Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: A method of detecting and responding to anomalous activity within a system involves generating a two-dimensional graphical image of a first dimension and a second dimension, and wherein the first dimension corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the second dimension, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and when a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.

Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: A method for caching and deduplicating a plurality of received segments of data is disclosed. The method comprises identifying a value of a first data field in each segment acting as a unique source identifier; and identifying a value of a second data field in each segment, the second data field being densely populated by values in the plurality of segments. The value of the second data field is partitioned into a first partition comprising more significant bits and a second partition comprising less significant bits. A key is generated based on values of the first data field and the first partition. A database entry associates the first key with a bitmap, the bitmap having a length based on the number of possible values a bitmap of equal length to the second partition could validly take. Single bits of the bitmap are set corresponding to received segments, to enable deduplication.

Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Abstract: A method for caching and deduplicating a plurality of received segments of data is disclosed. The method comprises identifying a value of a first data field in each segment acting as a unique source identifier; and identifying a value of a second data field in each segment, the second data field being densely populated by values in the plurality of segments. The value of the second data field is partitioned into a first partition comprising more significant bits and a second partition comprising less significant bits. A key is generated based on values of the first data field and the first partition. A database entry associates the first key with a bitmap, the bitmap having a length based on the number of possible values a bitmap of equal length to the second partition could validly take. Single bits of the bitmap are set corresponding to received segments, to enable deduplication.

Abstract: A method of detecting and responding to anomalous activity within a system involves generating a two-dimensional graphical image of a first dimension and a second dimension, and wherein the first dimension corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the second dimension, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and when a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.

Abstract: A method of detecting and responding to anomalous activity within a system involves, based upon pivot feature information, for a snapshot interval, generating a frequency structure interrelating a pivot feature, a binning feature and counts, using the frequency structure, generating a graphical image of a pre-specified width and height in pixels, and wherein the pre-specified width corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the pre-specified height, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and if a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.

Abstract: A method of detecting and responding to anomalous activity within a system involves, based upon pivot feature information, for a snapshot interval, generating a frequency structure interrelating a pivot feature, a binning feature and counts, using the frequency structure, generating a graphical image of a pre-specified width and height in pixels, and wherein the pre-specified width corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the pre-specified height, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and if a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.