Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: The present disclosure relates to an interactive system that manages analytics contexts through a series of analytics interactions. The disclosed interactive system receives a selection of an analytics interaction from a user during an interactive analytics session. Then, the system generates a series of analytics interactions by the user during the interactive analytics session. Each analytics interaction represents an analytics context that comprises an analytics interaction, a result, and a reference analytics context. Moreover, the system manages a plurality of analytics contexts by selecting the reference analytics context from previous analytics interactions, or by navigating to a different analytics context, or by deactivating a user-selected analytics context, and presents to the user the series of analytics interactions with the result corresponding to both the selection of the analytics interaction and the reference analytics context.

Abstract: Examples herein involve generating a spiral visualization of items of a dataset. Dimensions of item indicators corresponding to items of a dataset are analyzed. Starting coordinates for a spiral path for a spiral visualization of the items are determined based on the dimensions of the item indicators and a display area of a display device. A spiral path may be calculated based on the starting coordinates and the dimensions of the item indicators. The spiral visualization may be generated by rendering the item indicators on the spiral path to present a first item indicator of the item indicators from a corresponding first item of the list at the starting coordinates and a last item indicator of the item indicators of a corresponding last item on the list on the spiral path toward the center of the spiral.

Abstract: A tag is set as a tag in focus in response to detecting a user selection of the tag. An item in an item view of a user interface is associated with the tag in focus in response to the user selecting the item.

Abstract: Examples herein involve generating a spiral visualization of items of a dataset. Dimensions of item indicators corresponding to items of a dataset are analyzed. Starting coordinates for a spiral path for a spiral visualization of the items are determined based on the dimensions of the item indicators and a display area of a display device. A spiral path may be calculated based on the starting coordinates and the dimensions of the item indicators. The spiral visualization may be generated by rendering the item indicators on the spiral path to present a first item indicator of the item indicators from a corresponding first item of the list at the starting coordinates and a last item indicator of the item indicators of a corresponding last item on the list on the spiral path toward the center of the spiral.

Abstract: The present disclosure relates to an interactive system that manages analytics contexts through a series of analytics interactions. The disclosed interactive system receives a selection of an analytics interaction from a user during an interactive analytics session. Then, the system generates a series of analytics interactions by the user during the interactive analytics session. Each analytics interaction represents an analytics context that comprises an analytics interaction, a result, and a reference analytics context. Moreover, the system manages a plurality of analytics contexts by selecting the reference analytics context from previous analytics interactions, or by navigating to a different analytics context, or by deactivating a user-selected analytics context, and presents to the user the series of analytics interactions with the result corresponding to both the selection of the analytics interaction and the reference analytics context.

Abstract: Data entries can include values for each of a number of features that each have a number of permissible or possible values. The features and the permissible values thereof are ranked based on a graph constructed from the features and the permissible values. The data entries can include textual data for free-text features that do not have permissible values or possible values, and new features created based on information extracted from the textual data, where nodes and edges are added to the graph from these new features. Graphical elements corresponding to the features and graphical representations based on frequencies of the permissible values of the features can be displayed.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Determining term scores based on a modified inverse domain frequency is disclosed. One example is a system including a data processing engine, an evaluator, and a data analytics module. The data processing engine identifies a key term associated with a system, and a sub-plurality of a plurality of documents, the sub-plurality of documents associated with the event. The evaluator determines, based on the presence or absence of the key term, a first distribution related to the sub-plurality of documents, and a second distribution related to the plurality of documents, and evaluates, for the key term, a term score based on the first distribution and the second distribution, the term score indicative of a modified inverse domain frequency based on the sub-plurality of documents. The data analytics module includes the key term in a word cloud when the term score for the key term satisfies a threshold.

Abstract: An interactive system to detect malware is provided to interactively analyze web proxy log data. The log data is progressively processed to compute analytics for different context settings. The system has a context module, an interaction module and a plurality of analytics modules. When a change of the context setting (filter, weights etc.) is requested, the processing and calculation of analytics for the current context setting is paused and subsequently restarted for the now changed context setting. An analytics interface provided via a graphical user interface is updated upon the change of context settings.