Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for clustering and visualizing textual data. A data clustering and visualization system clusters large volumes of semi-structured and unstructured textual data into categories. Each category can include a group of similar alerts and incidents. The categories are then graphically presented.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing semi-supervised learning on partially labeled nodes on a bipartite graph. One described method can determine a useful score of malware infection risk from partial known facts for entities modeled as nodes on a bipartite graph, where network traffic is measured between inside-the-enterprise entities and outside-the-enterprise entities. This and other methods can be implemented in a large-scale massively parallel processing database. Methods of scaling the partial label input and of presenting the results are also described.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting and localizing anomalies in large data sets. One of the methods includes identifying a user whose behavior is classified as anomalous during a particular time interval and determining observed community feature values for a community of users of which the user is a member. If observed user feature values are consistent with the observed community feature values, the behavior of the user is classified as not anomalous. If the observed user feature values are not consistent with the observed community feature values, the behavior of the user is classified as anomalous.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting and localizing anomalies in large data sets. One of the methods includes identifying a user whose behavior is classified as anomalous during a particular time interval and determining observed community feature values for a community of users of which the user is a member. If observed user feature values are consistent with the observed community feature values, the behavior of the user is classified as not anomalous. If the observed user feature values are not consistent with the observed community feature values, the behavior of the user is classified as anomalous.