Abstract: An apparatus comprises a memory to store data and a processor coupled to the memory. The processor may modify a plurality of data elements using a semantic relationship between the plurality of data elements and a pre-selected data security policy and to store data representing the modified plurality of data elements in the memory.

Abstract: Example implementations relate to capturing and/or recovering components of a computing system. A recovery service may receive a recovery script from an external recovery script repository, wherein the recovery script may include a number of actions, each respective action being a capture action or a recovery action. For action in the recovery script, the recovery service may request a recovery agent to perform the action on a component of the computing system.

Abstract: Examples analyze source code of a task prior to compiling the source code to determine a static property of the task. Examples determine a category for the task based at least in part on the static property. Examples compile the source code to generate a binary of the task. Examples determine execution parameters for the task based at least in part on the category. Examples schedule the binary for execution based at least in part on the execution parameters.

Abstract: Examples relate to model-based computer attack analytics orchestration. In one example, a computing device may: generate, using an attack model that specifies behavior of a particular attack on a computing system, a hypothesis for the particular attack, the hypothesis specifying, for a particular state of the particular attack, at least one attack action; identify, using the hypothesis, at least one analytics function for determining whether the at least one attack action specified by the hypothesis occurred on the computing system; provide an analytics device with instructions to execute the at least one analytics function on the computing system; receive analytics results from the analytics device; and update a state of the attack model based on the analytics results.

Abstract: Example implementations relate to capturing and/or recovering components of a computing system. A recovery service may receive a recovery script from an external recovery script repository, wherein the recovery script may include a number of actions, each respective action being a capture action or a recovery action. For action in the recovery script, the recovery service may request a recovery agent to perform the action on a component of the computing system.

Abstract: Example implementations relate to changing deployment statuses. An example implementation includes updating a data source data store comprising descriptors of available data sources, a pre-processor data store comprising descriptors of available pre-processors, or an analytic data store comprising descriptors of available analytics. A change request may be initiated responsive to a change in the data source data, pre-processor data, or analytic data and a deployment status of a pre-processor or an analytic may be changed responsive to the change request.

Abstract: An apparatus comprises a memory to store data and a processor coupled to the memory. The processor may modify a plurality of data elements using a semantic relationship between the plurality of data elements and a pre-selected data security policy and to store data representing the modified plurality of data elements in the memory.

Abstract: Examples analyze source code of a task prior to compiling the source code to determine a static property of the task. Examples determine a category for the task based at least in part on the static property. Examples compile the source code to generate a binary of the task. Examples determine execution parameters for the task based at least in part on the category. Examples schedule the binary for execution based at least in part on the execution parameters.

Abstract: Examples relate to computer attack model management. In one example, a computing device may: identify a first set of attack models, each attack model in the first set specifying behavior of a particular attack on a computing system; obtain, for each attack model in the first set, performance data that indicates at least one measure of attack model performance for a previous use of the attack model in determining whether the particular attack occurred on the computing system; and update the first set of attack models based on the performance data.

Abstract: Examples relate to model-based computer attack analytics orchestration. In one example, a computing device may: generate, using an attack model that specifies behavior of a particular attack on a computing system, a hypothesis for the particular attack, the hypothesis specifying, for a particular state of the particular attack, at least one attack action; identify, using the hypothesis, at least one analytics function for determining whether the at least one attack action specified by the hypothesis occurred on the computing system; provide an analytics device with instructions to execute the at least one analytics function on the computing system; receive analytics results from the analytics device; and update a state of the attack model based on the analytics results.

Abstract: According to an example, statistics-based data trace classification may include generating sets of training data traces from training data information by assigning a subset of the training data information that has a predetermined property with a first label and assigning another subset of the training data information that does not have the predetermined property with a second label. A trained trace classifier may be generated to detect whether or not a set of input data traces satisfies the predetermined property. The trace classifier may be trained to learn the predetermined property from a statistical data object determined from the sets of the training data traces, and the first and second labels related to the sets of the training data traces.