Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates that are associated with content objects taken from the plurality of content objects. When a document template is identified, then template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata as well. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Incremental automatic update of ranked neighbor lists based on k-th nearest neighbors is disclosed. One example is a system including an indexing module to retrieve an incoming data stream, and retrieve ranked neighbor lists for received data objects. An evaluator determines similarity measures between the received data objects and their respective k-th nearest neighbors. A threshold determination module determines a statistical distribution based on the determined similarity measures, and a threshold based on the statistical distribution. The evaluator determines additional similarity measures between a new data object in the data stream and the received data objects.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises computing, via a processor, a ranked elements list for each of a plurality of objects. The method also comprises iteratively computing, via the processor, a blacklist of elements for the objects. The method further comprises determining, via the processor, duster centers that include top ranked non-blacklisted elements, and assigning, via the processor, each object to at least one duster center.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: A system may include an access engine to access an input vector as well as a projection matrix. The projection matrix may include a number of rows equal to a number of hash values to generate from the input vector multiplied by the square root of an inverted sparsity parameter specifying a ratio of the hash universe size from which the hash values are generated to the number of hash values to generate. The projection matrix may include a number of columns equal to the dimensionality of the input vector. The system may also include a hash computation engine to determine a projection vector from the projection matrix and the input vector, split the projection vector into a number of sub-vectors equal to the number of hash values to generate, and generate a hash value from each of the sub-vectors.

Abstract: Incremental automatic update of ranked neighbor lists based on k-th nearest neighbors is disclosed. One example is a system including an indexing module to retrieve an incoming data stream, and retrieve ranked neighbor lists for received data objects. An evaluator determines similarity measures between the received data objects and their respective k-th nearest neighbors. A threshold determination module determines a statistical distribution based on the determined similarity measures, and a threshold based on the statistical distribution. The evaluator determines additional similarity measures between a new data object in the data stream and the received data objects.

Abstract: A system may include an access engine to access an input vector as well as a projection matrix. The projection matrix may include a number of rows equal to a number of hash values to generate from the input vector multiplied by the square root of an inverted sparsity parameter specifying a ratio of the hash universe size from which the hash values are generated to the number of hash values to generate. The projection matrix may include a number of columns equal to the dimensionality of the input vector. The system may also include a hash computation engine to determine a projection vector from the projection matrix and the input vector, split the projection vector into a number of sub-vectors equal to the number of hash values to generate, and generate a hash value from each of the sub-vectors.

Abstract: A system may include an access engine and a projection engine. The access engine may access a feature vector with an initial dimensionality that represents a data object of a physical system. The projection engine may generate an extended vector with an extended dimensionality from the feature vector. The projection engine may also apply an orthogonal transformation to the extended vector to obtain an intermediate vector with the extended dimensionality, as well as compute the inner products of the intermediate vector and sparse binary vectors of a sparse binary vector set. In doing so, the projection engine may obtain a randomly projected vector with an output dimensionality that is greater than the extended dimensionality of the intermediate vector. Then, the projection engine may output the randomly projected vector as an output vector that is a random projection of the feature vector with the output dimensionality.

Abstract: In some examples, a system includes an access engine and a hyperplane determination engine. The access engine may access a training vector set that includes sparse binary training vectors and a set of labels classifying each of the sparse binary training vectors through a positive label or a negative label. The hyperplane determination engine may initialize a candidate hyperplane vector and maintain a scoring vector including scoring vector elements to track separation variances of the sparse binary training vectors with respect to the candidate hyperplane vector. Through iterations of identifying, according to the scoring vector, a particular sparse binary training vector with a greatest separation variance with respect to the candidate hyperplane vector, the hyperplane determination engine may incrementally update the candidate hyperplane vector and incrementally update the scoring vector to adjust separation variances affected by updates to the candidate hyperplane vector.

Abstract: Examples disclosed herein involve data stream analytics. In examples herein, a data stream may be analyzed by computing a set of hashes of a real-valued vector, the real-valued vector corresponding to a sample data object of a data stream; generating a list of data objects from a database corresponding to the sample data object based on the set of hashes, the list of data objects ordered based on similarity of the data objects to the sample data object of the data stream; and updating a data structure representative of activity of the sample data object in the data stream based on the list of data objects, the data structure to provide incremental analysis corresponding to the sample data object.

Abstract: In some examples, a method includes accessing input vectors in an input space, wherein the input vectors characterize elements of a physical system. The method may also include generating feature vectors from the input vectors, and the feature vectors are generated without any vector product operations between performed between any of the input vectors. An inner product of a pair of the feature vectors may correlate to an implicit kernel for the pair of feature vectors, and the implicit kernel may approximate a Gaussian kernel within a difference threshold. The method may further include providing the feature vectors to an application engine for use in analyzing the elements of the physical system, other elements in the physical system, or a combination of both.

Abstract: A method includes receiving information about a plurality of data chunks and determining if one or more of a plurality of back-end nodes already stores more than a threshold amount of the plurality of data chunks where one of the plurality of back-end nodes is designated as a sticky node. The method further includes, responsive to determining that none of the plurality of back-end nodes already stores more than a threshold amount of the plurality of data chunks, deduplicating the plurality of data chunks against the back-end node designated as the sticky node. Finally, the method includes, responsive to an amount of data being processed, designating a different back-end node as the sticky node.

Abstract: In one embodiment, for a first image, a first vector of similarity to a set of reference images is calculated as a first face descriptor, and for a second image, a second vector of similarity to the set of reference images is calculated as a second face descriptor. A similarity measure between the first face descriptor and the second face descriptor is then calculated.