Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

Abstract: Examples disclosed herein relate, among other things, to a method. The method may obtain a time series comprising a plurality of data points associated with a sub-segment of a segment, obtaining a plurality of weights associated with a plurality of data point pairs from the plurality of data points, and based on the plurality of weights and the plurality of data point pairs, determine whether the time series comprises a trend. Based on a determination that the time series comprises a trend, the method may calculate a trend score for the trend based on at least one characteristic of at least one of the segment and the sub-segment, and provide the trend for display.

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

Abstract: In some examples, a plurality of multi-dimensional data samples representing respective behaviors of entities in a computing environment are sorted, where the sorting is based on values of dimensions of each respective multi-dimensional data sample. For a given multi-dimensional data sample, a subset of the plurality of multi-dimensional data samples is selected based on the sorting. An anomaly indication is computed for the given multi-dimensional data sample based on applying a function on the multi-dimensional data samples in the subset. It is determined whether the given multi-dimensional data sample represents an anomalous entity in the computing environment based on the computed anomaly indication.

Abstract: In some examples, a plurality of alerts relating to issues in a computing arrangement are received, where the plurality of alerts generated based on events in the computing arrangement. A subset of the plurality of alerts is grouped into a bundle of alerts, the grouping being based on a criterion. The bundle of alerts is communicated to cause processing of the alerts in the bundle of alerts together.

Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. Contextual information is determined for the alert, the determined contextual information comprising spatial and temporal distributions of previous instances of the alert or similar alerts. The contextual information is communicated for use in addressing the issue in the computing arrangement.

Abstract: An example method is provided in according with one implementation of the present disclosure. The method comprises generating a group of most frequent elements in a dataset, calculating features of each of the most frequent elements in the dataset, applying a trained model to the features of each of the most frequent elements, and generating a list of predicted relevant elements from the list of most frequent elements. The method further comprises determining at least one element-chain group for each predicted relevant element and a group score for the element-chain-group, ordering a plurality of element-chain groups for the dataset based on the group score for each of the element-chain groups, and identifying a predetermined number of element-chain groups to be outputted to a user.

Abstract: A unified visualization interface is disclosed. One example is a system including an association module, a multicasting module, a data sharing module, and a unified visualization interface. The association module associates an identified event in a first visualization system with a visualization function. The multicasting module stores event data related to the identified event and the associated visualization function in a shared data source, and multicasts the identified event to a second visualization system. The data sharing module associates the event data with characteristics of the first visualization system, and shares, in response to the multicast of the identified event, the shared data source with the second visualization system.

Abstract: The present disclosure relates to an interactive system that manages analytics contexts through a series of analytics interactions. The disclosed interactive system receives a selection of an analytics interaction from a user during an interactive analytics session. Then, the system generates a series of analytics interactions by the user during the interactive analytics session. Each analytics interaction represents an analytics context that comprises an analytics interaction, a result, and a reference analytics context. Moreover, the system manages a plurality of analytics contexts by selecting the reference analytics context from previous analytics interactions, or by navigating to a different analytics context, or by deactivating a user-selected analytics context, and presents to the user the series of analytics interactions with the result corresponding to both the selection of the analytics interaction and the reference analytics context.

Abstract: According to an example, intent based clustering may include classifying objects based on training objects, and clustering the objects to determine initial clusters. The classification and initial clustering may be used to determine modified clusters.

Abstract: According to an example, intent based clustering may include generating a plurality of clusters based on an analysis of categories of features of data used to generate the clusters with respect to an order of each of the features by determining whether a number of samples of the data for a category of the categories meets a specified criterion.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Determining term scores based on a modified inverse domain frequency is disclosed. One example is a system including a data processing engine, an evaluator, and a data analytics module. The data processing engine identifies a key term associated with a system, and a sub-plurality of a plurality of documents, the sub-plurality of documents associated with the event. The evaluator determines, based on the presence or absence of the key term, a first distribution related to the sub-plurality of documents, and a second distribution related to the plurality of documents, and evaluates, for the key term, a term score based on the first distribution and the second distribution, the term score indicative of a modified inverse domain frequency based on the sub-plurality of documents. The data analytics module includes the key term in a word cloud when the term score for the key term satisfies a threshold.

Abstract: An interactive system to detect malware is provided to interactively analyze web proxy log data. The log data is progressively processed to compute analytics for different context settings. The system has a context module, an interaction module and a plurality of analytics modules. When a change of the context setting (filter, weights etc.) is requested, the processing and calculation of analytics for the current context setting is paused and subsequently restarted for the now changed context setting. An analytics interface provided via a graphical user interface is updated upon the change of context settings.

Abstract: According to an example, term chain clustering may include receiving a set of training cases from a known category, and receiving a set of unlabeled cases that are to be analyzed with respect to the known category. A plurality of terms of the set of training cases from the known category, and the set of unlabeled cases that are to be analyzed, may be analyzed using a term scoring function to generate a score for each of the plurality of terms. A highest scoring term may be selected from the analyzed terms based on the score for each of the plurality of terms. A selected set that includes cases from the set of unlabeled cases that include the highest scoring term may be generated.

Abstract: A technique for residual data identification can include receiving a plurality of data instances in a multi-class training data set that are d as belonging to recognized categories, receiving a plurality of data instances a first unlabeled data set, and receiving a plurality of data instances in a second unlabeled data set A technique for residual data identification can include labeling the plurality of data instances in the multi-class training data set as negative data instances. A technique for residual data identification can include labeling the plurality of data instances in the first unlabeled data set as positive data instances. A technique for residual data identification can include training a classifier with the labeled negative data instances and the labeled positive data instances. A technique for residual data identification can include applying the classifier to identify residual data instances in the second unlabeled data set.

Abstract: A method comprises computing an activity map for an input image. The activity map indicates an amount of variable spatial activity in the input image. The method further comprises producing an output image based on the activity map, and controlling a printhead to cause the output image to be printed. The output image contains a plurality of color pixels and each such color pixel is represented by at least one of cyan (C), magenta (M), yellow (Y), and black (K) in a color space.

Abstract: A method comprises computing an activity map for an input image. The activity map indicates an amount of variable spatial activity in the input image. The method further comprises producing an output image based on the activity map, and controlling a printhead to cause the output image to be printed. The output image contains a plurality of color pixels and each such color pixel is represented by at least one of cyan (C), magenta (M), yellow (Y), and black (K) in a color space.

Abstract: A method for enhancing an input image to produce an enhanced output image is provided. The method includes constructing a photographic-mask intermediate image without low-contrast details and a temporary-image intermediate image with enhanced mid-contrast details, retained high-contrast details, and reduced low-contrast details, and employing values for the photographic-mask intermediate image and temporary-image intermediate image to produce the enhanced output image that is globally and locally contrast-enhanced, sharpened, and denoised.

Abstract: A project management system (10) and method (250) are included. The project management system (10) includes a production database (14) in memory (15) to store project data (20). The project data (20) can include workflow resource data (16) describing workflow resources (54, 56) and feedback data (17) obtained for each workflow step (52) of a plurality of projects (18) of a project type (152). The project management system (10) also includes a processor (27) to access the memory (15) and to execute computer readable instructions including a production learning module (26) to analyze the workflow resource data (16) and the feedback data (17) to generate predictive project data (12). The predictive project data (12) can describe a predicted workflow (154) for a given project (18) of the project type (152) based on the workflow resources (54, 56).