Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

Abstract: The technology disclosed relates to detecting anomalous behavior of network components in a complex network setting.

Abstract: The technology disclosed relates to sub-clustering within service clusters in real-time. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections, wherein the node data includes software versions of the processes and process data with configuration files and clustering the multiple hosts with the service clusters into the sub-clusters based at least in part on the software versions.

Abstract: The technology disclosed relates to maintaining up to date software version data in a network. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections. It further relates to collecting current software version information for the processes, updating the network topology with the current software version for particular process running on a particular host when it differs from a stored software version in the network topology, reassigning the particular host to a sub-cluster within the service cluster according to the current software version, and monitoring the updated sub-cluster within the service cluster.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to learning how to efficiently display anomalies in performance data to an operator. In particular, it relates to assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and training a classifier that implements at least one circumstance-specific detector used to monitor a time series of performance data or to detect patterns in the time series. The training includes producing a time series of anomaly event candidates including corresponding event information used as input to the detectors, generating feature vectors for the anomaly event candidates, selecting a subset of the candidates as anomalous instance data, and using the feature vectors for the anomalous instance data and implicit and/or explicit feedback from users exposed to a visualization of the monitored time series annotated with visual tags for at least some of the anomalous instances data to train the classifier.

Abstract: Disclosed is a system and method for providing search suggestions to a user based on the user's previously entered search queries. A computing device stores a global set of search suggestions. The computing device receives over a network from a user computer operated by a user one or more alphanumeric characters forming a portion of a search query. The computing device determines a search suggestion to the portion of the search query from the global set of search suggestions based on a search history of the user, the search history of the user comprising a plurality of search queries entered by the user within a predetermined period of time. The computing device transmits to the user computer the search suggestion for display by the user computer.

Abstract: Search-engine software displays a group of search results in a graphical user interface (GUI) for a search engine. The search-engine software captures positive feedback and negative feedback as to the search results from a user. Then the search-engine software determines a collective aboutness signature for the search results associated with the positive feedback and a collective aboutness signature for search results associated with the negative feedback. The search-engine software obtains a score of similarity to each of the collective aboutness signatures for a representation of each query suggestion in a group of query suggestions. Then the search-engine software separates the scored query suggestions into two or more groups, based on the similarity scores, and displays query suggestions from the groups in the GUI.

Abstract: The present invention is directed towards systems and methods for providing search assistance technologies based on a user's search self-efficacy and search frustration. The method according to one embodiment of the present invention comprises receiving a search query from a user. The method then calculates the user's search self-efficacy and calculates the user's frustration with the current information task. The method then identifies a plurality of search assistance technologies based on the user's search self-efficacy and frustration. Finally, the method provides a search engine results page comprising a plurality of search results and the identified plurality of search assistance technologies.

Abstract: Search-engine software displays a group of search results in a graphical user interface (GUI) for a search engine. The search-engine software captures positive feedback and negative feedback as to the search results from a user. Then the search-engine software determines a collective aboutness signature for the search results associated with the positive feedback and a collective aboutness signature for search results associated with the negative feedback. The search-engine software obtains a score of similarity to each of the collective aboutness signatures for a representation of each query suggestion in a group of query suggestions. Then the search-engine software separates the scored query suggestions into two or more groups, based on the similarity scores, and displays query suggestions from the groups in the GUI.

Abstract: Method, system, and programs for providing personalized suggest-as-you-type suggestions in response to a user search query wherein the personalized query suggestions are based on the user's past interactions with the system. The system is able to identify frequent queries issued by the user that result in the user clicking on the same universal resource locator.

Abstract: Disclosed is a system and method for providing search suggestions to a user based on the user's previously entered search queries. A computing device stores a global set of search suggestions. The computing device receives over a network from a user computer operated by a user one or more alphanumeric characters forming a portion of a search query. The computing device determines a search suggestion to the portion of the search query from the global set of search suggestions based on a search history of the user, the search history of the user comprising a plurality of search queries entered by the user within a predetermined period of time. The computing device transmits to the user computer the search suggestion for display by the user computer.

Abstract: One embodiment selects from a set of query-suggestion pairs a first query and a subset of query-suggestion pairs that each has the first query as its query; computes a Log Likelihood Ratio (LLR) value for each query-suggestion pair from the subset of query-suggestion pairs; ranks the subset of query-suggestion pairs according to their respective LLR values; removes from the subset of query-suggestion pairs all query-suggestion pairs whose LLR values are below a predetermined LLR threshold; computes a Pointwise Mutual Information (PMI) value for each remaining query suggestion pair from the subset of query-suggestion pairs; removes from the subset of query-suggestion pairs all query-suggestion pairs whose PMI values are below a predetermine PMI threshold; and constructs a ranked set of suggestions for the first query, wherein the ranked set of suggestions comprises one or more suggestions of the remaining query-suggestion pairs from the subset of query-suggestion pairs.

Abstract: The present invention is directed towards systems and methods for providing search assistance technologies based on a user's search self-efficacy and search frustration. The method according to one embodiment of the present invention comprises receiving a search query from a user. The method then calculates the user's search self-efficacy and calculates the user's frustration with the current information task. The method then identifies a plurality of search assistance technologies based on the user's search self-efficacy and frustration. Finally, the method provides a search engine results page comprising a plurality of search results and the identified plurality of search assistance technologies.

Abstract: One embodiment selects from a set of query-suggestion pairs a first query and a subset of query-suggestion pairs that each has the first query as its query; computes a Log Likelihood Ratio (LLR) value for each query-suggestion pair from the subset of query-suggestion pairs; ranks the subset of query-suggestion pairs according to their respective LLR values; removes from the subset of query-suggestion pairs all query-suggestion pairs whose LLR values are below a predetermined LLR threshold; computes a Pointwise Mutual Information (PMI) value for each remaining query suggestion pair from the subset of query-suggestion pairs; removes from the subset of query-suggestion pairs all query-suggestion pairs whose PMI values are below a predetermine PMI threshold; and constructs a ranked set of suggestions for the first query, wherein the ranked set of suggestions comprises one or more suggestions of the remaining query-suggestion pairs from the subset of query-suggestion pairs.

Abstract: A method for processing semi-structured data. The method includes receiving semi-structured data into a first format from a real business process. Preferably, the semi-structured data are machine generated. The method includes tokenizing the semi-structured data into a second format and storing the semi-structured data in the second format into one or more memories and clustering the tokenized data to form a plurality of clusters. The method also includes identifying a selected low frequency term in each of the clusters, and processing at least two of the clusters and the associated selected low frequency terms to form a single template for the at least two of the clusters. In a preferred embodiment, the method replaces the selected low frequency term with a wild card character.

Abstract: A method for estimating the performance of a statistical classifier. The method includes inputting a first set of business data in a first format from a real business process and storing the first set of business data in the first format into memory. The method applying a statistical classifier to the first set of business data and recording its classification decisions and obtaining a labeling that contains the correct decision for each data item. The method includes computing a weight for each data item that reflects its true frequency and computing a performance measure of the statistical classifier based on the weights that reflect true frequency. The method also displays the performance measure to a user.