, by the controller via the tokens, the identity service that governs the resource to participate in operations of the controller to provide the pre-authorized access to the robotic process automation.