Abstract: The technologies described herein identify multiple electronic devices belonging to the same group. A computer system receives, from network accessing applications of a plurality of electronic devices, internet protocol (IP) trajectory information about the network accessing applications via a network. The IP trajectory information includes a user identifier, a list of IP addresses associated with each of the network accessing applications, and timestamps specifying times each of the network accessing applications accesses the network. The computer system identifies and removes commercial IP addresses from the list of IP addresses, analyzes IP trajectory information to retrieve a most commonly used IP address for each of the network accessing applications during a certain period, and determines that different network accessing applications belong to the same group if the most commonly used IP addresses for the different network accessing applications are the same.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. A method includes determining a lineage for a process within the network and then evaluating, through knowledge of the lineage, the source of the command that initiated the process. The method includes capturing data from a plurality of capture agents at different layers of a network, each capture agent of the plurality of capture agents configured to observe network activity at a particular location in the network, developing, based on the data, a lineage for a process associated with the network activity and, based on the lineage, identifying an anomaly within the network.

Abstract: A method for determining the significance of a document, or a portion thereof, is disclosed. Accordingly a search engine, or some other application, analyzes user associated content portions of a document to determine a relevance score for the document (e.g. Curation Rank). The particular algorithm for determining the relevance score will vary depending upon the particular implementation, but may generally be based upon an analysis of the number and quality of user associated content portions, comments, ratings of the user's themselves, and the ratings of users contributing to interactions (e.g. sharing) with the content portions. Based on this analysis, the document is assigned a relevance score which is used for ranking the document in accordance with instructions associated with a search query. E.g. the document relevance score may be used in selecting and ordering documents returned in search results for a particular search query.

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

Abstract: A method, apparatus, and system for enabling a user to selectively make one or more highlights in a currently displayed document on a mobile, handheld, eBook reader, or similar device are disclosed. The user-generated highlights are persistent over user-initiated cursor control activities as well as persistent over reading sessions. Furthermore, the highlighting functionality can be invoked without downloading and installing any custom software components, and without explicitly generating a user account.

Abstract: A method, system, and service—using conventional web browsers with no software installation—for enabling a user to select portions of content are disclosed. The user selected portions of content, or references to them, are stored in a repository and are made available for subsequent viewing to a potentially larger universe of users. Neither group: the users selecting the portions of content, nor the users viewing the previously selected portions of content, need to install any special software to avail all these benefits.

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

Abstract: A method and system for enabling the display of user selected content-portions of internet documents that have been selected by users of a content-portion selection service are disclosed. Accordingly, a content-portion selection service includes a web portal with a web page providing users with a snippet of code, which, when inserted into an internet document, causes the internet document to display selected content-portions from the content-portion selection service. The snippet of code can be configured to query the content-portion selection service for selected content-portions that were made by certain users, or, selection content-portions made on documents from certain domains, and so forth. The code associated with the user interface object displaying the selected content-portions can be configured to periodically query the content-portion selection service to retrieve up-to-date content-portion selections, thereby dynamically changing the content-portions appearing on a web page or internet document.

Abstract: A system and method enable exploration of cold ads in an online information system. Cold ads are ads that are new to the system and do not yet have reliable click through rate (CTR) estimates or click probabilities. The method and system selectively boost the click probabilities of cold ads to increase their likelihood of participating in and winning an auction so that the cold ad get more impressions, but without adversely affecting revenue in a production environment when cold ads are introduced.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: Systems, methods, and computer-readable media for collector high availability. In some embodiments, a system receives, from a first collector device, a first data report generated by a capturing agent deployed on a host system in a network. The system can also receive, from a second collector device, a second data report generated by the capturing agent deployed on the host system. The first and second data reports can include traffic data captured at the host system by the capturing agent during a period of time. The system can determine that the first data report and the second data report are both associated with the capturing agent, and identify duplicate data contained in the first data report and the second data report. The system can then deduplicate the first and second data reports to yield a deduplicated data report.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: A marketplace diagnostics framework for analyzing and managing online marketplaces.

Abstract: The technologies described herein identify multiple electronic devices belonging to the same group. A computer system receives, from network accessing applications of a plurality of electronic devices, internet protocol (IP) trajectory information about the network accessing applications via a network. The IP trajectory information includes a user identifier, a list of IP addresses associated with each of the network accessing applications, and timestamps specifying times each of the network accessing applications accesses the network. The computer system identifies and removes commercial IP addresses from the list of IP addresses, analyzes IP trajectory information to retrieve a most commonly used IP address for each of the network accessing applications during a certain period, and determines that different network accessing applications belong to the same group if the most commonly used IP addresses for the different network accessing applications are the same.

Abstract: A marketplace diagnostics framework for analyzing and managing online marketplaces.

Abstract: Systems, methods, and computer-readable media for determining sensor placement and topology. In some embodiments, a system can receive messages from sensors deployed around a network, each of the messages reporting a respective flow captured by a reporting sensor from the sensors. Next, the system can identify flows reported in the messages and, for each of the flows, generate a respective list of sensors that reported that flow. Based on the respective list of sensors, the system can infer a respective placement of the sensors within the network and a topology of the sensors. For example, the system can determine that a first sensor is deployed in a virtual machine, a second sensor is deployed in a hypervisor hosting the virtual machine, and a third sensor is deployed in a network device configured to route traffic associated with the hypervisor.

Abstract: The technologies described herein identify multiple electronic devices belonging to the same group. A computer system receives, from network accessing applications of a plurality of electronic devices, internet protocol (IP) trajectory information about the network accessing applications via a network. The IP trajectory information includes a user identifier, a list of IP addresses associated with each of the network accessing applications, and timestamps specifying times each of the network accessing applications accesses the network. The computer system identifies and removes commercial IP addresses from the list of IP addresses, analyzes IP trajectory information to retrieve a most commonly used IP address for each of the network accessing applications during a certain period, and determines that different network accessing applications belong to the same group if the most commonly used IP addresses for the different network accessing applications are the same.

Abstract: Methods and apparatus for managing file distribution between publishing and subscribing devices are provided. At a transporter system, a publish request for publishing a version of the dataset is received from a publisher device, wherein the publish request has a predefined format that includes an identity of the dataset, an identity of the version of the dataset, and an identity of a location for the version of the dataset. The transporter system updates a registry to associate the dataset with the identity of the dataset, version, and location, and the transporter system automatically publishes the dataset to any subscribers devices that have previously sent subscribe requests for such dataset to the transporter system.

Abstract: The present technology is directed to mapping flow data and overlaying it on a geographic map. Furthermore the geographical map can also display attacks and the flow of an attack from the source to a logical entity. The map additionally can be accompanied with a pie chart relating to the attacks and intensity of attacks. Normal flows can also be displayed on the map along with the attack flows.