Abstract: Examples herein involve processing data in a distributed data processing system using an off-heap memory store. An example involves allocating a shared memory region of a shared memory to store attributes corresponding to a first partition of a distributed data system, and updating, in the shared memory region, the attributes corresponding to updates to the local data from process iterations of the first partition, such that a second partition of the distributed data system has access to the updated attributes.

Abstract: In some examples, a system receives anomaly scores regarding an entity from a plurality of detectors, produces a weighted anomaly score for the entity based on the anomaly scores and respective weights assigned to the plurality of detectors, the weights based on historical performance of the plurality of detectors, determines an impact based on a context of the entity, wherein the impact is indicative of an effect that the entity would have on a computing environment if the entity were to exhibit anomalous behavior, and computes a risk score for the entity based on the weighted anomaly score and the determined impact.

Abstract: Examples herein involve processing data in a distributed data processing system using an off-heap memory store. An example involves allocating a shared memory region of a shared memory to store attributes corresponding to a first partition of a distributed data system, and updating, in the shared memory region, the attributes corresponding to updates to the local data from process iterations of the first partition, such that a second partition of the distributed data system has access to the updated attributes.

Abstract: In some examples, a system extracts features from event data representing events in a computing environment, trains ensembles of machine-learning models for respective analytics modules of a plurality of different types of analytics modules, and detects, by the different types of analytics modules using the respective trained ensembles of machine-learning models, an anomalous entity in response to further event data.

Abstract: In some examples, a system extracts features from event data representing events in a computing environment, trains ensembles of machine-learning models for respective analytics modules of a plurality of different types of analytics modules, and detects, by the different types of analytics modules using the respective trained ensembles of machine-learning models, an anomalous entity in response to further event data.

Abstract: In some examples, a system receives anomaly scores regarding an entity from a plurality of detectors, produces a weighted anomaly score for the entity based on the anomaly scores and respective weights assigned to the plurality of detectors, the weights based on historical performance of the plurality of detectors, determines an impact based on a context of the entity, wherein the impact is indicative of an effect that the entity would have on a computing environment if the entity were to exhibit anomalous behavior, and computes a risk score for the entity based on the weighted anomaly score and the determined impact.

Abstract: In some examples, a system generates a graphical representation of entities associated with a computing environment, and derives features for the entities represented by the graphical representation, the features comprising neighborhood features and link-based features, a neighborhood feature for a first entity of the entities derived based on entities that are neighbors of the first entity in the graphical representation, and a link-based feature for the first entity derived based on relationships of other entities in the graphical representation with the first entity. The system determines, using a plurality of anomaly detectors based on respective features of the derived features, whether the first entity is exhibiting anomalous behavior.

Abstract: Topics for a document are identified using names of categories in a knowledge base. Terms are extracted from document text. The extracted terms are mapped to articles in the knowledge base. The number of terms that are mapped to each article are counted. The number of articles to which the terms are mapped are also counted for each category. The categories that include the articles having the mapped terms are sorted such that the most relevant categories for the document correspond to the categories that include the highest number of articles to which the terms are mapped. The most relevant categories are then identified as the topics for the document.

Abstract: A technique of extracting hierarchies for multilabel classification. The technique can process a plurality of labels related to a plurality of documents, using a clustering process, to cluster the labels into plurality of clusterings representing a plurality of classes. The technique classifies the documents and predicts a plurality of performance characteristics, respectively, for the plurality of clusterings. The technique selects at least one of the clusterings using information from the performance characteristics and adds the selected clustering into a resulting hierarchy.

Abstract: A technique of extracting hierarchies for multilabel classification. The technique can process a plurality of labels related to a plurality of documents, using a clustering process, to cluster the labels into plurality of clusterings representing a plurality of classes. The technique classifies the documents and predicts a plurality of performance characteristics, respectively, for the plurality of clusterings. The technique selects at least one of the clusterings using information from the performance characteristics and adds the selected clustering into a resulting hierarchy.

Abstract: A method and apparatus that can extract new terms from documents for inclusion in a vocabulary collection is disclosed. A document may be parsed to obtain an n-gram phrase indicative of a new term. The phrase may include a plurality of words. The n-gram phrase may be decomposed into a series of bi-gram phrases each including a first and a second phrase part. The first and second phrase parts each include at least one word. It may then be determined whether the first or second phrase part is in a vocabulary collection. If not, it may be estimated as to the probability that the bi-gram phrase should be in the vocabulary collection. The bi-gram phrase may be added to the vocabulary collection if the probability that the bi-gram phrase should be in the vocabulary collection exceeds a minimum threshold level.

Abstract: At least one term is extracted [202] from unstructured information. The at least one term is validated [204]. Then, a sense of the at least one extracted and validated term is determined [206]. The at least one extracted and validated term is clustered [208] into at least one group of terms according to the determined sense. A taxonomy is generated [210] based on the clustering and a mining of accessible taxonomies.