Abstract: Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for detecting abnormal behavior of device in an enterprise network based on an analysis of behavioral information of the device's neighbors in network. At a high level, embodiments of the present disclosure employ a hive-mind approach to determine anomalous behavior of a device in a network based on analyzing behavior information reported by neighboring devices within the network. Embodiments identify that a device is alive and connected within the network based on multiple neighboring devices reporting behavioral information about the device; however, the device may be dysfunctional and failing to report its own information. By aggregating and analyzing behavioral information of a device based on the reporting information of its neighboring devices, embodiments of the present disclosure are able to determine whether a device is healthy even when the device is unable to report its own information.

Abstract: Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for detecting abnormal behavior of device in an enterprise network based on an analysis of behavioral information of the device's neighbors in network. At a high level, embodiments of the present disclosure employ a hive-mind approach to determine anomalous behavior of a device in a network based on analyzing behavior information reported by neighboring devices within the network. Embodiments identify that a device is alive and connected within the network based on multiple neighboring devices reporting behavioral information about the device; however, the device may be dysfunctional and failing to report its own information. By aggregating and analyzing behavioral information of a device based on the reporting information of its neighboring devices, embodiments of the present disclosure are able to determine whether a device is healthy even when the device is unable to report its own information.

Abstract: Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for detecting abnormal behavior of device in an enterprise network based on an analysis of behavioral information of the device's neighbors in network. At a high level, embodiments of the present disclosure employ a hive-mind approach to determine anomalous behavior of a device in a network based on analyzing behavior information reported by neighboring devices within the network. Embodiments identify that a device is alive and connected within the network based on multiple neighboring devices reporting behavioral information about the device; however, the device may be dysfunctional and failing to report its own information. By aggregating and analyzing behavioral information of a device based on the reporting information of its neighboring devices, embodiments of the present disclosure are able to determine whether a device is healthy even when the device is unable to report its own information.

Abstract: Disclosed herein is a system and method for automatically identifying potential malware files or benign files in files that are not known to be malware. Vector distances for select features of the files are compared to vectors both known malware files and benign files. Based on the distance measures a malware score is obtained for the unknown file. If the malware score exceeds a threshold a researcher may be notified of the potential malware, or the file may be automatically classified as malware if the score is significantly high.

Abstract: Disclosed herein is a system and method for a system and method for determining whether the protection level of a protection system is appropriate for the way the user of a computing system is using the device. The protection system monitors the user's activity while they are using the various applications on the device. The protection system identifies an activity record that is the most similar to the user's activity and compares the current protection level with the associated record's protection level. The protection system may change the protection level when the user's protection level and the associated record's protection level are different.

Abstract: Disclosed herein is a system and method for automatically identifying potential malware files or benign files in files that are not known to be malware. Vector distances for select features of the files are compared to vectors both known malware files and benign files. Based on the distance measures a malware score is obtained for the unknown file. If the malware score exceeds a threshold a researcher may be notified of the potential malware, or the file may be automatically classified as malware if the score is significantly high.

Abstract: A user interface may be selected for a system with hierarchical data types by traversing an inheritance tree to find a pre-defined user interface, or by automatically generating a user interface based on the type definition. The automatically generated user interface may include tabs or groupings for components of the data type that may be inherited from other data types. In some embodiments, portions of the automatically generated user interface may be obtained from other data types.

Abstract: A data feed is defined with a data type and criteria. Each data type corresponds to a type of management related data provided by a management system. The management system is searched for all management related data that corresponds with the data type and the criteria. An aggregator collects the management related data that corresponds with the data type and the criteria. The collected management related data is rendered for a display.

Abstract: A computer-implemented method for exposing instrumentation data available from within a managed code environment to an instrumentation data source executing outside of said managed code environment is presented. The method comprises each of the following. An indication is received that said instrumentation data should be exposed to said instrumentation data source. In response to receiving said indication, a decoupled provider is loaded. The decoupled provider facilitates communication between said managed code environment and said instrumentation data source. A determination is made as to whether schema describing said instrumentation data has been previously registered with said instrumentation data source. In response to determining that said schema has not been previously registered with said instrumentation data source, said schema is registered with said instrumentation data source through said decoupled provider.

Abstract: An application program interface (API) provides a set of functions, including a set of base classes and types that are used in substantially all applications accessing the API, for application developers who build Web applications on Microsoft Corporation's .NET™ platform.

Abstract: An application program interface (API) provides a set of functions, including a set of base classes and types that are used in substantially all applications accessing the API, for application developers who build Web applications on Microsoft Corporation's .NET™ platform.

Abstract: Architecture that facilitates management of an application or service of a system. A catalog is provided that stores management information which is accessible to determine the status of the application of service. Code of the application or service to be installed on the system is attributed with management information. When installed, the application or service is processed to copy the management information into a manifest, which manifest is further stored in the catalog along with other manifests associated with different applications or services. The management information in a manifest is uniquely identified by a URI, which access to the management information is via the URI, and which leads to the associated application or service.

Abstract: A system that facilitates management of an application or service of a system using code attribution. Code of an application or service to be installed on the system is attributed with management information. The system includes a management subsystem that uses the attributed management information to manage the installed application or service.