Abstract: A system includes a processor and a memory coupled with and readable by the processor and storing therein a set of instructions. When executed by the processor, the processor is caused to receive application events associated with an application and create data records based on the application events. The processor is further caused to compute an interestingness value for each of the data records based on a goal of the application, assign the computed interestingness value to each of the data records and store each of the data records with the assigned interestingness value.

Abstract: A request to load an application into memory for execution is received. The application is stored in one or more blocks in a blockchain. The application is validated by running a blockchain hash. In response to validating the application by running the blockchain hash, the application is loaded from the blockchain into a memory. The application is then executed in the memory. This provides a secure method of loading an application into memory.

Abstract: A computing device includes a processor and a medium storing instructions. The instructions are executable by the processor to: receive a database query for an approximate aggregation of a numerical value of a plurality of records, wherein each record includes the numerical value and a filter value; in response to the database query, determine a count of records that have filter values within an importance threshold associated with the database query; and determine the approximate aggregation of the numerical value based on the count of records and the importance threshold associated with the database query.

Abstract: A computing device includes a processor and a medium storing instructions. The instructions are executable by the processor to: receive a database query for an approximate aggregation of a numerical value of a plurality of records, wherein each record includes the numerical value and a filter value; in response to the database query, determine a count of records that have filter values within an importance threshold associated with the database query; and determine the approximate aggregation of the numerical value based on the count of records and the importance threshold associated with the database query.

Abstract: The systems and methods described herein, given a population of entities each with associated information technology (IT) security risk scores, computes an aggregate risk score which quantifies the overall risk of the population. The method works for any arbitrary population of any size, and of any combination of different entity types and results in normalized risk scores for the arbitrary population (i.e. in the [0,1] range, regardless of population size or makeup). Since the risk scores are normalized, it affords comparison across different arbitrary entity populations having different combinations of entity types (e.g. users, servers, and printers). The aggregation technique allows for sensitivity to small numbers of high risk entities, which is a highly desirable characteristic for risk-based applications, and allows for sensitivity to different entity types or other relevant factors such as higher risk users, different threat types.

Abstract: Humans as well as non-human actors may interact with computer devices on a computer network. As described herein, it is possible to train and apply human vs. non-human detection models to provide an indication of the probability that a human or a non-human actor was interacting with a computer device during a particular time period. The probability that a human or non-human was interacting with computers during a particular time may be used to improve various actions, including selecting one or more different threat detection models to apply during the particular time, selecting data to use with threat detection models during the time, or selecting data from the particular time to store.

Abstract: The present invention provides a method, system and computer program product for analyzing risks, for example associated with potential data leakage. Risk for activities may be measured as a function of risk components related to: persons involved in the activity; sensitivity of data at risk; endpoint receiving data at risk; and type the activity. Risk may account for the probability of a leakage event given an activity as well as a risk cost which reflects the above risk components. Manually and/or automatically tuned parameters may be used to affect the risk calculation. Risk associated with persons and/or files may be obtained by: initializing risk scores of persons or files based on a rule set; adjusting the risk scores in response to ongoing monitoring of events; identifying commonalities across persons or files; and propagating risk scores based on the commonalities.

Abstract: An illustrative embodiment of a computer-implemented method for predictive analytic queries includes creating a user-defined predictive analytics query using a set of syntactic grammar that defines a correct syntax of the user-defined predictive analytics query including a created set of predictive analytics by-example vocabularies and a set of subject-specific by-example vocabularies forming a set of by-example vocabularies, wherein the set of syntactic grammar defines semantics of each syntactically correct predictive analytics query using the by-example vocabularies such that predictive analytics queries can be expressed with semantic precision using this constrained Natural Language Processing (cNLP) approach. The computer-implemented method further generates a predictive analytic model and runtime query, using the user-defined predictive analytics query, executes the runtime query using the predictive analytic model to create a result, and returns the result to the user.

Abstract: An illustrative embodiment of a computer-implemented method for predictive analytic queries includes creating a user-defined predictive analytics query using a set of syntactic grammar that defines a correct syntax of the user-defined predictive analytics query including a created set of predictive analytics by-example vocabularies and a set of subject-specific by-example vocabularies forming a set of by-example vocabularies, wherein the set of syntactic grammar defines semantics of each syntactically correct predictive analytics query using the by-example vocabularies such that predictive analytics queries can be expressed with semantic precision using this constrained Natural Language Processing (cNLP) approach. The computer-implemented method further generates a predictive analytic model and runtime query, using the user-defined predictive analytics query, executes the runtime query using the predictive analytic model to create a result, and returns the result to the user.

Abstract: An interactive system for visualizing business data organized according to the dimensional model allows to combine data from more than one data source and present the data in the form of a graphical, multi-metric data visualization. The visualizations are hierarchically structured and built from visualization elements including, in ascending order of hierarchy, charts, panels, scenes and sheets. The system provides a large variety of two- and three-dimensional visualization elements, mostly predefined charts, which can be combined in any number into fully customized visualizations. In a preferred embodiment, a visualization is built by the system, which prompts the user to select data sources, data items to be visualized, and certain features of the presentation layout.

Abstract: A method of rendering screen of a computer display device under conditions requiring frequent repainting of the screen is disclosed. The display is a part of a computer system running an application under control of an operating system. The application detects the onset of conditions requiring frequent repainting of the screen by checking messages sent by the operating system to the application's message queue. The application then starts the repainting of the screen based on the information retrieved from the queue while checking periodically the message queue to see if the originally detected conditions still apply. If this is the case, the application terminates the original repainting operation and starts a new repainting operation based on the updated information retrieved from the message queue. This cycle is repeated until it is determined that the originally detected conditions no longer apply, in which case a final complete repaint of the screen takes place.

Abstract: An interactive system for visualizing business data organized according to the dimensional model allows to combine data from more than one data source and present the data in the form of a graphical, multi-metric data visualization. The visualizations are hierarchically structured and built from visualization elements including, in ascending order of hierarchy, charts, panels, scenes and sheets. The system provides a large variety of two- and three-dimensional visualization elements, mostly predefined charts, which can be combined in any number into fully customized visualizations. In a preferred embodiment, a visualization is built by the system, which prompts the user to select data sources, data items to be visualized, and certain features of the presentation layout.

Abstract: A method of rendering screen of a computer display device under conditions requiring frequent repainting of the screen is disclosed. The display is a part of a computer system running an application under control of an operating system. The application detects the onset of conditions requiring frequent repainting of the screen by checking messages sent by the operating system to the application's message queue. The application then starts the repainting of the screen based on the information retrieved from the queue while checking periodically the message queue to see if the originally detected conditions still apply. If this is the case, the application terminates the original repainting operation and starts a new repainting operation based on the updated information retrieved from the message queue. This cycle is repeated until it is determined that the originally detected conditions no longer apply, in which case a final complete repaint of the screen takes place.