Abstract: Search results and ads that satisfy a query may be formatted into a search results page where an initial placement of ads may result in an estimated click through rate for the presented ads. An adjustment factor may be determined based on parameters associated with the search results, such as the clicks on the search results themselves. The adjustment factor may be applied to a particular ad to determine if an estimated click through rate of the particular ad will change with respect to a position when there are a first number of mainline ads and a second number of side bar ads. Mainline exclusivity may be appropriate for an ad to increase the click through rate of the ad. The increase may be determined in accordance with the adjustment factor to decide whether to present the ad with mainline exclusivity.

Abstract: Sketches are generated for each node in a graph. For undirected graphs, each sketch for a node may include an indicator of a node from a seed set of nodes and the shortest distance between the node and the indicated node. When a request is received for the shortest distance between two nodes of the graph, the sketches for each of the two nodes are retrieved, and nodes that are indicated in both of the sketches are determined. The distances between each of the two nodes and a determined node as indicated in the sketches is summed for each of the determined nodes, and the sum having the least distance is selected as the estimated shortest distance between the two nodes.

Abstract: The present invention provides a packet processing device and method. A parsing processor provides instruction-driven content inspection of network packets at 10-Gbps and above with a parsing engine that executes parsing instructions. A flow state unit maintains statefulness of packet flows to allow content inspection across several related network packets. A state-graph unit traces state-graph nodes to keyword indications and/or parsing instructions. The parsing instructions can be derived from a high-level application to emulate user-friendly parsing logic. The parsing processor sends parsed packets to a network processor unit for further processing.

Abstract: The rank of nodes in a graph may be inferred from a calculated probability that each node in the graph appears in a single random walk of the graph. Short random walks may be generated for each node in the graph. The generated random walks may be combined to form a longer single random walk. Multiple single random walks may be generated in this fashion. The probability of each node appearing in a single random may be calculated from the generated single random walks. The rank of each node may then be inferred from the calculated probabilities.

Abstract: A virtual machine distribution system is described herein that uses a multiphase approach that provides a fast layout of virtual machines on physical computers followed by at least one verification phase that verifies that the layout is correct. During the fast layout phase, the system uses a dimension-aware vector bin-packing algorithm to determine an initial fit of virtual machines to physical hardware based on rescaled resource utilizations calculated against hardware models. During the verification phase, the system uses a virtualization model to check the recommended fit of virtual machine guests to physical hosts created during the fast layout phase to ensure that the distribution will not over-utilize any host given the overhead associated with virtualization. The system modifies the layout to eliminate any identified overutilization. Thus, the virtual machine distribution system provides the advantages of a fast, automated layout planning process with the robustness of slower, exhaustive processes.

Abstract: Entries are arranged in hash tables with storage for multiple entries per bucket with entries being shifted among hash tables to make room for entries being added. A path is determined through a search of the hash tables to identify where to move entries during insert operations among the hash tables to make room for a data item being added. Entries are moved and a data item added according to the identified path. Many different types of searches may be used, such as breadth-first, depth-first, random walk, etc. Also, a free position at the end of the path may be identified by being a bucket having a lowest occupancy level in a first predetermined number of levels of the search, a first bucket encountered having space available or an occupancy level less than a predetermined threshold level, with the predetermined threshold level typically being less than that of a full bucket, etc.

Abstract: A method for packing virtual machines onto host devices may calculate scarcity values for several different parameters. A host's scarcity for a parameter may be determined by multiplying the host's capacity for a parameter with the overall scarcity of that parameter. The sum of a host's scarcity for all the parameters determines the host's overall scarcity. Hosts having the highest scarcity are attempted to be populated with a group of virtual machines selected for compatibility with the host. In many cases, several different scenarios may be evaluated and an optimal scenario implemented. The method gives a high priority to those virtual machines that consume scarce resources, with the scarcity being a function of the available hardware and the virtual machines that may be placed on them.

Abstract: A technique for automatically detecting and correcting configuration errors in a computing system. In a learning process, recurring event sequences, including e.g., registry access events, are identified from event logs, and corresponding rules are developed. In a detecting phase, the rules are applied to detected event sequences to identify violations and to recover from failures. Event sequences across multiple hosts can be analyzed. The recurring event sequences are identified efficiently by flattening a hierarchical sequence of the events such as is obtained from the Sequitur algorithm. A trie is generated from the recurring event sequences and edges of nodes of the trie are marked as rule edges or non-rule edges. A rule is formed from a set of nodes connected by rule edges. The rules can be updated as additional event sequences are analyzed. False positive suppression policies include a violation- consistency policy and an expected event disappearance policy.

Abstract: A method is disclosed for identifying queries stored in a log which are semantically related to an input query that may include a large number of terms. A set of one or more subsequences are generated for each query stored in the log, and these sets of subsequences are stored in a lookup table. A set of one or more subsequences are also generated for the input query. The subsequences in the lookup table and of the input query are generated by hashing of the respective query terms to a value between 0 and 1 using a known technique of min-hashing. The present system then constructs the subsequences of the query using the k-min hashes of the query, where k is an integer based on the number of terms in the query.

Abstract: A method, computer program product, system and apparatus are presented for reducing wasted bandwidth due to supercasting multicast cells through a router switch fabric. In one embodiment of the present invention, signatures of a switch fabric destination address are generated and compared. A signature is an information-rich representation of the fabric destination address that is generated using the fabric destination address. Therefore, supercasting can be minimized by combining fabric destination addresses with like signatures. Aspects of the present invention include generating the signatures using random permutation maps of the set of switch fabric ports or determining intersections of a fabric destination address with a selection of subsets of the switch fabric ports.

Abstract: A model based on a generalization of the Examination Hypothesis is disclosed that states that for a given query, the user click probability on a document in a given position is proportional to the relevance of the document and a query specific position bias. Based on this model the relevance and position bias parameters are learned for different queries and documents. This is done by translating the model into a system of linear equations that can be solved to obtain the best fit relevance and position bias values. A cumulative analysis of the position bias curves may be performed for different queries to understand the nature of these curves for navigational and informational queries. In particular, the position bias parameter values may be computed for a large number of queries. Such an exercise reveals whether the query is informational or navigational.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for identifying matches to a series of regular expressions, with the series of regular expressions including a first regular expression followed by a second regular expression, which avoids the potential overlap of characters used in matching the first and second regular expressions, while allowing individual deterministic finite automata (DFAs) to be used, whether standalone or as a merged DFA, which decreases the number of states required to represent the series of regular expressions. This potential overlap of characters can be avoided by adding marking states in a merged DFA as “divergent” in order to mask (e.g., ignore) a matching of the second regular expression for the potential overlap, or by using another DFA corresponding to the second regular expression for use during this divergent period.

Abstract: A method is disclosed for preventing compressed keys from being aliased across multiple hash tables. A special hashing technique is used to produce hash keys and compressed keys that make such aliasing avoidable. Given a first input key K, a second and different input key K?, a first hash function H0 that produces a first hash key as an index into a first hash table, a second hash function H1 that produces a second hash key as an index into a second hash table, a first compression function L0 that produces a first compressed key for the first hash table, and a second compression function L1 that produces a second compressed key for the second hash table, functions H0, H1, L0, and L1 are selected in such a way that H0(K)=H0(K?) and L0(K)=L0(K?) if and only if H1(K)=H1(K?) and L1(K)=L1 (K?).

Abstract: Data from a click log may be used to generate training data for a search engine. The pages clicked as well as the pages skipped by a user may be used to assess the relevance of a page to a query. Labels for training data may be generated based on data from the click log. The labels may pertain to the relevance of a page to a query.

Abstract: The present invention provides a packet processing device and method. A parsing processor provides instruction-driven content inspection of network packets at 10-Gbps and above with a parsing engine that executes parsing instructions. A flow state unit maintains statefulness of packet flows to allow content inspection across several related network packets. A state-graph unit traces state-graph nodes to keyword indications and/or parsing instructions. The parsing instructions can be derived from a high-level application to emulate user-friendly parsing logic. The parsing processor sends parsed packets to a network processor unit for further processing.

Abstract: The present invention provides a packet processing device and method. A parsing processor provides instruction-driven content inspection of network packets at 10-Gbps and above with a parsing engine that executes parsing instructions. A flow state unit maintains statefulness of packet flows to allow content inspection across several related network packets. A state-graph unit traces state-graph nodes to keyword indications and/or parsing instructions. The parsing instructions can be derived from a high-level application to emulate user-friendly parsing logic. The parsing processor sends parsed packets to a network processor unit for further processing.

Abstract: A framework may be used for generating URL signatures to identify botnet spam and membership. The framework may take a set of unlabeled emails as input that are grouped based on URLs contained within the emails. The framework may return a set of spam URL signatures and a list of corresponding botnet host IP addresses by analyzing the URLs within the emails that are contained within the groups. Each URL signature may be in the form of either a complete URL string or a URL regular expression. The signatures may be used to identify spam emails launched from botnets, while the knowledge of botnet host identities can help filter other spam emails also sent by them.

Abstract: Advertising slots on a search engine results page may be determined based on keywords and/or results to a user query. Advertisers may use the keywords and/or the results to the query to place their ads into the advertising slots. Rules may be applied to determine how ads are displayed or not displayed. For example, a larger set of keywords may be inferred from the initial set of keywords on which the ad provider placed her bids. This greatly increases the potential reach of an advertiser's ad campaign or a search engine provider's revenue from ad placement.

Abstract: A summary of the neighborhood of a page may be determined offline and used at query time to approximate the neighborhood graph of the result set and to compute scores using the approximate neighborhood graph. The summary of the neighborhood graph may include a Bloom filter containing a limited size subset of ancestors or descendants of the page. A web page identifier may also be included in the summary. Consistent sampling is used, where a consistent unbiased sample of a number of elements from the set is determined. At query time, given a result set, the summaries for all the results may be used to create a cover set. An approximate neighborhood graph consisting of the vertices in the cover set is created. Ranking technique scores may be determined based on the approximate neighborhood graph.

Abstract: The present invention provides a packet processing device and method. A parsing processor provides instruction-driven content inspection of network packets at 10-Gbps and above with a parsing engine that executes parsing instructions. A flow state unit maintains statefulness of packet flows to allow content inspection across several related network packets. A state-graph unit traces state-graph nodes to keyword indications and/or parsing instructions. The parsing instructions can be derived from a high-level application to emulate user-friendly parsing logic. The parsing processor sends parsed packets to a network processor unit for further processing.