Abstract: A computer-implemented method for detecting malicious content is disclosed that includes operations of: receiving a character set as an input, converting the input into an integer array containing indexes of each character, and creating an input vector from the integer array, the input vector being a dense numerical representation of the character set. The input vector is passed to a machine learning model to generate a plurality of features based on the character set, the plurality of features comprising at least two of: a length of the character set, a Shannon Entropy of the character set, n-gram similarity score of the character set with English dictionary words, n-gram similarity score of the character set with a set of legitimate domains, and an online web traffic ranking service. A dense input vector is formed by concatenating the plurality of features to the input vector, and then processed to obtain a comparison score.

Abstract: The present disclosure is directed to automated generation and management of update estimates relative to application of an update to a computing device. One or more updates to be applied to a computing device are identified. A trained artificial intelligence (AI) model is applied that is adapted to generate an update estimate predicting an amount of time that is required to apply an update to the computing device. An update estimate is generated based on a contextual analysis that evaluates one or more of: parameters associated with the update; device characteristics of the computing device to be updated; a state of current user activity on the computing device; historical predictions relating to prior update estimates for one or more computing devices (e.g., that comprise the computing device); or a combination thereof. A notification of the update estimate is then automatically generated and caused to be rendered.

Abstract: Embodiments described herein are directed to facilitating performing online data decomposition to identify multiple seasonal components. In accordance with aspects of the present disclosure, a first iterative process is performed to determine a first seasonal component associated with an incoming data point based on a set of previous data points of a time series data set and corresponding data components. In addition, a second iterative process is performed to determine a second seasonal component associated with the incoming data point based on previous data points of the time series data set and corresponding data components. The first seasonal component and the second seasonal component can then be provided for analysis of the incoming data point (e.g., for presentation, for use in determining trend and residual components, etc.).

Abstract: Embodiments of the present disclosure are directed to facilitating performing online data forecasting. In operation, data decomposition of an incoming data point is performed to determine a trend component associated with the incoming data point. Such a trend component, and previous trend components, can be used to determine a trend component expected for a data point subsequent to the incoming data point. A seasonality component expected for the data point subsequent to the incoming data point can be identified, for example, based on a seasonality component associated with a previous corresponding data point. Thereafter, the expected trend and seasonality components can be used to predict the data point subsequent to the incoming data point. Such a data prediction can be performed in an online processing manner such that a subsequent data point is not used to decompose the incoming data point or forecast the data point.

Abstract: A computerized method is disclosed that includes operations of training a machine learning model using a labeled training set of data, wherein the machine learning model is configured to classify domain name server (DNS) records, obtaining DNS record data including at least a first DNS Txt record, applying the trained machine learning model to the first DNS Txt record to classify the first DNS Txt record and responsive to the classification of the first DNS Txt record, generating a flag for a system administrator. The trained machine learning model may classify the first DNS Txt record using logistic regression. In some instances, applying the trained machine learning model to the first DNS Txt record includes performing a tokenizing operation on the first DNS Txt record to generate a tokenized first DNS Txt record.

Abstract: A computerized method is disclosed including operations of receiving a data stream, performing a changepoint detection resulting in a detection of changepoints in the data stream including: maintaining a listing of starting indices for each run within the data stream in a buffer of size L wherein each index of the listing has a run length probability representing a likelihood of being a changepoint, receiving a new data point within the data stream and adding a new index to the buffer resulting in the buffer having size L+1, calculating a posterior run length probability that the new data point is a changepoint, and removing an index from the listing that has a lowest run length probability thereby returning the buffer to size L, and responsive to determining the index removed from the listing does not correspond to the new data point, identifying a changepoint associated with the new data point.

Abstract: The present disclosure is directed to automated generation and management of update estimates relative to application of an update to a computing device. One or more updated to be applied to a computing device are identified. A trained artificial intelligence (AI) model is applied that is adapted to generate an update estimate predicting an amount of time that is required to apply an update to the computing device. An update estimate is generated based on a contextual analysis that evaluates one or more of: parameters associated with the update; device characteristics of the computing device to be updated; a state of current user activity on the computing device; historical predictions relating to prior update estimates for one or more computing devices (e.g., that comprise the computing device); or a combination thereof. A notification of the update estimate is then automatically generated and caused to be rendered.

Abstract: The disclosure provides implementations for determining whether domain name server (DNS) beaconing is present within a communication session. Some implementations provide a method that includes multiple analyses directed to analyzing each of a time-to-live (TTL) run length distribution for a plurality of DNS records within the communication session and analyzing whether the communication is comprised of at least a threshold number of transmissions. As used in the analyses, the communication session may be comprised of transmissions between a first source device and a first DNS. When DNS beaconing is detected within the communication session, some implementations of the disclosure provide for generating an alert to an administrator or other user.

Abstract: The present disclosure is directed to automated generation and management of update estimates relative to application of an update to a computing device. One or more updates to be applied to a computing device are identified. A trained artificial intelligence (AI) model is applied that is adapted to generate an update estimate predicting an amount of time that is required to apply an update to the computing device. An update estimate is generated based on a contextual analysis that evaluates one or more of: parameters associated with the update; device characteristics of the computing device to be updated; a state of current user activity on the computing device; historical predictions relating to prior update estimates for one or more computing devices (e.g., that comprise the computing device); or a combination thereof. A notification of the update estimate is then automatically generated and caused to be rendered.

Abstract: Embodiments of the present invention are directed to facilitating performing online data decomposition. In accordance with aspects of the present disclosure, an incoming data point of a time series data set is obtained. Thereafter, an iterative process of estimating trend and seasonality is performed to decompose the incoming data point to a set of data components based on a particular set of previous data points of the time series data set and corresponding data components. Generally, the set of data components for the incoming data point include a trend component, a seasonality component, and a residual component. The set of data components is provided for analysis of the incoming data point, such as, for example, to identify data anomalies.

Abstract: Systems and methods are described for processing ingested pipeline metrics and ingested logs in an asynchronous manner as the data is being ingested to explain anomalies detected in the pipeline metrics using the ingested logs. For example, one or more streaming data processors can convert data as the data is ingested into a comparable data structure, determine whether the comparable data structure should be assigned to an existing data pattern or a new data pattern, and determine whether the logs corresponding to the comparable data structure is anomalous. Separately, the streaming data processor(s) can perform an outlier detection on the pipeline metrics to detect outliers. The streaming data processor(s) can then window the anomalous logs and the pipeline metric outliers to surface explanations for the pipeline metric outliers using the anomalous logs.

Abstract: The present disclosure is directed to automated generation and management of update estimates relative to application of an update to a computing device. One or more updated to be applied to a computing device are identified. A trained artificial intelligence (AI) model is applied that is adapted to generate an update estimate predicting an amount of time that is required to apply an update to the computing device. An update estimate is generated based on a contextual analysis that evaluates one or more of: parameters associated with the update; device characteristics of the computing device to be updated; a state of current user activity on the computing device; historical predictions relating to prior update estimates for one or more computing devices (e.g., that comprise the computing device); or a combination thereof. A notification of the update estimate is then automatically generated and caused to be rendered.

Abstract: Systems and methods for natural language processing (NLP) are described. The systems may be trained by identifying training data including clean data and noisy data; predicting annotation information using an artificial neural network (ANN); computing a loss value for the annotation information using a weighted loss function that applies a first weight to the clean data and at least one second weight to the noisy data; and updating the ANN based on the loss value. The noisy data may be obtained by identifying a set of unannotated sentences in a target domain, delexicalizing the set of unannotated sentences, finding similar sentences in a source domain, filling at least one arbitrary value in the similar delexicalized sentences, generating annotation information for the similar delexicalized sentences using an annotation model for the source domain, and applying a heuristic mapping to produce annotation information for the sentences in the target domain.

Abstract: A computerized method is disclosed that includes accessing domain name server (DNS) record data including a plurality of DNS records spanning a first time period, performing a time-to-live (TTL) analysis to determine a TTL run length distribution for the DNS record data, wherein the TTL analysis includes: generating a vector of the TTL values of each DNS record ordered sequentially in time, parsing the vector of the TTL values into segments, where a segment consists of one or more TTL values where a current TTL value is less than an immediately preceding TTL value, and determining the TTL run length distribution, determining whether DNS beaconing is present based on a result of the TTL analysis and in response to determining that DNS beaconing is present, generating an alert for a system administrator.

Abstract: In an aspect, a method includes determining, by a processor of a vehicle, that an original equipment manufacturer (OEM) subscription of the vehicle is set to a low capability subscription. The method includes determining, by the processor, that the low capability subscription is unable to access a network at a current location of the vehicle based on the low capability subscription. The method also includes determining, by the processor and based on sensor data received from one or more sensors of the vehicle, a probability of an accident occurring to the vehicle. The method further includes determining, by the processor, that the probability satisfies a threshold. The method includes switching, by the processor, the OEM subscription from the low capability subscription to a high capability subscription.

Abstract: Systems and methods for natural language processing (NLP) are described. The systems may be trained by identifying training data including clean data and noisy data; predicting annotation information using an artificial neural network (ANN); computing a loss value for the annotation information using a weighted loss function that applies a first weight to the clean data and at least one second weight to the noisy data; and updating the ANN based on the loss value. The noisy data may be obtained by identifying a set of unannotated sentences in a target domain, delexicalizing the set of unannotated sentences, finding similar sentences in a source domain, filling at least one arbitrary value in the similar delexicalized sentences, generating annotation information for the similar delexicalized sentences using an annotation model for the source domain, and applying a heuristic mapping to produce annotation information for the sentences in the target domain.

Abstract: Systems and methods are described for processing ingested pipeline metrics and ingested logs in an asynchronous manner as the data is being ingested to explain anomalies detected in the pipeline metrics using the ingested logs. For example, one or more streaming data processors can convert data as the data is ingested into a comparable data structure, determine whether the comparable data structure should be assigned to an existing data pattern or a new data pattern, and determine whether the logs corresponding to the comparable data structure is anomalous. Separately, the streaming data processor(s) can perform an outlier detection on the pipeline metrics to detect outliers. The streaming data processor(s) can then window the anomalous logs and the pipeline metric outliers to surface explanations for the pipeline metric outliers using the anomalous logs.

Abstract: An embodiment of the present invention is directed to low-maintenance conversion of an advance function presentation (AFP) format to a portable document format. According to an embodiment of the present invention, hidden text may be inserted as locators in the AFP files. For example, the hidden text may be inserted in a small font size (e.g., approximately 1 point) in a color that matches the background, e.g., text in white. A benefit of this hidden text is that it does not need to change with the maintenance of the statement template. Accordingly, the transformation software template may be built, or trained, to look for these hidden text locators to identify the beginning and end of sections. This leads to a robust transformation software template that does not need to be maintained or changed with text changes in the statements.

Abstract: An embodiment of the present invention is directed to low-maintenance conversion of an advance function presentation (AFP) format to a portable document format. According to an embodiment of the present invention, hidden text may be inserted as locators in the AFP files. For example, the hidden text may be inserted in a small font size (e.g., approximately 1 point) in a color that matches the background, e.g., text in white. A benefit of this hidden text is that it does not need to change with the maintenance of the statement template. Accordingly, the transformation software template may be built, or trained, to look for these hidden text locators to identify the beginning and end of sections. This leads to a robust transformation software template that does not need to be maintained or changed with text changes in the statements.

Abstract: Anonymous containers are discussed herein. An operating system running on a computing device, also referred to herein as a host operating system running on a host device, prevents an application from accessing personal information (e.g., user information or corporate information) by activating an anonymous container that is isolated from the host operating system. In order to create and activate the anonymous container, a container manager anonymizes the configuration and settings data of the host operating system, and injects the anonymous configuration and settings data into the anonymous container. Such anonymous configuration and settings data may include, by way of example and not limitation, application data, machine configuration data, and user settings data. The host operating system then allows the application to run in the anonymous container.