Abstract: Embodiments described systems and method to estimate user gaze comprising receiving a target image data associated with the user from a camera coupled with the display, wherein the target image data includes a target eye patch image data associated with the user; and determining, using a neural network, the target point of regard associated with the target image data based on: the target eye patch image data, a plurality of aggregated gaze reference vectors, and a plurality of reference image data associated with the user, respectively associated with the plurality of aggregated gaze reference vectors. In embodiments, the target point of regard is determined within a predetermined threshold. In embodiments, the target point of regard is mapped onto the display.

Abstract: The disclosure relates to systems, methods, and programs for implicitly determining the relation of the eyes associated with gaze inference, including salient features (e.g., ocular dominance) that are not visible within a digital frame, allowing for real-time determination of the user's dominant eye for the purpose of gaze estimation, and point-of-regard mapping onto a 2D plane, achieved through an end-to-end training of an eye selector agent with domain-expertise knowledge embedded in an unsupervised manner via a convolutional deep neural network training process.

Abstract: Embodiments described systems and method to estimate user gaze comprising receiving a target image data associated with the user from a camera coupled with the display, wherein the target image data includes a target eye patch image data associated with the user; and determining, using a neural network, the target point of regard associated with the target image data based on: the target eye patch image data, a plurality of aggregated gaze reference vectors, and a plurality of reference image data associated with the user, respectively associated with the plurality of aggregated gaze reference vectors. In embodiments, the target point of regard is determined within a predetermined threshold. In embodiments, the target point of regard is mapped onto the display.

Abstract: The disclosure relates to systems, methods, and programs for implicitly determining the relation of the eyes associated with gaze inference, including salient features (e.g., ocular dominance) that are not visible within a digital frame, allowing for real-time determination of the user's dominant eye for the purpose of gaze estimation, and point-of-regard mapping onto a 2D plane, achieved through an end-to-end training of an eye selector agent with domain-expertise knowledge embedded in an unsupervised manner via a convolutional deep neural network training process.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Certain described examples are directed towards analyzing network data. The network data is processed to generate a graph data structure that has edges that are associated with communication times from the network data and nodes that are associated with computer devices. Representations of the graph data structure are generated over time. Given an indication of at least a computing device, for example as involved in anomalous activity or a security incident, the representations of the graph data structure may be used to determine further associated computer devices that are associated with the indicated device.

Abstract: A common action flow for an application is identified by processing session data maintained for a plurality of users to identify a plurality of action flows. Each action flow represents a series of actions taken by one of the users navigating the application's user interface during a session. A data structure is generated from the plurality of action flows. That data structure is indicative of a plurality of candidate sub-flows. The data structure is analyzed to identify a selected one of the candidate sub-flows repeated in multiple ones of the plurality of action flows. That identified sub-flow is the common action flow. Data representative of the identified common action flow can then be communicated.

Abstract: A method, a computing system, and a non-transitory machine readable storage medium containing instructions for identifying relationships between entities are provided. In an example, the method includes receiving a query. The query specifies a first computing entity, a second computing entity, and a window of time. A data structure is queried based on the query to identify a set of relationship instances each corresponding to a relationship between the first computing entity and the second computing entity during the window of time. A representation of the first computing entity, the second computing entity, and the set of relationship instances is provided at a user interface.

Abstract: In some examples, a first pair of parameters in respective first and second log message streams associated with respective first and second source components and a second pair of parameters in the respective first and second log message streams may be identified. The first pair may be identical and the second pair may be identical. It may be determined that first pair of parameters was simultaneously generated and that the second pair of parameters was simultaneously generated in the first and in the second log message streams. A linkage score may be determined between the first and the second source components. The linkage score may be based on the determination that each of the respective first and the second pairs of parameters was simultaneously generated. It may be determined that that the first and second source components are topologically linked based on the linkage score.

Abstract: Certain described examples are directed towards analyzing network data. The network data is processed to generate a graph data structure that has edges that are associated with communication times from the network data and nodes that are associated with computer devices. Representations of the graph data structure are generated over time. Given an indication of at least a computing device, for example as involved in anomalous activity or a security incident, the representations of the graph data structure may be used to determine further associated computer devices that are associated with the indicated device.

Abstract: In some examples, a first pair of parameters in respective first and second log message streams associated with respective first and second source components and a second pair of parameters in the respective first and second log message streams may be identified. The first pair may be identical and the second pair may be identical. It may be determined that first pair of parameters was simultaneously generated and that the second pair of parameters was simultaneously generated in the first and in the second log message streams. A linkage score may be determined between the first and the second source components. The linkage score may be based on the determination that each of the respective first and the second pairs of parameters was simultaneously generated. It may be determined that that the first and second source components are topologically linked based on the linkage score.

Abstract: A method, a computing system, and a non-transitory machine readable storage medium containing instructions for identifying relationships between entities are provided. In an example, the method includes receiving a query. The query specifies a first computing entity, a second computing entity, and a window of time. A data structure is queried based on the query to identify a set of relationship instances each corresponding to a relationship between the first computing entity and the second computing entity during the window of time. A representation of the first computing entity, the second computing entity, and the set of relationship instances is provided at a user interface.

Abstract: A common action flow for an application is identified by processing session data maintained for a plurality of users to identify a plurality of action flows. Each action flow represents a series of actions taken by one of the users navigating the application's user interface during a session. A data structure is generated from the plurality of action flows. That data structure is indicative of a plurality of candidate sub-flows. The data structure is analyzed to identify a selected one of the candidate sub-flows repeated in multiple ones of the plurality of action flows. That identified sub-flow is the common action flow. Data representative of the identified common action flow can then be communicated.

Abstract: A common action flow for an application is identified by processing session data maintained for a plurality of users to identify a plurality of action flows. Each action flow represents a series of actions taken by one of the users navigating the application's user interface during a session. A data structure is generated from the plurality of action flows. That data structure is indicative of a plurality of candidate sub-flows. The data structure is analyzed to identify a selected one of the candidate sub-flows repeated in multiple ones of the plurality of action flows. That identified sub-flow is the common action flow. Data representative of the identified common action flow can then be communicated.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Determining term scores based on a modified inverse domain frequency is disclosed. One example is a system including a data processing engine, an evaluator, and a data analytics module. The data processing engine identifies a key term associated with a system, and a sub-plurality of a plurality of documents, the sub-plurality of documents associated with the event. The evaluator determines, based on the presence or absence of the key term, a first distribution related to the sub-plurality of documents, and a second distribution related to the plurality of documents, and evaluates, for the key term, a term score based on the first distribution and the second distribution, the term score indicative of a modified inverse domain frequency based on the sub-plurality of documents. The data analytics module includes the key term in a word cloud when the term score for the key term satisfies a threshold.

Abstract: A common action flow for an application is identified by processing session data maintained for a plurality of users to identify a plurality of action flows. Each action flow represents a series of actions taken by one of the users navigating the application's user interface during a session. A data structure is generated from the plurality of action flows. That data structure is indicative of a plurality of candidate sub-flows. The data structure is analyzed to identify a selected one of the candidate sub-flows repeated in multiple ones of the plurality of action flows. That identified sub-flow is the common action flow. Data representative of the identified common action flow can then be communicated.

Abstract: Disclosed herein are techniques for formulating parsing rules. Substrings are detected in an input data. Each substring is associated with a semantic token that categorizes each substring. Patterns of semantic tokens are identified. Rules for parsing the input data are formulated based at least partially on the patterns of semantic tokens.