Abstract: Systems and methods for detecting cost anomalies in a data protection system. Data is collected for assets of a data protection system operating in a cloud. The data often relates to cost and may constitute time series. The time series are then analyzed by performing a fitting competition using multiple models. The best fitting model is selected and the residuals are analyzes to find outliers and produce a normal zone for the signal. The outliers can identify cost anomalies that may reflect the health of the data protection system.

Abstract: Techniques are provided for facial recognition using a high probability group database and a facial network of related persons.

Abstract: Techniques are provided for facial recognition using a high probability group database. One method comprises maintaining (i) a first database of facial images of individuals, and (ii) a second database of facial images comprising a subset of the individuals from the first database based on a probability of individuals appearing in sequences of image frames at a given time; applying a face detection algorithm to sequences of image frames to identify one or more faces in the sequences of images; and applying a facial recognition to at least one sequence of image frames using at least the second database to identify one or more individuals in the at least one sequence of image frames. The second database is comprised of facial images of: (i) individuals from multiple angles; (ii) individuals that appeared in prior image frames; and/or (iii) individuals that appeared in an image frame generated by a plurality of cameras.

Abstract: A method and system for processing user feedback on client devices. Specifically, the method and system disclosed herein entail aggregating and sampling a feature set pertinent to the classification and/or prediction of user dissatisfaction with their respective client devices. Following the derivation of user discontent scores based on anomaly detection and machine learning methodologies, one or more actions may be performed to address and/or alleviate the observed user discontent.

Abstract: A method and system for performance-driven load shifting. Specifically, the method and system disclosed herein entail transferring user program workloads, for processing, between local computing resources available on a client device and cloud computing resources available on an offload domain based on the assessed performance score of the client device at any given point in time. Seamless load shifting is further guaranteed due substantively to the employment of a mobile network facilitating communications between the client device and the offload domain.

Abstract: Techniques are provided for recommending changes to a hardware configuration based on a user satisfaction rating. One method comprises obtaining usage data indicating user activity for each user on a computing device; generating a user profile for each user; clustering the users into user clusters based on the user profiles; determining, for a given user cluster, a satisfaction score for each user in the given user cluster based on the obtained usage data for each user on the computing device; providing suggested hardware upgrades for the computing device of a given user in the given user cluster, wherein the given user is selected based on a lower corresponding satisfaction score relative to the satisfaction scores of other users in the given cluster, and wherein the one or more suggested hardware upgrades are based on hardware configurations of one or more of the other users in the given cluster having a higher corresponding satisfaction score.

Abstract: Predicting large data flushes by collecting usage data for system assets, analyzing the data using machine learning on each asset and the whole system to determine usage trends, predicting a next large data flush using a time-series model, and determining if a size of the predicted next flush size is too large relative to journal storage space in order to advance fast forward mode. Further, protecting history information by pausing distribution of data from journal volumes to replica volumes, taking storage-level snapshots of the replica and the journal volumes, storing a snapshot timestamp for each of the storage-level snapshots in a a snapshot database prior to advancing the fast forward mode or un-pausing distribution.

Abstract: Business Data Lake searching techniques are provided.

Abstract: Embodiments for predicting large data flushes in a data replication system collecting usage data for assets in the system; analyzing the data using machine learning processes on the basis of each asset and the system as a whole to determine usage trends with respect to the data flush operations; predicting a next large data flush using a time-series model; obtaining a capacity of a journal storage space used for write operations to a storage device in the system; and determining if a size of the predicted next flush size is too large relative to this capacity, and if so, invoking a fast forward mode to not retain I/O history information for undo operations during a replication in order to save resources in the system.

Abstract: Techniques are provided for customer support ticket aggregation. One method comprises obtaining a customer support ticket; extracting a topic of the customer support ticket using a topic model based on natural language processing techniques; converting the customer support ticket to a topic vector representation that identifies the extracted topic and comprises a list of words describing the topic based on a collection of processed customer support tickets; extracting features from the customer support ticket; generating a fingerprint for the customer support ticket that comprises the topic vector representation and the extracted features; applying the fingerprint to a machine learning similarity model that compares the fingerprint to fingerprints of processed customer support tickets from the collection of processed customer support tickets; and identifying a processed customer support ticket from the collection of processed customer support tickets that is related to the customer support ticket.

Abstract: Techniques are provided for extracting anomaly related rules from organizational data. One method comprises obtaining anomaly analysis data integrated from multiple data sources of an organization, wherein the multiple data sources comprise at least one set of labeled anomaly data related to anomalous transactions; extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly; training multiple machine learning models using the extracted features, where the machine learning models are trained using different combinations of the extracted features; evaluating a performance of the trained machine learning models; and extracting rules from the trained machine learning models based on the performance, wherein the extracted rules are used to classify transactions as anomalous. The trained machine learning models comprise a decision tree comprising paths to an anomaly classification. The extracted rules are optionally in a human-readable format.

Abstract: A system recommends the refactoring of microservices. The system generates a graph of connected nodes including a first node, which represents a first atomic part of code in a microservice in an application, and a second node, which represents a second atomic part of code in the microservice. The system determines a nodes connection score based on any connections between the first node and the second node. If the nodes connection score satisfies a nodes connection threshold, the system determines a relative code size based on comparing a size associated with the first atomic part of code against a size of the microservice. If the relative code size satisfies a code size threshold, the system outputs a recommendation to disconnect the first atomic part of code from the microservice, create another microservice in the application, and connect the first atomic part of code to the other microservice.

Abstract: Data compression optimization based on client clusters is described. A system identifies a cluster of similar client devices in a group of client devices, by comparing data compression factors that correspond to each client device in the group of client devices. The system identifies a relationship between data compression factors corresponding to the cluster and data compression ratios corresponding to the cluster. The system identifies a client device, in the cluster, which corresponds to a data compression ratio that is inefficient relative to other compression ratios corresponding to other client devices in the cluster. The system outputs a data compression recommendation for the client device, based on data compression factors corresponding to the client device and the identified relationship between the data compression factors corresponding to the cluster and the data compression ratios corresponding to the cluster.

Abstract: Techniques are provided for compression of log data using field types. An exemplary method comprises: obtaining at least one log message, wherein the at least one log message comprises a message template and at least one message variable, wherein the message template comprises at least one field corresponding to the at least one message variable; obtaining a compression index that maps a plurality of message templates to a corresponding message signature; identifying a predefined field type of the at least one field; selecting a compression technique to apply to the at least one message variable based on the predefined field type to obtain a compressed message variable; and writing the compressed message variable and a message signature corresponding to the message template of the at least one log message to a log file. The at least one log message can be a historical log message or part of a real-time stream of log messages.

Abstract: Techniques are provided for identifying anomalies in an Internet of Things (IoT) activity profile of a user using an analytic engine. An exemplary method comprises obtaining data from a plurality of IoT devices of a user, wherein at least one IoT device comprises an agent device that performs an action on behalf of the user; applying the obtained data to a feature engineering module to convert the obtained data into time-series features that capture behavior and/or characteristics of an IoT environment of the user, and applying the time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in the IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned patterns.

Abstract: Techniques are provided for compression and decompression of log data using pattern recognition. An exemplary method comprises: obtaining at least one log message, wherein the at least one log message comprises a pattern-based message template and one or more message variables, wherein the pattern-based message template was learned from historical log data using a log pattern mining technique; obtaining a compression index that maps a plurality of pattern-based message templates to a corresponding message signature; and writing the one or more message variables and a message signature corresponding to the pattern-based message template of the at least one log message to a log file. The log pattern mining technique learns a given pattern-based message template from the historical log data to represent a plurality of historical log messages. The at least one log message may comprise a historical log message or may be from a real-time stream of log messages.

Abstract: A customer blockchain data store is provided. An exemplary method comprises obtaining a blockchain associated with a given customer of an enterprise having multiple customer communication channels, wherein the blockchain comprises transaction data for the given customer with the customer communication channels; obtaining new transaction data for the given customer for a given one of the customer communication channels; providing the new transaction data for the given customer to additional customer communication channels; receiving a validation of the new transaction data from the additional customer communication channels based on one or more predefined validation criteria; and storing the validated new transaction data for the given customer in the blockchain associated with the given customer.

Abstract: Embodiments for finding a root cause of an anomaly in a network environment by representing assets in the network environment as respective nodes in a causal graph, wherein the nodes have a measurable quality that can be tracked and arcs between pairs of nodes represent causal relationships between nodes of the node pairs designating source nodes as processes at the top of a hierarchy of tracked processes, and sink nodes as processes at the bottom of the hierarchy and having characteristics of interest in the environment; detecting anomalies in the tracked processes embodied in the sink nodes; traversing the causal graph in a reverse order from a node in which an outlier is detected; and analyzing nodes along the traversal path to identify a node of the highest hierarchy that shows unusual behavior as the root cause.

Abstract: An automated agent for the causal mapping of complex environments. Specifically, a disclosed method and system entails the application of statistical tools, or causality tests, to measure the strength and direction of causal relations between two or more environment components. Further, the execution of the causality tests may be an offline process that may be triggered periodically to account for changes or updates to an environment over time.

Abstract: Techniques are provided for data-driven scheduling of automated software program test suites. An exemplary method comprises: obtaining a plurality of test cases that test software programs; obtaining a failure likelihood for each of the plurality of test cases; and scheduling the test cases in an order based on the failure likelihoods. Generally, test cases that are more likely to fail are scheduled before test cases that are less likely to fail. Dependencies and/or priorities among the plurality of test cases are also optionally obtained and the scheduling of the test cases is based on the dependencies and/or priorities. The dependencies among the plurality of test cases comprise, for example, an indication of whether a given test case constrains one or more additional test cases.