Abstract: A method and a system for querying partitioned tables in a distributed database is disclosed. In one aspect, a method includes receiving a request to access multiple data elements, identified by record identifiers from a partitioned and distributed database table. The method further includes mapping record identifiers to partitions. The method further includes sorting the record identifiers by database node and partition. The method further includes generating, for each database node and partition, at least one statement including at least one request to access a data element stored in the corresponding partition. The method further includes responding to the request by routing the at least one statement generated for each database node and partition.

Abstract: Systems and methods are described for providing an implementation of the MapReduce programming model utilizing tasks executing on an on-demand code execution system, utilizing a stream data processing system as an intermediary between map and reduce function. A map task implementing a map function can process portions of a data set, to generate outputs associated with different values for a measured attribute of the data set. Executions of the map task can publish outputs to a data stream on the stream data processing system, which stream is configured to utilize the measured attribute as a partition key for the stream. Based on the partition key, the stream data processing system can divide the stream into sub-streams, each containing a relevant subset of the outputs. The on-demand code execution system can execute a reduce task to apply the reduce function to the outputs of each sub-stream, thereby completing the MapReduce process.

Abstract: A distributed offline indexing system uses a set of data processing systems in a distributed computing environment to create an index database that can store, for example, data about geographical or geospatial areas. The index database can be distributed across a plurality of database shards such that each shard includes an index file and a DB file. The index files include keys that refer to values in their corresponding DB files. The keys are used to look-up their corresponding values at search time. At indexing time, the keys are hashed, with an entropy creating hash, to distribute the keys across the shards.

Abstract: In one example, a method includes receiving, at a cloud storage site, chunks that each take the form of a hash of a combination that includes two or more salts and a file object, and one of the salts is a retention salt shared by the chunks, monitoring a time period associated with the retention salt, when the time period has expired, removing the chunks that include the retention salt, and depositing the removed chunks in a deleted items cloud store.

Abstract: The present disclosure relates to a method, device and computer program product for managing an address mapping of a storage system. A group of data objects in the storage system are mapped to a group of buckets in the address mapping, the group of buckets being divided into a first group of active shards which are associated with a group of storage devices in the storage system, respectively. In the method, a first write request for writing a first data object to the storage system is received. The address mapping is updated so as to map the first data object to a first bucket in the group of buckets. The storage system is instructed to store the first data object to a first storage device in the group of storage devices, and the first storage device is associated with a first active shard to which the first bucket belongs. The storage system is managed based on the updated address mapping.

Abstract: Techniques are described herein for leveraging and extending relational data sharding infrastructure to provide comprehensive support for sharding semi-structured and unstructured data, in addition to the relational data, in a single sharded database system. Specifically, techniques are described in which a catalog server pre-gathers all data it needs to answer fetches from a dynamically created temporary lob. In addition, techniques are provided in which a catalog server encodes shard identifiers in lob locators sent to the client. Techniques are provided for pushing down various operators to shard servers.

Abstract: A data analysis apparatus executes: acquiring a group of learning input data; setting a plurality of first hash functions; substituting each learning input data in each of the plurality of first hash functions to thereby calculate a plurality of first hash values; selecting, for the group of learning input data and for each of the plurality of first hash functions, a specific first hash value that satisfies a predetermined statistical condition from among the plurality of first hash values; setting a second hash function; substituting, for the group of learning input data, each specific first hash value in the second hash function to thereby calculate a plurality of second hash values; and generating a learning feature vector that indicates features of the group of learning input data by aggregating the plurality of second hash values corresponding to respective specific first hash values and obtained as a result of the calculation.

Abstract: The described technology is generally directed towards efficiently organizing data in a single, non-distributed database as an associated array of key-value pairs implemented on top of a storage medium that allows only data appends. A table segment in an append-only storage medium is accessed by table keys. The table keys are hashed into key values used to access information in an attribute index (a search tree) that contains offsets to the table segment entries. Hashing the table keys can result in a series of hash parts, including a primary hash part corresponding to a node in the attribute index, and as needed in the event of hash collisions, secondary hash parts that map to child nodes in the attribute index.

Abstract: An information processing apparatus includes a memory, a communication interface, and a processor. The memory stores therein a first code generated from data structure information describing at least one data item defined in a database. The communication interface receives a request message including a second code, which is a message requesting a data read or write operation on the database. The processor compares the first code with the second code, permits the requested data read or write operation if the first and second codes are the same, and performs an exception process to check for consistency between the data items of the database and the request message if the first and second codes are different.

Abstract: Embodiments of the invention relate to executing graph path queries. A database stores data entities and attributes in node tables and stores links between nodes in an edge table. Edges form a path between a source node and a target node. A source node set is generated and joined with the edge table to produce a first intermediate set. Similarly, a target node set is generated and joined with the edge table to produce a second intermediate set. A result path is generated through a joining of the first and second intermediate paths and application of a length condition.

Abstract: Embodiments relate to executing graph path queries. A database stores data entities and attributes in node tables and stores links between nodes in an edge table. Edges form a path between a source node and a target node. A source node set is generated and joined with the edge table to produce a first intermediate set. Similarly, a target node set is generated and joined with the edge table to produce a second intermediate set. A result path is generated through a joining of the first and second intermediate paths and application of a length condition.

Abstract: The disclosed technology generally describes separating types of data chunks in a copy-on-write/MVCC B+ tree, chunk-based data storage system, and also allocating the sizes of leaf chunks to be smaller than that of other (e.g., internal and root node) chunks. By having leaf chunks separate from node chunks, the probability of having a fully reclaimable (without copying) chunk is increased. Similarly, by having smaller sized leaf chunks relative to node chunks, the probability of having a fully reclaimable (without copying) leaf chunks is increased. The technology thus facilitates more efficient garbage collection.

Abstract: A method and system including a common dictionary module; a common dictionary processor in communication with the common dictionary module and operative to execute processor-executable process steps to cause the system to: define a common dictionary type; assign one or more characteristics to the common dictionary type; receive one or more data values; compress the dictionary type; and generate a common dictionary. Numerous other aspects are provided.

Abstract: A hashing scheme includes a cache-friendly, latchless, non-blocking dynamically resizable hash index with constant-time lookup operations that is also amenable to fast lookups via remote memory access. Specifically, the hashing scheme provides each of the following features: latchless reads, fine grained lightweight locks for writers, non-blocking dynamic resizability, cache-friendly access, constant-time lookup operations, amenable to remote memory access via RDMA protocol through one sided read operations, as well as non-RDMA access.

Abstract: Modularized data processing systems and methods for its use are provided. Processing a current job can reuse data generated for a previously processed job to the extent the two share parameter configurations. Similarly, outputs of processing modules generated during processing the previously processed job can be used as inputs to processing modules processing a current job, if the two jobs share some parameter configurations.

Abstract: The scalable high-level fusion of structured and unstructured data includes ingesting and processing unstructured data to produce a statistical model stored as extracted entities then mapped to a collection of resource description framework (RDF) triples, and applying a semantic analysis to a set of structured data to produce a logical model stored as a collection of triples. Reasoners are applied to both models generating an extended knowledge graph of both base and inferred knowledge that is decomposed into a wide table database, with each row storing a corresponding triple, and a reasoner converting the RDF triples into associated triples by adding a new column to the database in response to detecting a new predicate for a subject already present in one of the rows of the database so that the new predicate is stored in the new column in a new row created for the subject already present.

Abstract: Systems, methods, and non-transitory computer-readable media can store fingerprint data corresponding to one or more content items in an index data structure, the index data structure comprising a set of bins, wherein at least one first bin references a list of fingerprinted frames, and wherein at least one fingerprinted frame in the list corresponds to a first content item. A determination is made that one or more fingerprinted frames corresponding to a second content item are to be added to the index data structure. At least one of the fingerprinted frames corresponding to the second content item are added to the list of fingerprinted frames that is referenced by the first bin.

Abstract: A method, system, and computer program product for transforming RDF quads to relational views. The method commences by receiving a named graph, the named graph comprising at least one RDF quad, and analyzing the named graph to produce analysis metadata. The method uses the analysis metadata to generate relational views. The method further comprises publishing a relational view in the form of a SPARQL query. The quality of the results can be quantitatively measured and reported by calculating a goodness score based at least in part on aspects of the relational view definitions. Several variants for transformation include generating relational view definitions formed using a named-graph strict variant, or a named-graph relaxed variant, or a named-graph agnostic variant. The transformations can form outputs responsive to characteristics or properties such as a number of classes, a number of single-valued properties, a number of nullability properties, or a number of type-uniformed ranges.

Abstract: Multi-type attribute indexes may be implemented for document databases. When a request to perform a query at a document database is received that is directed toward in indexed attribute that has multiple data types for values stored in the multi-type attribute index, a predicate in the query may be replaced with a different predicate that is applicable to search the multi-type attribute index according to a sort order for the multiple data types stored in the at multi-type attribute index. A plan that includes the different predicate may be performed in order to provide a result of the query to a user.

Abstract: In various embodiments, methods and systems for implementing hash-based partitioning in distributed computing systems are provided. At a high level, a distributed computing system having an underlying range-based partitioning architecture for storage may be configured as a hash-based partitioning system, for example, a hybrid range-hash table storage. An operations engine of the hash-based partitioning system receives a tenant request to provision input/output operations per second (IOPS). The tenant request comprises a requested number of IOPS. Based on the tenant request, a provisioning operation to provision IOPS in a hybrid range-hash table storage with hash-based partitioning is determined. The provisioning operation is selected from one of the following: a table creation provisioning operation, an IOPS increase provisioning operation, and an IOPS decrease provisioning operation. The selected provisioning operation is executed for a corresponding table.

Abstract: A calculation device according to the present application includes an acquiring unit and a calculation unit. The acquiring unit that acquires a plurality of pieces of first triple information indicating a relationship related to three types of elements and a plurality of pieces of second triple information obtained based on a conceptual system in the plurality of pieces of the first triple information. The calculation unit that calculates statistical information related to the plurality of pieces of the first triple information based on the number of pieces of the first triple information associated with each of the plurality of pieces of the second triple information acquired by the acquiring unit.

Abstract: A search request received at a computer of a search support system is processed by analyzing the received search request to identify request parameters and connecting to a system index of the search support system that is referenced in the request parameters. An external result provider (ERP) process is initiated that establishes communication between the search support system and a data source external to the search support system, for a virtual index referenced in the request parameters. Thus, the ERP process provides an interface between the search support system and external data sources, such as by third parties. The ERP process can operate in a streaming mode (providing realtime search results with minimal processing) and/or a reporting mode (providing results with a greater delay and processing extent) and can switch between modes. The search request results are received from the connected system indexes and the referenced virtual indexes.

Abstract: A method includes performing a lookup using a key into a root node of a multi-tier data structure, to find a partition for performing an insert. A lookup for the key is performed on a first level index that is part of a linked data structure. A payload or reference is added to the linked data structure based on data structure criterion, otherwise the key and the payload are added to the linked data structure if the key is not found. A new first level index is created and added to the linked data structure upon the linked data structure remaining unchanged. The key and the payload or reference are added to the new index. Based on merge criterion, a new second level index is created and a portion of content from selected first level and second level indexes are merged for combining into the new second level index.

Abstract: Systems, methods, and non-transitory computer-readable media can receive a first content item having a set of frames. A binary hash code that represents the first content item is generated using at least an aggregation model and an iterative quantization hash model, the binary hash code being determined based at least in part on the set of frames of the first content item. The binary hash code is stored, wherein a similarity between the first content item and a second content item is capable of being measured based at least in part on a comparison of the binary hash code of the first content item and a binary hash code of the second content item.

Abstract: An indexing system uses a cascade of hash structures to process data entries upon ingest for indexing. The indexing system may be used for enhancing database privacy, anonymization, or data compression. A hash structure, for example, a bloom filter or hash table, passes a representation of the data entries to a subsequent hash structure in the cascade responsive to determining that the hash structure previously filtered an instance of the same representation. The indexing system can generate the representations of the data entries using one or more hash functions. A terminal hash structure of the cascade may index the data entries responsive to determining that the data entries satisfy a criteria for anonymization. For instance, the indexing system determines that there exists a threshold number of data entries describing a population of subjects having the same combination of data elements.

Abstract: Various examples are directed to systems and methods for managing hash indexing in a database management system. A database management system may receive first index usage data for a first index describing a database. The database management system may determine a first hash index effectiveness for the first index based at least in part on the first index usage data. The database management system may compare the first hash index effectiveness to a threshold hash index effectiveness. The database management system may modify a hash index status of the first index based at least in part on the comparing.

Abstract: The present disclosure describes techniques for converting and storing data in a unified format. One example method includes converting original data to a first data having a predetermined format; generating first metadata and a key value corresponding to the first data during the conversion of the original data; determining whether second metadata corresponding to the key value exists in a cache; determining whether the second metadata are different from the first metadata; in response to determining that the second metadata does not exist in the cache or to determining that the second metadata are different from the first metadata, storing the first data, the first metadata, and the key value to the cache; determining that a predetermined condition is satisfied; and in response determining that the predetermined condition is satisfied, storing the first data, the first metadata, and the key value to a non-relational database.

Abstract: A technique reduces an amount of metadata stored in a memory of a node in a cluster. An extent store layer of a storage input/output (I/O) stack executing on the node stores key-value pairs in a plurality of data structures, e.g., cuckoo hash tables, resident in the memory. The cuckoo hash table embodies metadata that describes an extent and, as such, may be organized to associate a location on disk with a value that identifies the location on disk. The value may be embodied as a locator that includes a reference count used to support deduplication functionality of the extent store layer with respect to the extent. The reference count is divided into two portions: a delta count portion stored in memory for each slot of the hash table and an overflow count portion stored on disk in a header of each extent. One bit of the delta count portion is reserved as an overflow bit that indicates whether the in-memory reference count has overflowed.

Abstract: Common data are maintained by a system including a plurality of node devices that each store a respective portion of a common data in a respective database, wherein a node device of the plurality of node devices stores a first portion of the common data, and receives a hash value of a second portion of the common data that is different from the first portion, in response to an update of the second portion of the common data.

Abstract: A computer system has a database constructed from storage areas in each of a plurality of computers, which stores data including an operation number for managing an operation status by transaction processing. The data is allocated to the computers in accordance with predetermined management ranges, and the computers include a control module configured to generate an operation history indicating specifics of each operation included in the piece of transaction processing in a case of receiving an execution request. A distribution module determines a sequence number of applying a plurality of operation histories to the database and transmits them to the other computers. A conflict judgment module determines whether a piece of transaction processing corresponding to an operation history conflicts based on the operation number; and an applying module operates the database based on an operation history corresponding to a piece of transaction processing to the database determined not to conflict.

Abstract: Aspects of the disclosure relate to communication systems, apparatus and methods which enable or support transmitting/receiving downlink control information (DCI) carrying a downlink grant or an uplink grant. A method includes detecting a reference length based on an effective length of a downlink (DL) grant DCI and an effective length of an uplink (UL) grant DCI and calculating a length difference based on the effective DL grant DCI length and the effective UL grant DCI length. A length of a padding field in the DL grant DCI and/or the UL grant DCI is set equal to the calculated length difference such that the lengths of the DL grant DCI and UL grant DCI are both equal to the reference length. Padding bits are inserted in the padding field of the DL grant DCI and/or the UL grant DCI. Thereafter, the DL grant DCI and/or the UL grant DCI is encoded and transmitted to a scheduled entity.

Abstract: A system for unloading tables of a database is provided. In some aspects, the system performs operations including determining that a number of accesses to a table occurring within a time period has satisfied an access threshold. The operations may further include identifying, in response to the determining, a first timestamp indicating a most recent access to the table. The operations may further include determining whether a difference between a current timestamp and the first timestamp satisfies a first time threshold. The operations may further include comparing, in response to the difference satisfying the first time threshold, a ratio of the difference and a size of the table to a ratio threshold. The operations may further include unloading, in response to satisfying the ratio threshold, the table. The operations may further include adjusting, based on the feedback, the first time threshold and/or the ratio threshold.

Abstract: Provided is a method, computer program product, and system for transferring data between block and file storage systems. A remote server may receive, from a host device, a request to restore data to the host device. The remote server may store the data as one or more objects, with each object corresponding to an extent of a logical volume on the host device. A set of strides on the host device that correspond to the one or more objects may be determined using metadata for the one or more objects. Each of the one or more objects may be split into a set of data pieces using the metadata. Each data piece may then be transmitted from the remote server to the host device.

Abstract: A user of a storage system can upload files for a media asset, which can include a high quality media file and various related files. As part of the upload process, the storage system can extract metadata that describes the media asset. The user can specify one or more lifecycle policies to be applied for storage of the asset, and a rules engine can ensure the application of the one or more policies. The rules engine can also enable the use of simple media processing workflows. A filename hashing approach can be used to ensure that the segments and files for the asset are stored in a relatively random and even distribution across the partitions of the storage system. As part of the lifecycle for the asset, the high quality media file can be moved to less expensive storage once transcoding of the asset or another such action occurs.

Abstract: A method for writing transaction data in a blockchain system is disclosed. The blockchain system comprises at least one blockchain. The method comprises: receiving a blockchain transaction data writing request comprising transaction feature information of transaction data to be added to the blockchain; determining a blockchain matching the transaction data to be added to the blockchain according to a blockchain data record table and the transaction feature information of the transaction data to be added to the blockchain, wherein the blockchain data record table records transaction type identification information associated with the blockchain for reflecting transaction feature information of transaction data in the blockchain; and writing an execution result of the transaction data to be added to the blockchain into the blockchain matching the transaction data to be added to the blockchain.

Abstract: A similarity fingerprint for a data object such as a file can be automatically determined using one or more anchor values. The one or more anchor values can be provided or determined. For each anchor value, a set of distances between each instance of the anchor value in the data object is determined. The set of distances for the instance of the anchor value is aggregated into a single value. The single value is added as a component of the similarity fingerprint. Thus, if there are N anchor values, there can be N components of the similarity fingerprint. The similarity fingerprints of different data objects can be compared and the results of the comparison can be used to determine how similar the data objects are.

Abstract: Data matches are calculated in a data deduplication system by matching input and repository digests using a digest based data matching process where the reference digests corresponding to a repository interval of data identified as similar to an input interval of data are loaded into two data structures. The dual data structures include a sequential buffer containing a plurality of digest entries in a sequence corresponding to a placement order of calculated values of the reference digests, the placement order of the calculated values of the reference digests correlative to an order in which input digest values were calculated such that the plurality of digests are stored in a linear form independent of a deduplicated form by which data the plurality of digests describe is stored.

Abstract: The present invention generally relates to detecting malicious network activity coming from network devices such as routers and firewalls. Specifically, embodiments of the present invention provide for detecting stealth malware on a network device by comparing inbound and outbound network traffic to discover packets originating from the network device and packets that violate configuration rules. When combined with a network traffic monitor server configured to monitor actual network traffic reports and to receive known network traffic reports from host computers, the system can detect stealth network traffic originating from both network devices and host computer systems.

Abstract: Embodiments are directed towards employing multiple profiles to track identification of users across multiple domains. Multiple application-domain profiles and multiple web-domain profiles may each include a statistical identifier. A profile enrichment store may be generated from the application-domain profiles and web-domain profiles, where each entry in the profile enrichment store may be based on statistical identifiers. The profile enrichment store may be utilized to determine categories associated with a statistical identifier for a request from a client device. A targeted advertisement may be determined based on the determined category and may be provided to the client device. A client caching identifier may be used in a mobile web domain, in combination with the statistical identifier, to track mobile web users. If a request is associated with a profile that includes an affirmative opt-out flag, categories in the profile enrichment store for a corresponding statistical identifier may be cleaned up.

Abstract: Methods, devices, and systems may be used for semantics publishing and discovery. In an embodiment, a method for publishing semantics related resource identifiers may include adding a key word to an identifier of a semantics related resource and publishing the identifier to at least one of a sibling node and a child node. In another embodiment, a method may include using a Bloom filter to publish a semantics related resource. In another embodiment, a method may include publishing, by a semantics node, an identifier of a semantics related resource to a sibling node, while publishing a digest of the semantics node to a child node.

Abstract: A method for servicing document search requests. The method includes receiving, by a document management service, a document search query from a requesting user, and injecting, into the document search query, a user access vector. The user access vector specifies, for the requesting user, access control lists that are associated with the requesting user. The method further includes identifying, in a document repository, documents that match the document search query with the injected user access vector. A matching document requires a match of terms in the search query with terms in the matching document, and a match of at least one access control list specified in the matching document and at least one of the access control lists specified in the user access vector.

Abstract: A technique for enforcing uniqueness of property-value pairs in a schemaless data store includes receiving a request to uniquely store a property-value pair PV1 in a first collection of the data store. In response to receiving the request, a property-value pair PV2 is constructed that includes (a) a property on which the data store enforces uniqueness in a second collection of the data store and (b) a corresponding value that provides a formatted version of PV1. The technique includes performing a store-if-unique operation configured to (i) generate a failing result in response to PV2 already existing in the second collection and (ii) store PV2 in the second collection in response to PV2 not already existing in the second collection. If the store-if-unique operation fails, the request to store PV1 in the first collection is denied; otherwise, the request is granted.

Abstract: Disclosed are systems, methods, and non-transitory computer-readable media for structuring data in a knowledge graph. A data management system determines known concepts that are related to a data snippet. The data management system determines cosine similarity values indicating an intrinsic similarity between the data snippet and the known concepts, as well as pertinence values indicating a measure of topical similarity between the data snippet and the known concepts. The data management system determines, based on the cosine similarity values and the pertinence values, that the data snippet is related to a first known concept, and in response, assigns a concept identifier for the first known concept to the data snippet. Score indicating a strength of connection between the concepts added to the knowledge graph are determined and used to derive insights between the concepts.

Abstract: A multi-shard database system receives a transaction including multiple actions directed to different shards of the database system. The database system creates a transaction record including a transaction identifier and a transaction status for the transaction in a transaction database. The database system then executes, in parallel, the multiple actions on the different shards by associating with each data item involved in the transaction a data structure that includes the transaction identifier and new data to be applied to the data item. The database system then updates the transaction status in the transaction record for the transaction from pending to completed when each of the multiple actions is successfully executed on the corresponding shard. Consistency is eventually implemented when the data structures associated with the data items involved in the transaction are evaluated. The evaluation of a data structure can be triggered by a read request or other events.

Abstract: In an example, a system and method for data plane integration is described. Aspects of the embodiments are directed to a service application connected to a switch of a network fabric and a method of data plane integration performed at a service appliance, the service appliance providing firewall functionality. The service appliance can receive a data packet from a network location; determine a flow owner of the data packet based on a hashing table; and transmit the data packet based on the determined flow owner of the data packet.

Abstract: An example technique includes assigning partitions of a dataset of multidimensional points to a plurality of local memory nodes of a multicore machine and using the local memory nodes for a search query to determine similarity matches in the dataset for a given multidimensional point. The using includes parallel searching with the local memory nodes in the assigned partitions to identify candidate similarity matches to the given multidimensional point using indexes derived from the multidimensional points, the parallel searching for each node progressing through a sequence of search distances and providing an ongoing search result for each search distance from the given multidimensional point and regulating an extent of the parallel searching based on the ongoing search results.

Abstract: In response to determining that continuous data protection is to be enabled for a particular table of a database service, a service component verifies that automated transmission of change records of the table to a log-structured journal has been configured. A given change record comprises a before-image and an after-image associated with a committed database write, and is assigned a unique sequence number. In response to a determination to restore the table as of a specified point in time, a restore record set is identified from the journal with respect to a selected snapshot of the table. The restore record set includes change records which are not represented in the snapshot and are to be represented in the restored table. A restore result table is created using the selected snapshot and the restore record set.

Abstract: A system, a method and a computer program product for indexing data samples are disclosed. A locality-sensitive string hash index is determined for each data sample in a plurality of data samples. The determined locality-sensitive string hash indexes for at least two data samples in the plurality of data samples are compared. The comparison includes estimating, based on the determined locality-sensitive string hash indexes, a distance between the two data samples. Based on the comparison, at least one data sample in the plurality of data samples being similar to at least another data sample in the plurality of data samples is identified.

Abstract: Systems and methods for augmenting, inferring, extrapolating, deducing, reasoning, and storing logical networks of information represented in digest form are disclosed. The disclosed systems and methods enable the combined inclusion of both sensitive information and non-sensitive information into a compressed, universal, indiscernible format. Relationships can be derived or inferred between unintelligible digests of information by associating them with a common underlying entity. A universal digest format described herein may become comprehensible by further utilizing additional a priori or a posteriori knowledge of the information such that recognized digests can be utilized fully while unknown and potentially sensitive digests remain undecipherable.

Abstract: Implementations of the disclosure describe grouping documents by content similarity. A method of the disclosure includes determining a first set of document identifiers (IDs) for documents identified responsive to a search query, for each document ID of the first set: obtaining shingles corresponding to the document ID, identifying a second set of document IDs corresponding to the obtained shingles, grouping the identified document IDs of the second set in a grouping data structure, and determining resulting document IDs from the grouping data structure, the resulting document IDs corresponding to a threshold number of the document IDs in the grouping data structure having a highest number of occurrences. The method further includes associating the documents corresponding to the resulting documents IDs with one another in search results generated responsive to the search query.