Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates associated with content objects taken from the plurality of content objects. When a document template is identified, template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: Handling user-demanded privacy controls over data of an electronic document collaboration system. A storage facility is configured to store content objects and associated metadata that pertains to the content objects. A user raises a privacy action request that comprises a demand to change how certain content objects that contain personally identifiable information (PII) of the user are handled. A plurality of content objects are classified using a PII classifier that is trained using synthetically-generated training set entries where, rather than reading actual contents from electronic documents of the collaboration system to generate training set entries, instead, the training set entries are generated using words that are randomly selected from a repository of natural language words. When PII corresponding to the user who raised the privacy action request is discovered in content objects, then the content management system modifies those content objects and/or its metadata in accordance with the demand.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Abstract: Examples disclosed herein involve data stream analytics. In examples herein, a data stream may be analyzed by computing a set of hashes of a real-valued vector, the real-valued vector corresponding to a sample data object of a data stream; generating a list of data objects from a database corresponding to the sample data object based on the set of hashes, the list of data objects ordered based on similarity of the data objects to the sample data object of the data stream; and updating a data structure representative of activity of the sample data object in the data stream based on the list of data objects, the data structure to provide incremental analysis corresponding to the sample data object.

Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Methods, systems, and computer program products for content management systems. An unlabeled dataset comprising documents that at least potentially comprise personally identifiable information (PII) is used when training a PII content classifier. Such a classifier is trained by (1) determining, based on applying a PII rule to a first portion of a document selected from the unlabeled dataset, a confidence value that the first portion of the document does contain personally identifiable information, (2) selecting a second portion of the document selected from the unlabeled dataset such that the second portion does not include the first portion; and (3) assigning, based on the confidence value, a likelihood value that corresponds to whether characteristics of the second portion are indicative that the document does contain personally identifiable information. Such a PII content classifier is used over selected portions of subject content objects to determine whether the selected portions contain PII.

Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates that are associated with content objects taken from the plurality of content objects. When a document template is identified, then template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata as well. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Incremental automatic update of ranked neighbor lists based on k-th nearest neighbors is disclosed. One example is a system including an indexing module to retrieve an incoming data stream, and retrieve ranked neighbor lists for received data objects. An evaluator determines similarity measures between the received data objects and their respective k-th nearest neighbors. A threshold determination module determines a statistical distribution based on the determined similarity measures, and a threshold based on the statistical distribution. The evaluator determines additional similarity measures between a new data object in the data stream and the received data objects.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises computing, via a processor, a ranked elements list for each of a plurality of objects. The method also comprises iteratively computing, via the processor, a blacklist of elements for the objects. The method further comprises determining, via the processor, duster centers that include top ranked non-blacklisted elements, and assigning, via the processor, each object to at least one duster center.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.