Abstract: A method for determining the significance of a document, or a portion thereof, is disclosed. Accordingly a search engine, or some other application, analyzes user associated content portions of a document to determine a relevance score for the document (e.g. Curation Rank). The particular algorithm for determining the relevance score will vary depending upon the particular implementation, but may generally be based upon an analysis of the number and quality of user associated content portions, comments, ratings of the user's themselves, and the ratings of users contributing to interactions (e.g. sharing) with the content portions. Based on this analysis, the document is assigned a relevance score which is used for ranking the document in accordance with instructions associated with a search query. E.g. the document relevance score may be used in selecting and ordering documents returned in search results for a particular search query.

Abstract: A method, system, and program for enabling a user to select at least one portion of content in a currently displayed internet document in a web browser is disclosed. Search technologies are applied based upon portions of a web page, and highlights are generated on the fly on matching portions of content. The selection, searching and highlighting functionalities are enabled for the user without requiring the user to download and/or install custom software.

Abstract: This invention discloses the creation of widgets that display portions of content. Using the teachings from this invention: an entity can create a widget to be programmatically embedded on any kind of a computing device such as a personal computer, or a mobile device. The widget is personalized for each individual user—both in appearance and in content. Users can choose which portions of content they want to see in their widget. Furthermore, the widget has the additional ability to be dynamically updated: including the ability to display content that had not even been created at the time of creation of the widget itself. Amongst other things—with embedded links in the widget, it is an attractive mechanism for content publishers to have ongoing engagement with users; and a powerful way for users to selectively and quickly view portions of content that they are most interested in.

Abstract: A method, apparatus, and system for enabling a user to selectively make one or more highlights in a currently displayed document on a mobile, handheld, eBook reader, or similar device are disclosed. The user-generated highlights are persistent over user-initiated cursor control activities as well as persistent over reading sessions. Furthermore, the highlighting functionality can be invoked without downloading and installing any custom software components, and without explicitly generating a user account.

Abstract: Managing a network environment to identify spoofed packets is disclosed. A method includes analyzing, via a first capture agent, packets processed by a first environment in a network associated with a first host, and analyzing, via a second capture agent, packets processed by a second environment in the network associated with a second host. The method includes collecting the first data and the second data at a collector and generating a topological map of the network and a history of network activity associated with the first environment and the second environment. The method includes extracting network data from a packet and comparing the extracted network data with stored network data in the database. When the comparison indicates that the extracted network data does not match the stored network data (i.e., the reported source does not match an expected source for the packet), determining that the packet is a spoofed packet.

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: An example method can include choosing a pattern or patterns of network traffic. This pattern can be representative of a certain type of traffic such as an attack. The pattern can be associated with various components of a network and can describe expected behavior of these various components. A system performing this method can then choose a nodes or nodes to generate traffic according to the pattern and send an instruction accordingly. After this synthetic traffic is generated, the system can compare the behavior of the components with the expected behavior. An alert can then be created to notify an administrator or otherwise remedy any problems.

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed outside of the first host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that a hidden process exists and corrective action can be taken.

Abstract: A network analytics system can receive first sensor data, including first network activity and a first timestamp associated with a first clock of a first node, and second sensor data, including second network activity and a second timestamp associated with a second clock of a second node. The system can determine a first delta between the first clock and a third clock based on the first timestamp, and a second delta between the second clock and the third clock. The system can determine a first communication latency associated with a first sensor of the first node, and a second communication latency associated with a second sensor of the second node. The system can generate a report that synchronizes one or more data flows between the first node and the second node based on the first delta, the second delta, the first communication latency, and the second communication latency.

Abstract: An example method can include choosing a pattern or patterns of network traffic. This pattern can be representative of a certain type of traffic such as an attack. The pattern can be associated with various components of a network and can describe expected behavior of these various components. A system performing this method can then choose a nodes or nodes to generate traffic according to the pattern and send an instruction accordingly. After this synthetic traffic is generated, the system can compare the behavior of the components with the expected behavior. An alert can then be created to notify an administrator or otherwise remedy any problems.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: A system and method enable exploration of cold ads in an online information system. Cold ads are ads that are new to the system and do not yet have reliable click through rate (CTR) estimates or click probabilities. The method and system selectively boost the click probabilities of cold ads to increase their likelihood of participating in and winning an auction so that the cold ad get more impressions, but without adversely affecting revenue in a production environment when cold ads are introduced.

Abstract: Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.

Abstract: One or more computing devices, systems, and/or methods for transmitting content items using search history profiles are provided. For example, a first request to access a web page may be received. The first request may be associated with a device. The first request may be analyzed to determine a query. The query may be stored in a search history profile associated with the device. The search history profile may comprise indications of a plurality of queries. A second request for content may be received from a second device associated with the search history profile. Responsive to receiving the second request, a content item may be selected from a content items database based upon the query. The content item may be transmitted to the second device. The device may be the same as the second device. Alternatively and/or additionally, the device may be different than the second device.

Abstract: The technologies described herein identify multiple electronic devices belonging to the same group. A computer system receives, from network accessing applications of a plurality of electronic devices, internet protocol (IP) trajectory information about the network accessing applications via a network. The IP trajectory information includes a user identifier, a list of IP addresses associated with each of the network accessing applications, and timestamps specifying times each of the network accessing applications accesses the network. The computer system identifies and removes commercial IP addresses from the list of IP addresses, analyzes IP trajectory information to retrieve a most commonly used IP address for each of the network accessing applications during a certain period, and determines that different network accessing applications belong to the same group if the most commonly used IP addresses for the different network accessing applications are the same.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed outside of the first host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that a hidden process exists and corrective action can be taken.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

Abstract: Systems, methods, and non-transitory computer-readable storage media for synchronizing timestamps of a sensor report to the clock of a device. In one embodiment, the device receives a report from a sensor of a node. The report can include a network activity of the node captured by the sensor and a first timestamp relative to the clock of the node. The device can then determine a second timestamp relative to the clock of the collector indicating receipt of the report by the device and from the sensor at the node. The device can also determine a delta between the first timestamp and the second timestamp, and a communication latency associated with a communication channel between the device and the sensor. Next, the device can adjust the delta based on the communication latency, and generate a third timestamp based on the adjusted delta.