Abstract: Techniques for generating query language statements for a document repository are described herein. An example method includes detecting a search query corresponding to a document repository and generating a modified search query by adding atomic tags to the search query, the atomic tags being based on prior knowledge obtained by static analysis of the document repository and semantic rules. The method also includes generating enriched tags based on combinations of the atomic tags and any previously identified enriched tags and generating a first set of conditions based on combinations of the atomic tags and the generated enriched tags and generating a second set of conditions based on free-text conditions. The method also includes generating the query language statements based on the first set of conditions and the second set of conditions and displaying a plurality of documents from the document repository that satisfy the query language statements.

Abstract: System and techniques for activity sensing online preference assay are described herein. An initial indication of an online activity preference for a member of a social network service may be obtained. A plurality of member activities corresponding with the online activity preference for a period of time subsequent to obtaining the initial indication may be collected. Respective decision trees of a set of decision trees may be traversed based on a set of inputs comprising the collected plurality of member activities to determine a probability that the online activity preference corresponds with the member. An actual online activity preference may be derived for the member using an aggregation of the determined probability for the respective decision trees of the set of decision trees. Social network content items may be filtered for the member based on the actual online activity preference.

Abstract: There is provided an information processing apparatus including a page switching unit for switching a display screen from a first Web page screen displayed on a display unit to a second Web page screen, and a switching information notification unit for notifying a page switching information on a notification screen before the second Web page screen is displayed while switching between the pages by the page switching unit, the page switching information is based on information included in at least the second Web page of the first and second Web pages, and the notification screen is a different screen from the first Web page.

Abstract: The disclosed embodiments provide a system for updating an index structure of a graph database storing a graph. During operation, the system includes, in the index structure, a first compressed edge store containing a first compact representation of edges in the graph at a first virtual time and a first series of updates to the edges after the first virtual time. At a second virtual time, the system creates a second compact representation of the edges from the first compact representation and the first series of updates. The system then appends, to the second compact representation, a second series of updates to the edges after the second virtual time to produce a second compressed edge store. Finally, the system updates the index structure by atomically replacing, in the index structure, a reference to the first compressed edge store with a reference to the second compressed edge store.

Abstract: Aspects of the disclosure will be described with regard to the processing of DNS queries by a DNS service based on multiple network addresses associated with a single network entity (e.g., a service provider). The DNS service may respond to each DNS query for identifying network addresses associated with the service provider with a respective unique network address from a pool of network addresses. Based on the uniqueness of network addresses, DNS queries and subsequent communications between respective client computing devices and the service can be correlated.

Abstract: A system and a method are disclosed for simulating a target system. The target system may include a plurality of components coupled via a communication bus. Each component of the target system may include a model algorithm representing the internal behavior of the component, and a model interface configured to transfer and/or receive communication payloads to/from a peer component in the target system. During simulation initialization, a simulation model of a component of the target system is accessed and a protocol engine, associated with a bus communication protocol is selected to be attached to the simulation model of the accessed component. Then, during the simulation of the target system, the model interface receives an incoming payload and informs the protocol engine of the received payload. The protocol engine may instruct the model algorithm of the component to perform a protocol specific action based on the received payload.

Abstract: A failure-effect validation system includes an effects modeler configured to develop a cumulative effects model for failure modes of the complex system, and by which a model of the complex system is extendible to form an extended complex-system model. The effects modeler is also configured to develop search targets each of which includes logical expressions of notable hazards and other factors that contribute to the cumulative effects, such as crew workload, safety margin and/or physiological effects. A model analysis system is configured to perform an automated analysis using the extended complex-system model and search targets, and in which the automated analysis includes a graph search of possible states of the extended complex-system model to locate search targets. And the effects assessment system is configured to selectively generate a layout of failure analysis data including at least a portion of the extended complex-system model and results of the automated analysis.

Abstract: A method of Computational Fluid Dynamics CFD simulation for a product including a plurality of individual components, the method comprising creating a library of known components, including their component geometry and modeling properties needed for simulation, the components being individually meshed within the library; using a graphical user interface GUI to select and place a plurality of components from the library in a desired configuration to make up a CFD model of a product; and CFD simulating the model by scheduling a plurality of solvers, each solver modeling a component group comprising part or all of at least one component, to manage the time of action of the solvers and data exchange between the solvers.

Abstract: An apparatus for simulating a wind power farm includes a wind power generator simulator configured to act as a virtual wind power generator to dynamically generate an attribute value and provide the attribute value to a supervisory control and data acquisition (SCADA) system to be tested; a wind power generator simulation platform configured to generate and manage a plurality of wind power generator simulators within one system, monitor the system, monitor operation states of the plurality of wind power generator simulators, and transmit a result of monitoring the operation states; and a wind power farm controller configured to generate a wind power farm by grouping a plurality of wind power generator simulation platforms into a single cluster, and manage a simulation environment of the wind power farm.

Abstract: A modeling framework for evaluating the impact of weather conditions on farming and harvest operations applies real-time, field-level weather data and forecasts of meteorological and climatological conditions together with user-provided and/or observed feedback of a present state of a harvest-related condition to agronomic models and to generate a plurality of harvest advisory outputs for precision agriculture. A harvest advisory model simulates and predicts the impacts of this weather information and user-provided and/or observed feedback in one or more physical, empirical, or artificial intelligence models of precision agriculture to analyze crops, plants, soils, and resulting agricultural commodities, and provides harvest advisory outputs to a diagnostic support tool for users to enhance farming and harvest decision-making, whether by providing pre-, post-, or in situ-harvest operations and crop analyses.

Abstract: A model generating device for generating model data regarding an operation state of a target object to be controlled, includes a memory and a processor coupled to the memory and configured to acquire first measurement data regarding the operation state of the target object under each of a plurality of measurement conditions set in a first sequence, acquire second measurement data regarding the operation state of the target object under each of the plurality of measurement conditions set in a second sequence different from the first sequence, estimate third measurement data indicating the operation state in a case where the target object enters a steady state in each of the plurality of measurement conditions, based on the first measurement data and the second measurement data, generate the model data regarding the operation state of the target object based on the third measurement data, and output the model data.

Abstract: A method for determining an electromigration effect in an integrated circuit model with multiple parallel processors is provided. The method includes receiving, in a partition scheduler, a circuit netlist divided into smaller partition netlists in a partition scheduler and scheduling a computational thread including tasks associated with a first partition netlist, and verifying that at least one task in the first computational thread has been executed by at least one computer selected from a network of computers. The method also includes releasing the computer and resetting a status of the computer, converting a result from the at least one task to an input file for another computational thread associated with a second partition netlist, the result including an induced current in the circuit component of the first partition netlist. The method includes determining electromigration effects on the circuit component in the partition netlists based on the induced current.

Abstract: A compensating initialization module may be automatically inserted into a design to compensate for register retiming which changes the designs behavior under reset. The device configuration circuitry may provide an adjustment sequence length as well as a start signal to the initialization module to properly reset the retimed user logic implemented on the integrated circuit after initial configuration and unfreezing of the integrated circuit. The auto initialization module may control the c-cycle initialization process and indicate to the user logic when c-cycle initialization has completed. The user logic may subsequently begin a user-specified reset sequence. When the user-specified reset sequence ends, the user logic implemented on the integrated circuit may begin normal operations. Additionally, a user reset request may also trigger the auto initialization module to begin a reset process.

Abstract: Circuitry for an efficient configuration data management is presented. The circuitry includes an encoding circuit that compares configuration data of a circuit design with base configuration data of a base circuit design. The encoding circuit compresses a difference between the configuration data and the base configuration data to produce compressed configuration data. The compressed configuration data can be stored in a storage circuit. For a purpose of implementing the circuit design in an integrated circuit, a decoding circuit can retrieve the compressed configuration data from the storage circuit, decompress the compressed configuration data, and compare a result of the decompression operation with the base configuration data to restore the configuration data. The restored configuration data can serve to program configuration memory bits on the integrated circuit, thereby implementing the circuit design.

Abstract: Devices, systems, and methods are disclosed that are configured to execute functions using synthesized parallel stateless asynchronous flowcharts. The flowcharts include one or more test objects, action objects, and/or task objects. Each of the objects in the flowcharts to be executed sets out an atomic path, which is a sequence of functions with one or more elements. The disclosed processing circuits are configured to execute the functions/instructions set forth in the flowcharts by following each atomic path. In some embodiments, the processing circuits execute the one or more flowcharts in an order determined during processing (i.e., “on the fly”). In these and other embodiments, the disclosed processing circuits transform or restore elements of the one or more flowcharts with or without human intervention.

Abstract: Systems and methods are provided for identifying a wire of a plurality of wires to be adjusted to mitigate effects of electromigration. A method includes identifying a plurality of wires of a circuit, each wire comprising a one or more wire segments. An electromigration stress is determined for each wire path of each wire, a wire path being made up of one or more wire segments. For each wire, a highest determined electromigration stress is assigned for wire paths of that wire as the wire electromigration stress for that wire. An identification of the wire having the highest wire electromigration stress is stored, where the wire having the highest wire electromigration stress is a candidate for adjustment to mitigate electromigration effects.

Abstract: A system and method for implementing a layout of passenger arrangements using previously designed configurations. A plurality of tools for implementing a layout of passenger arrangements using previously designed configurations is provided. The plurality of tools comprise a previously designed configurations identification and selection tool configured for selecting previously designed configurations to include in the layout of passenger arrangements and a previously designed configuration visualization tool for displaying a degree to which the layout of passenger arrangements comprises previously designed configurations. A tool selection user interface may be provided to receive input from an operator identifying a one of the plurality of tools to run.

Abstract: A method for producing a complex product, in particular a motor vehicle, wherein a component is constructed for the product. Data having a three-dimensional representation of the component is generated in a first data format for a first program and data having meta-information on the three-dimensional representation of the component is generated in an electronically searchable data format for a second program. Additionally, the data having the three-dimensional representation of the component in the first data format is embedded into the data in the second data format. A third program is provided for establishing communication between the first and the second program.

Abstract: A patient-specific finite element model of the cornea is generated for the purposes of modeling a cornea for simulating tissue cuts in the cornea. A first group of tissue fibers, with main fibers that extend parallel to the surface of the cornea, is distributed in the finite element model in accordance with a first distribution function. Moreover, a second group of tissue fibers, with inclined cross-linked fibers that do not extend parallel to the surface of the cornea, is distributed in the finite element model in accordance with a second distribution function. Here, the second distribution function distributes the cross-linked fibers with a non-uniform weighting function over the depth of the cornea, from the outer surface of the cornea to the inner surface of the cornea.

Abstract: The present invention provides algorithm-based molecular assays that involve measurement of expression levels of genes from a biological sample obtained from a kidney cancer patient. The present invention also provides methods of obtaining a quantitative score for a patient with kidney cancer based on measurement of expression levels of genes from a biological sample obtained from a kidney cancer patient. The genes may be grouped into functional gene subsets for calculating the quantitative score and the gene subsets may be weighted according to their contribution to cancer recurrence.

Abstract: The invention provides a molecular marker set that can be used for prognosis of colorectal cancer in a colorectal cancer patient. The invention also provides methods and computer systems for evaluating prognosis of colorectal cancer in a colorectal cancer patient based on the molecular marker set. The invention also provides methods and computer systems for determining chemotherapy for a colorectal cancer patient and for enrolling patients in clinical trials.

Abstract: A genetic surveillance system comprises a communications network and at least one reader-analyzer instrument. The reader-analyzer instrument has a communication interface to communicate over the network. The reader-analyzer instrument is adapted to perform genetic assay analysis of a sample obtained from a member of a population and to generate detection-related data based upon the analysis. The reader-analyzer instrument is adapted to associate qualifying information with the detection-related data and to communicate the associated qualifying information and detection-related data over the network.

Abstract: In a system for distributed computing in a health care environment in which multiple different applications are in use connected on a common computer network, the improvement comprising at least one clinical exchange server on the network, the clinical exchange server including memory, the clinical exchange server programmed to perform the steps of (i) maintaining a separate patient record for each of a plurality of patients wherein each patient record includes an event registry including separate event data subsets for each event recorded by any of the different applications where each event data subset indicates the application that recorded the event and event summary data wherein the event summary data is less than all of the data recorded by the application that recorded the event, (ii) receiving a first query from the first application for patient information associated with a first patient where the first query includes information usable to identify an event in the event registry, (iii) using the info

Abstract: Systems and methods for data analysis include constructing patient traces as a set of medical events for each patient of a patient population, the patient population being segmented based on patient outcomes. Medical events in one or more of the patient traces are reduced to provide processed patient traces. The processed patient traces are clustered to identify a cluster of patient traces. A process model is mined, using a processor, representing an aggregation of treatment pathways in the patient traces from the cluster. Patterns from patient traces are identified that are discriminative of patient outcomes. At least one of the patterns is represented with respect to the process model to identify treatment pathways correlated with the patient outcomes.

Abstract: A pill dispensing system includes an electronic mobile communication device with a wireless transmitter and receiver. A pill cartridge has a cartridge body storing a plurality of pills, where the cartridge body includes an electronic tag storing data. A pill cartridge dispenser is configured to receive at least one of the pill cartridge and configured to electromechanically control dispensing of the plurality of pills from the cartridge body, where the pill cartridge dispenser is configured to be in wireless communication with the electronic mobile communication device. The electronic mobile communication device is configured to wirelessly read the data stored on the electronic tag or wherein the pill cartridge dispenser is configured to wirelessly read the data stored on the electronic tag. The electronic mobile communication device wirelessly communicates with the pill cartridge dispenser to dispense at least one pill from the plurality of pills within the pill cartridge.

Abstract: An apparatus for automated storage and dispensing of medications. Medications are stored in an inventory storage container attached to a frame of the apparatus. Medications are delivered to the apparatus via a locked delivery container. A carrier mechanism retrieves medications from the inventory storage container and delivery container and moves medications to various subsystems of the apparatus. Information related to medications is communicated to a remote pharmacist prior to dispensing the medication. Multiple installations of the apparatus are centrally coordinated.

Abstract: A processor receives a first list comprising a plurality of events from a portion of digital data of an unknown work and one or more metrics between each pair of adjacent events from the plurality of events. The processor compares the first list to a second list comprising events and metrics between events for a known work to determine a first quantity of hits and a second quantity of misses. The processor determines whether the first list matches the second list based on the first quantity of hits and the second quantity of misses. The processor determines that the unknown work is a copy of the known work responsive to determining that the first list matches the second list.

Abstract: An information processing device includes an identification part configured to, in response to a user's operation to start any given one of a plurality of first application programs, determine whether the start of the one of the first application programs is allowed; and a request part configured to request the one of the first application programs to display a first screen which indicates the start of the one of the first application programs is not allowed when the identification part determines that the start of the one of the first application programs is not allowed, and request a second application program to display a second screen including a message when the identification part determines that the start of the one of the first application programs is allowed and when the message needs to be given.

Abstract: A device can include a processor; memory operatively coupled to the processor; a touchscreen display operatively coupled to the processor; a sensor operatively coupled to the processor; and instructions stored in the memory and executable by the processor to render targets to the touchscreen display, receive, via the touchscreen display, pattern information associated with the targets, receive sensor information via the sensor, and transition the device from a locked state to an unlocked state based at least in part on stored pattern information, the received pattern information and the received sensor information.

Abstract: Peroxisome proliferator activated receptor (PPAR) compounds, and methods of using the same for treating bone fractures, treating osteoporosis and/or metabolic bone diseases, and inducing osteogenesis and/or chondrogenesis, are disclosed.

Abstract: A privacy compliance monitoring system, according to particular embodiments, is configured to track a user's system inputs and responses to questions regarding a particular privacy campaign in order to monitor any potential abnormal or misleading response. In various embodiments, the system is configured to track changes to a user's responses, monitor an amount of time it takes a user to respond, determine a number of times that a user changes a response and/take other actions to determine whether a particular response may be abnormal. In various embodiments, the system is configured to automatically flag one or more questions based on determining that the user may have provided an abnormal response.

Abstract: A system receives a source and a metadata layer that describes the source. The source may comprise source records with fields containing source data, and the metadata layer may include metadata comprising at least one of a field data type, a field data length, a field description, or a record length. The processor may further validate the metadata layer against the source and write results to a log. The processor may further be configured for transforming the source records into transformed records for a load ready file. The processor may further balance a number of records in the source against a number of transformed records in the load ready file to generate a transformation failure rate.

Abstract: A method and apparatus for capacitive off-wrist detection for wearable device are disclosed. In one aspect, the wearable device includes one or more biometric sensors including a capacitive sensor. The method may involve measuring, based on output of the capacitive sensor, a capacitance value indicative of proximity of the wearable device to a user. The method may also involve detecting a change in the capacitance value within a defined time interval, the change being greater than or equal to a threshold change indicative of the wearable device not being proximate to the user's skin. The method may further involve determining that the wearable device has been removed from the user in response to detecting that the change in the capacitance value within the defined time interval is greater than or equal to the threshold change.

Abstract: A system for automating a data device login procedure having a network, a system backend communicable with the network having a backend processor configured to control a simplified login procedure and a database of login information accessible by the backend processor, a data reader communicable with the system backend configured to receive a credential data from an identification device, and a fungible portable data device communicable with the backend configured to receive a login information from the system backend for completing a login procedure. The data reader is configured to initiate the login procedure upon receipt of the credential data from the identification device and communicate the credential data to the backend. The backend is configured to determine the login information associated with the credential data comprising personalization information for the fungible portable data device and the system backend completes the login procedure to the fungible portable data device.

Abstract: A verification method includes displaying a selected pattern set on a display device electrically connected with a user apparatus. One of a first selected pattern and a second selected pattern as an as-selected pattern is selected. The as-selected pattern is used as a first target pattern, and the other is used as a second target pattern. A match object area and a target object area on the display device are displayed. The selected pattern is displayed in the match object area, and the first and second object patterns are displayed in the target object area. A user operates the user apparatus or a connected wearable device to control and select the as-selected pattern in the match object area on the display device or on another display device. When the as-selected pattern conforms to the first object pattern, the verification is finished.

Abstract: The present disclosure discloses a method, a device, and a system for updating authenticating information in the field of Internet technologies. The method comprises: receiving a service processing request containing user information and service object information; extracting according to the user information, first authentication information associated with the service object information from prestored authentication information; authenticating the first authentication information; displaying an information update interface when the first authentication information fails to be authenticated; obtaining second authentication information from the information update interface; replacing the first authentication information with the second authentication information; authenticating the second authentication information; and processing the service processing request if the second authentication information is authenticated.

Abstract: A method performed by a computing system includes receiving from a publishing entity a message and a first piece of evidence that the message was sent by the publishing entity, time-stamping the first piece of evidence, storing the time-stamped first piece of evidence, sending the message to a first subscribing entity, receiving from the first subscribing entity a second piece of evidence that the message was received by the first subscribing entity, time-stamping the second piece of evidence, and storing the time-stamped second piece of evidence.

Abstract: Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack.

Abstract: Embodiments of an invention for an interface between a device and a secure processing environment are disclosed. In one embodiment, a system includes a processor, a device, and an interface plug-in. The processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to create a secure processing environment. The execution unit is to execute an application in the secure processing environment. The device is to execute a workload for the application. The interface plug-in is to provide an interface for the device to enter the secure processing environment to execute the workload.

Abstract: An apparatus and method for generating an application container are provided. The method includes selecting a target application from among a plurality of applications included in an electronic device, acquiring a policy file corresponding to the target application, determining whether the policy file includes a category of the target application, and executing the application container which includes the target application.

Abstract: A method for hardening in the field code of mobile software applications is described that includes receiving, by a cloud service framework, an application via a user interface over a network. The method also includes generating, by the cloud service framework, a representation of the code of the application and determining, by the cloud service framework, changes to code of the application based at least in part on the representation, wherein the changes to the code preclude the application from performing one or more unwanted behaviors. The method also includes instrumenting, by a static instrumentation unit within the cloud service framework, the application with the changes to the code to create an instrumented application that does not perform the one or more unwanted behaviors.

Abstract: Disclosed herein are methods, systems, and computer-readable media for blocking attempts at runtime redirection and attempts to change memory permissions during runtime. The present disclosure describes features that enable runtime detection of an attempt to redirect routines or change memory permissions, and determining whether to allow or deny the attempt. Such features may include changing memory write permissions on memory segments, such as those segments used by dynamic loaders after call associations have been saved or otherwise created. Other features may include swapping the addresses of system routines (e.g., open, read, write, close, etc.) to new routines that perform the same function as well as additional functionality configured to detect attempts to redirect or change memory permissions. Once detected by the new routine during runtime, a determination may be made to deny or allow the call based on a policy.

Abstract: A cloud controller performs, when an attack on a VM in any of data centers in a system is detected, setting of NAT of a private IP address of a VM(A), for a boundary router of each data center other than a data center that the VM(A) belongs to, the VM(A) being a victim. Next, the cloud controller performs setting for a redirecting device in the same data center as the VM(A), such that the redirecting device redirects access from a user terminal to a host under a boundary router of any of the respective data centers other than the data center. Thereafter, the cloud controller changes a private IP address of the VM(A) in a NAT setting of a boundary router of the data center to a private IP address of the redirecting device.

Abstract: Systems and methods include: collecting digital event data for the digital account; using a trained machine learning model to extract account takeover (ATO) risk features from the collected digital event data; evaluating the extracted ATO risk features of the collected digital event data of the digital account against a plurality of ATO risk heuristics; identifying one or more of the plurality of ATO risk heuristics that is triggered by the extracted ATO risk features, wherein one or more of the plurality of ATO risk heuristics may be triggered if at least a subset of the extracted ATO risk features matches requirements of the one or more ATO risk heuristics; and generating an ATO risk assessment for the digital account using the one or more triggered ATO risk heuristics.

Abstract: An approach is provided for providing an offline malware detection, and in addition a real-time malware detection. The offline malware detection may comprise: detecting at least one of function calling map of the application offline, wherein a function calling map records relationships of callings among functions called by the application; extracting patterns of the function callings of the application from the at least one function calling map; and comparing the extracted pattern with at least one basic pattern of normal applications. The real-time malware detection may comprises: running an application in a real environment; recording behaviors of the application at runtime of the application; extracting behavior patterns from the recorded behaviors; and comparing the extracted behavior patterns with at least one of basic patterns of normal applications or patterns previously recorded for the application.

Abstract: A virtual machine transmits local files to a secure virtual machine hosted by a hypervisor for malware detection. When malware is detected, the secure virtual machine can responsively provide remediation code to the virtual machine on a temporary basis so that the virtual machine can perform suitable remediation without a permanent increase in size of the virtual machine.

Abstract: A system and method for .Net PE files malware detection is provided. The method may include accessing two or more portable executable (PE) files and detecting at least one identical global user identifier (GUID) attribute. In response to finding identical GUID attributes, the method may include clustering a group of files into family clusters each having the same GUID attribute. The method may generate and release a signature for the family cluster. An exoneration criteria level may be set in accordance with matching characteristics associated with an acceptable software standard for the computing system or network, such that when the exoneration criteria level is reached, the PE file is exonerated from being associated with PUA or malware. Until this criterion is met, the PE file will be identified as PUA or malware. Additional GUID attributes may be identified as further proof that the PE file is polymorphic.

Abstract: A method includes a unified extensible firmware interface of a compute node identifying an option ROM or an OS boot loader within the compute node, wherein the option ROM or OS boot loader stores a signed image that can be verified using a required digital certificate. The method further includes determining that the unified extensible firmware interface does not store the required digital certificate in a revocation database or in an authorization database. Still further, the method includes automatically identifying the required digital certificate in a database of digital certificates other than the revocation database or the authorization database, and providing the required digital certificate to the authorization database.

Abstract: Booting a machine in a secure fashion in a potentially unsecure environment. The method includes a target machine beginning a boot process. The method further includes the target machine determining that it needs provisioning data to continue booting. The target machine contacts a secure infrastructure to obtain the provisioning data. The target machine provides an identity claim that can be verified by the secure infrastructure. As a result of the secure infrastructure verifying the identity claim, the target machine receives a request from the secure infrastructure to establish a key sealed to the target machine. The target machine provides the established key to the secure infrastructure. The target machine receives the provisioning data from the secure infrastructure. The provisioning data is encrypted to the established key. The target machine decrypts the encrypted provisioning data, and uses the provisioning data to finish booting.

Abstract: This disclosure provides an apparatus and method for deployment assurance checks for monitoring industrial control systems and other systems. A method includes identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks. The method includes determining devices to be monitored from the plurality of connected devices. The method includes evaluating system resource usage, by the risk manager system, on each device to be monitored. The method includes providing recommendations to a user as to whether or not the user should proceed with the monitoring, based on the evaluation.