Abstract: Disclosed in some examples are systems, methods, and machine readable mediums for identifying insider threats by determining file system element activity models that correlate to undesirable behavior and then utilizing the determined model to detect insider threats. Events involving file system elements of a client computing device (e.g., a network endpoint) may be monitored by a file system element monitoring application on the client computing device. The values of these signals are aggregated across all events of the same type that have occurred within a predetermined time window (e.g., an hour) for a particular client computing device. Each time an aggregated signal has a value over the threshold, an anomaly is recorded. Anomaly counts for each signal are then calculated as the aggregate number of anomalies for a particular signal over a second time period, the span of which is determined by the generation of first anomaly to the close of an alert by the network monitor.

Abstract: A method of detecting the onset of a ransomware attack is presented. In an example embodiment, file backup metadata for each of a plurality of computing devices is accessed and analyzed to detect anomalous file backup activity of individual ones of the computing devices. A determination is made as to whether the detected anomalous file backup activity of at least some of the computing devices is correlated in time. File description metadata for each of the computing devices is also accessed and analyzed to identify files in the computing devices that are anomalous to other files in the computing devices. A determination whether a ransomware attack has begun is based on a determination that the detected anomalous file backup activity of at least some of the computing devices is correlated in time, as well as on the identified anomalous files.

Abstract: A method of detecting the onset of a ransomware attack is presented. In an example embodiment, file backup metadata for each of a plurality of computing devices is accessed and analyzed to detect anomalous file backup activity of individual ones of the computing devices. A determination is made as to whether the detected anomalous file backup activity of at least some of the computing devices is correlated in time. File description metadata for each of the computing devices is also accessed and analyzed to identify files in the computing devices that are anomalous to other files in the computing devices. A determination whether a ransomware attack has begun is based on a determination that the detected anomalous file backup activity of at least some of the computing devices is correlated in time, as well as on the identified anomalous files.

Abstract: A method of detecting the onset of a ransomware attack is presented. In an example embodiment, file backup metadata for each of a plurality of computing devices is accessed and analyzed to detect anomalous file backup activity of individual ones of the computing devices. A determination is made as to whether the detected anomalous file backup activity of at least some of the computing devices is correlated in time. File description metadata for each of the computing devices is also accessed and analyzed to identify files in the computing devices that are anomalous to other files in the computing devices. A determination whether a ransomware attack has begun is based on a determination that the detected anomalous file backup activity of at least some of the computing devices is correlated in time, as well as on the identified anomalous files.

Abstract: Disclosed in some examples are systems, methods, and machine readable mediums for identifying insider threats by determining file system element activity models that correlate to undesirable behavior and then utilizing the determined model to detect insider threats. Events involving file system elements of a client computing device (e.g., a network endpoint) may be monitored by a file system element monitoring application on the client computing device. The values of these signals are aggregated across all events of the same type that have occurred within a predetermined time window (e.g., an hour) for a particular client computing device. Each time an aggregated signal has a value over the threshold, an anomaly is recorded. Anomaly counts for each signal are then calculated as the aggregate number of anomalies for a particular signal over a second time period, the span of which is determined by the generation of first anomaly to the close of an alert by the network monitor.

Abstract: Disclosed in some examples are systems, methods, and machine readable mediums for identifying insider threats by determining file system element activity models that correlate to undesirable behavior and then utilizing the determined model to detect insider threats. Events involving file system elements of a client computing device (e.g., a network endpoint) may be monitored by a file system element monitoring application on the client computing device. The values of these signals are aggregated across all events of the same type that have occurred within a predetermined time window (e.g., an hour) for a particular client computing device. Each time an aggregated signal has a value over the threshold, an anomaly is recorded. Anomaly counts for each signal are then calculated as the aggregate number of anomalies for a particular signal over a second time period, the span of which is determined by the generation of first anomaly to the close of an alert by the network monitor.

Abstract: A method of detecting the onset of a ransomware attack is presented. In an example embodiment, file backup metadata for each of a plurality of computing devices is accessed and analyzed to detect anomalous file backup activity of individual ones of the computing devices. A determination is made as to whether the detected anomalous file backup activity of at least some of the computing devices is correlated in time. File description metadata for each of the computing devices is also accessed and analyzed to identify files in the computing devices that are anomalous to other files in the computing devices. A determination whether a ransomware attack has begun is based on a determination that the detected anomalous file backup activity of at least some of the computing devices is correlated in time, as well as on the identified anomalous files.

Abstract: Systems and methods are provided for determining the efficacy of digital assets provided to an audience. One embodiment is a system that includes a brand management server. The brand management server includes a memory that stores assets comprising digital media. The brand management server also includes a controller. The controller distributes the assets for consumption by members of an audience at remote devices. The controller also selects one of the assets, determines a look-back period, acquires metrics indicating at least two different types of consumption of the asset by the audience during the look-back period, and calculates an asset score for the asset that indicates a popularity of the asset and is based on the metrics indicating the at least two different types of consumption.

Abstract: Systems and methods are provided for determining the efficacy of digital assets provided to an audience. One embodiment is a system that includes a brand management server. The brand management server includes a memory that stores assets comprising digital media. The brand management server also includes a controller. The controller distributes the assets for consumption by members of an audience at remote devices. The controller also selects one of the assets, determines a look-back period, acquires metrics indicating at least two different types of consumption of the asset by the audience during the look-back period, and calculates an asset score for the asset that indicates a popularity of the asset and is based on the metrics indicating the at least two different types of consumption.

Abstract: Systems and methods are provided for determining the efficacy of digital assets provided to an audience. One embodiment is a system that includes a brand management server. The brand management server includes a memory that stores assets comprising digital media. The brand management server also includes a controller. The controller distributes the assets for consumption by members of an audience at remote devices. The controller also selects one of the assets, determines a look-back period, acquires metrics indicating at least two different types of consumption of the asset by the audience during the look-back period, and calculates an asset score for the asset that indicates a popularity of the asset and is based on the metrics indicating the at least two different types of consumption.

Abstract: Systems and methods are provided for distributing content. One embodiment includes a content management server. The content management server includes a memory that stores a library of assets comprising digital media, and that further stores scores that indicate popularity of the assets in the library. The content management server also includes an interface that receives a Hyper Text Transfer Protocol (HTTP) request that is sourced by a device remote from the content management server, and a controller that identifies a Uniform Resource Locator (URL) within the HTTP request, selects a group of assets for the URL from the library, identifies an asset that has a highest score within the group, and provides the asset in response to the HTTP request. The controller alters scores for assets in the library over time as assets in the library are provided, and selects different groups of assets for the URL over time.

Abstract: Systems and methods are provided for distributing content. One embodiment includes a content management server. The content management server includes a memory that stores a library of assets comprising digital media, and that further stores scores that indicate popularity of the assets in the library. The content management server also includes an interface that receives a Hyper Text Transfer Protocol (HTTP) request that is sourced by a device remote from the content management server, and a controller that identifies a Uniform Resource Locator (URL) within the HTTP request, selects a group of assets for the URL from the library, identifies an asset that has a highest score within the group, and provides the asset in response to the HTTP request. The controller alters scores for assets in the library over time as assets in the library are provided, and selects different groups of assets for the URL over time.

Abstract: Systems and methods are provided for distributing content. One embodiment includes a content management server. The content management server includes a memory that stores a library of assets comprising digital media, and that further stores scores that indicate popularity of the assets in the library. The content management server also includes an interface that receives a Hyper Text Transfer Protocol (HTTP) request that is sourced by a device remote from the content management server, and a controller that identifies a Uniform Resource Locator (URL) within the HTTP request, selects a group of assets for the URL from the library, identifies an asset that has a highest score within the group, and provides the asset in response to the HTTP request. The controller alters scores for assets in the library over time as assets in the library are provided, and selects different groups of assets for the URL over time.

Abstract: Systems and methods are provided for distributing content. One embodiment includes a content management server. The content management server includes a memory that stores a library of assets comprising digital media, and that further stores scores that indicate popularity of the assets in the library. The content management server also includes an interface that receives a Hyper Text Transfer Protocol (HTTP) request that is sourced by a device remote from the content management server, and a controller that identifies a Uniform Resource Locator (URL) within the HTTP request, selects a group of assets for the URL from the library, identifies an asset that has a highest score within the group, and provides the asset in response to the HTTP request. The controller alters scores for assets in the library over time as assets in the library are provided, and selects different groups of assets for the URL over time.

Abstract: Systems and methods are provided for determining the efficacy of digital assets provided to an audience. One embodiment is a system that includes a brand management server. The brand management server includes a memory that stores assets comprising digital media. The brand management server also includes a controller. The controller distributes the assets for consumption by members of an audience at remote devices. The controller also selects one of the assets, determines a look-back period, acquires metrics indicating at least two different types of consumption of the asset by the audience during the look-back period, and calculates an asset score for the asset that indicates a popularity of the asset and is based on the metrics indicating the at least two different types of consumption.

Abstract: Methods, systems, and devices are described for providing proactive cloud orchestration services for a cloud hardware infrastructure. A health management system may monitor component(s) of the cloud hardware infrastructure. The health management system may determine a failure probability metric for the component(s) based on the monitoring of the component and in consideration of historical information associated with the component, or similar components. The health management system may determine an optimization strategy for the component and, when an optimization decision has been reached, initiate a reconfiguration procedure to implement the optimization strategy. The optimization strategy may provide for mitigating or eliminating the consequences of the component failure associated with data loss, downtime, and the like.

Abstract: Systems and methods are provided for distributing content. One embodiment includes a content management server. The content management server includes a memory that stores a library of assets comprising digital media, and that further stores scores that indicate popularity of the assets in the library. The content management server also includes an interface that receives a Hyper Text Transfer Protocol (HTTP) request that is sourced by a device remote from the content management server, and a controller that identifies a Uniform Resource Locator (URL) within the HTTP request, selects a group of assets for the URL from the library, identifies an asset that has a highest score within the group, and provides the asset in response to the HTTP request. The controller alters scores for assets in the library over time as assets in the library are provided, and selects different groups of assets for the URL over time.

Abstract: Systems and methods are provided for distributing content. One embodiment includes a content management server. The content management server includes a memory that stores a library of assets comprising digital media, and that further stores scores that indicate popularity of the assets in the library. The content management server also includes an interface that receives a Hyper Text Transfer Protocol (HTTP) request that is sourced by a device remote from the content management server, and a controller that identifies a Uniform Resource Locator (URL) within the HTTP request, selects a group of assets for the URL from the library, identifies an asset that has a highest score within the group, and provides the asset in response to the HTTP request. The controller alters scores for assets in the library over time as assets in the library are provided, and selects different groups of assets for the URL over time.

Abstract: Disclosed in some examples are systems, methods, and machine readable mediums for identifying insider threats by determining file system element activity models that correlate to undesirable behavior and then utilizing the determined model to detect insider threats. Events involving file system elements of a client computing device (e.g., a network endpoint) may be monitored by a file system element monitoring application on the client computing device. The values of these signals are aggregated across all events of the same type that have occurred within a predetermined time window (e.g., an hour) for a particular client computing device. Each time an aggregated signal has a value over the threshold, an anomaly is recorded. Anomaly counts for each signal are then calculated as the aggregate number of anomalies for a particular signal over a second time period, the span of which is determined by the generation of first anomaly to the close of an alert by the network monitor.

Abstract: A method of detecting the onset of a ransomware attack is presented. In an example embodiment, file backup metadata for each of a plurality of computing devices is accessed and analyzed to detect anomalous file backup activity of individual ones of the computing devices. A determination is made as to whether the detected anomalous file backup activity of at least some of the computing devices is correlated in time. File description metadata for each of the computing devices is also accessed and analyzed to identify files in the computing devices that are anomalous to other files in the computing devices. A determination whether a ransomware attack has begun is based on a determination that the detected anomalous file backup activity of at least some of the computing devices is correlated in time, as well as on the identified anomalous files.