Abstract: Disclosed herein are systems and methods for query processing with restrictions in a database clean room. In an embodiment, a system receives a query directed to a combination of a first source dataset from a first database account of a distributed database and a second source dataset from a second database account of the distributed database. The system generates an approved statements table that contains database statement language that can be executed against the combination of the first and second source datasets. Based on determining that the approved statements table includes the query, the system executes the query to produce results data, and stores the results data in the first database account.

Abstract: A method of retrieving information relating to an entity, the method including, in at least one electronic processing device, performing a search by: determining a respective search template for the entity, the search template being indicative of a sequence of query instructions; performing a sequence of queries in accordance with the sequence of query instructions of the respective search template, each query being a query of a data source performed in accordance with a respective query instruction and being performed at least in part using at least one of: an identity of the respective entity; and, a result of a previous query performed in accordance with a previous query instruction in the sequence of query instructions; determining a result for at least some of the sequence of queries; and, determining information relating to the entity using the results.

Abstract: An example operation may include one or more of generating a plurality of successive data points of an iterative simulation based on predefined checkpoints, each data point identifying an evolving state of the iterative simulation with respect to a previous data point among the successive data points, transmitting a blockchain request for validating state data within a first data point among the plurality of successive data points to a first subset of endorsing nodes of a blockchain network, and transmitting a blockchain request for validating state data within a second data point among the plurality of successive data points to a second subset of endorsing nodes which are mutually exclusive from the first subset of endorsing nodes of the blockchain network for parallel endorsement of the first and second data points.

Abstract: Disclosed herein are systems and methods for query processing with restrictions in a database clean room. In an embodiment, a system receives a query directed to a combination of a first source dataset from a first database account of a distributed database and a second source dataset from a second database account of the distributed database. The system generates an approved statements table that contains database statement language that can be executed against the combination of the first and second source datasets. Based on determining that the approved statements table includes the query, the system executes the query to produce results data, and stores the results data in the first database account.

Abstract: A field extraction template simplifies the creation of field extraction rules by providing a user with a set of field names commonly assigned to a certain type of data, as well as guidance on how to extract values for those fields. These field extraction rules, in turn, facilitate access to certain “chunks” of the data, or to information derived from those chunks, through named fields. A field extraction template comprises at least a set of field names and ordering data for the field names. The ordering data indicates index positions that are associated with at least some of the field names. A delimiter is specified for splitting data items into arrays of chunks. The chunk of a data item that belongs to a given field name is the chunk whose position within the item's array of chunks is equivalent to the index position associated with the given field name.

Abstract: Provided is a method for reverse real-time matching based on event-driven graph patterns. The method includes definition of a graph pattern, establishment of reverse matching architecture and a reverse matching method; and the graph pattern is used for describing a spatial connection relationship among vertices and edges in a graph in a reverse order and attribute constraints thereof, and includes a linked list of matching steps and matching contexts. Reverse real-time matching of the graph pattern is realized according to the reverse matching architecture, and the problem of event-driven subgraph matching in a real-time scene is solved.

Abstract: Computer-implemented methods, program products, and systems for provenance-based defense against poison attacks are disclosed. In one approach, a method includes: receiving observations and corresponding provenance data from data sources; determining whether the observations are poisoned based on the corresponding provenance data; and removing the poisoned observation(s) from a final training dataset used to train a final prediction model. Another implementation involves provenance-based defense against poison attacks in a fully untrusted data environment. Untrusted data points are grouped according to provenance signature, and the groups are used to train learning algorithms and generate complete and filtered prediction models. The results of applying the prediction models to an evaluation dataset are compared, and poisoned data points identified where the performance of the filtered prediction model exceeds the performance of the complete prediction model.

Abstract: First and second database accounts respectively share first and second source datasets with one another in a data clean room. The first database account stores a first approved-statements table that contains database statements that are permitted by the first database account to be executed against a combination of the shared first source dataset and the shared second source dataset. The second database account stores a second approved-statements table that contains database statements that are permitted by the second database account to be executed against the combination of the shared first source dataset and the shared second source dataset. One or more queries received from the first database account that are included in the second approved-statements table are processed, as are one or more queries received from the second database account that are included in the first approved-statements table.

Abstract: A system determines a shape of incoming data, and determines, based on the shape, whether the data should be passed on to support answering a query. If the shape of the data suggests that the data is insufficient or may even be misleading, the system can gate the data or prompt for more.

Abstract: Computer-implemented methods, program products, and systems for provenance-based defense against poison attacks are disclosed. In one approach, a method includes: receiving observations and corresponding provenance data from data sources; determining whether the observations are poisoned based on the corresponding provenance data; and removing the poisoned observation(s) from a final training dataset used to train a final prediction model. Another implementation involves provenance-based defense against poison attacks in a fully untrusted data environment. Untrusted data points are grouped according to provenance signature, and the groups are used to train learning algorithms and generate complete and filtered prediction models. The results of applying the prediction models to an evaluation dataset are compared, and poisoned data points identified where the performance of the filtered prediction model exceeds the performance of the complete prediction model.

Abstract: Disclosed are some implementations of systems, apparatus, methods, and computer program products for facilitating web site navigation using a search-based navigation interface of a web-based application or browser service. A plurality of sources can be searched to identify a set of items based, at least in part, on user input received via a search input interface element of the search-based navigation interface. Each item of the set of items can correspond to an object of one of a plurality of object types. A user interface object including user-selectable options can be provided for display in proximity to the search input interface element, where each item of the set of items corresponds to a different one of the user-selectable options. In response to a user selection of one of the user-selectable options corresponding to an item of the set of items, access to the corresponding object can be provided.

Abstract: Embodiments of the present disclosure may provide a data clean room architecture that restricts data included in the clean room. The data clean room architecture can implement a policy to enable data restrictions for data shared between multiple parties via a distributed database. Multiple database accounts can implement validation instances to validate queries when received from other database accounts. One or more of the database accounts can provide a query template that is congruent with the validation instance for use by the other database accounts to generate queries against the data shared in the data clean room.

Abstract: A process for recommending pre-constructed queries in data analytics includes writing different records to a correlation data structure correlating different data classifications of data to different queries and, subsequent to the writing, establishing a communicative connection by a data analytics application to an underlying database. Thereafter, a data model for data in the database may be constructed in the data analytics application and at least one of the different queries may be selected in the correlation data structure that correlates to the classification of the data in the data model. Finally, the selected one of the different queries may be displayed in the data analytics application to an end user so as to provide an intelligent recommendation for the addition of the selected one of the different queries without requiring the end user to alone and without assistance discover the suitability of the selected one of the different queries.

Abstract: Methods, apparatuses, and computer program products are described for aggregating user sessions for conversational exchanges using a virtual assistant. A user device can receive conversational inputs, convert the conversational inputs into textual strings, associate, based upon semantic analysis of different portions of the textual strings, a first network and a second network, and initiate, respectively, a first and second user session with a first response module of the first network and a second response module of the second network. The portions of textual strings can be transmitted to the first and second response modules via, respectively, the first and second user sessions. Once response fragments are received from the first and second response modules, the response fragments can be combined in a semantically suitable order to form a generated response.

Abstract: A resource dependency system dynamically determines and generates for display a minimized and collapsed resource dependency toolbar using two or more indicators to display a summarized view of dependency relationships to one or more selected items. For example, the system can analyze a resource dependency graph and determine root items, or items that do not depend on other items but are depended on by a selected item. The system can also determine leaf items, which no other items depend on. The system can also determine intermediary items that depend on root items and/or leaf items. Then, based on preconfigured instructions, the system can group the root, leaf, and intermediary items into two or more indicators and display the indicators on a graphical user interface conveying information about the selected item and how it is related to other items.

Abstract: Among other things, we describe a computer-implemented method, performed by a data processing system, of executing a computer program based on a query that is expressed in accordance with a query language applicable to a relational database, the computer program executed based at least in part on data stored in a tangible, non-transitory computer-readable medium, the executing including receiving a SQL query, where the SQL query includes an identifier associated with a resource that is external to the data processing system, generating a computer program based on the SQL query, and executing the computer program, causing transmitting one or more instructions to the resource, the instructions defining operations other than operations of the SQL query, and receiving data from the resource in response to the instructions.

Abstract: A computing system may obtain code for a query to a database from a first user. In response, the application may automatically perform an operation to determine a number of records of the database that would be accessed by executing the query on the database. The computing system may output, for display to the first user, the number of records of the database that would be accessed by executing the query on the database. The computing system may output, for display to the first user, a prompt for an acknowledgement of the number of records of the database that would be accessed. In response to receiving an indication of the acknowledgement by the first user of the number of records of the database that would be accessed, the computing system may output, for display to a second user, the code for the query for review by the second user.

Abstract: Techniques for detecting an anomaly in queries of a relational database are disclosed. The techniques include identifying a set of attribute values from a query for accessing data within a database. Based on previously received queries, at least one of a joint probability for the set of attribute values or individual probabilities for the set of attribute values is determined. When at least one of the joint probability for the set of attribute values or an individual probability for one or more attribute values in the set of attribute values does not satisfy a probability cutoff, an indication that the query is anomalous is outputted.

Abstract: A method and system for search exploration in a mobile application environment as well as a desktop environment is provided. The method and system utilize at least one computer processor to perform the steps of selecting a virtual object on a display interface via an indicator positioned within and associated with the virtual object. The computer processor provides dragging the indicator out of a home area and displaying at least one related property associated with the virtual object on the display while dragging outside of the home area. The computer processor provides dragging the indicator onto one or more of the at least one related property associated with the virtual object and a pausing of the indicator over at least one related property causes the computer processor to select the related property as a search parameter of a search query. Dropping the dragged indicator initiates a search based on said search query and the search is initiated based on the search query as a result of said dropping.

Abstract: A computer system and method provide efficient, intuitive, and human-friendly ways of expressing metric-centric queries about multidimensional database data and, at the same, provide a level of flexibility for expressing various metric-centric queries in an interactive manner. The expression techniques help to more easily formulate metric-centric queries that require aggregation operations and joins. The flexible techniques facilitate interactive analysis of multidimensional data from different perspectives including consolidating, drilling down, and slicing and dicing the data. As a result, the analysis task for the data analyst and the programming task for the application developer may be easier, more efficient, and more effective.

Abstract: Some embodiments are directed to a method for exchanging data between a user terminal, and a first data source and a second data source, the method including configuring a user-defined XML configuration file stored on a portal server. The method further includes retrieving data periodically from the first data source via a periodically executed application and retrieving data aperiodically from the second data source via an aperiodically executed application. The method further includes storing a combined data retrieved from the first data source and the second data sources in a database. The method further includes displaying the combined data on the user terminal in accordance with at least one option specified in the user-defined XML configuration file.

Abstract: Disclosed are methods and apparatuses for reducing the number of database calls when transferring data from a database to a server. One embodiment provides an approach for utilizing staging tables to collate and transform core data and related data in the database before transferring the data to the server, so that the number of database calls used may be reduced.

Abstract: A resource dependency system dynamically determines and generates for display a minimized and collapsed resource dependency toolbar using two or more indicators to display a summarized view of dependency relationships to one or more selected items. For example, the system can analyze a resource dependency graph and determine root items, or items that do not depend on other items but are depended on by a selected item. The system can also determine leaf items, which no other items depend on. The system can also determine intermediary items that depend on root items and/or leaf items. Then, based on preconfigured instructions, the system can group the root, leaf, and intermediary items into two or more indicators and display the indicators on a graphical user interface conveying information about the selected item and how it is related to other items.

Abstract: A method, computer program product, and computer system for reducing, by a computing device, overlap in a RAID extent group by moving a first disk extent in an extent pool from a source disk to a target disk in a Mapped RAID group. A neighborhood matrix for the Mapped RAID group may be balanced by moving a second disk extent in the extent pool from the source disk to the target disk in the Mapped RAID group.

Abstract: A cluster management system and method for synchronizing content libraries within a distributed computer system allows an on-demand synchronization option of a content library subscribed to a publishing content library, which includes at least a consumable software item and metadata of the consumable software item, to be enabled. As a result of the on-demand synchronization option of the subscribed content library being enabled, the metadata of the consumable software item is downloaded from the publishing content library to the subscribed content library without downloading the consumable software item. The consumable software item is downloaded from the publishing content library to the subscribed content library in response to user selection of the consumable software item at the subscribed content library.

Abstract: Methods, apparatus and articles of manufacture to provide workflow subscription management in a cloud computing environment are disclosed. Example disclosed methods include, in response to a first input identifying an event topic, causing, by executing an instruction with a processor, a corresponding event schema to be displayed, accessing a second input identifying a field included in the event topic schema and a third input identifying a threshold value corresponding to the field. Disclosed example methods also include, in response to receiving an event notification corresponding to the event topic and based on the threshold value having a defined relationship to a payload value included in an event payload contained in the event notification, triggering a workflow.

Abstract: The present disclosure discloses a method, apparatus, server, and storage medium for acquiring a recommended topic, and relates to the field of network technologies. The method includes: acquiring, according to a link of a current page, a recommended topic associated with a topic of the current page; and displaying the recommended topic on the current page. By using technical solutions provided in embodiments of the present invention, a recommended topic associated with a topic is acquired by using a page link as an index, which, however, is not limited to a page related to the topic, thereby achieving an objective of extending to other topics, expanding a browsing range, and making full use of a network to provide more services for a user.

Abstract: The invention discloses a method, system and terminal for interface presentation. The method comprises: a first terminal receiving a request message for saving the current user interface, capturing the current interface information based on the request message, and uploading the interface information to a network storage server; a second terminal receiving a triggering instruction, initiating to the network storage server a request for invoking the interface information, constructing a user executable interface with the invoked interface information, and presenting the constructed interface.

Abstract: A big data processing system includes a workload trimming function that separates out from among a set of identified anomalies, those that are clearly outliers, rather than ones residing within clusters of anomalies as mapped within an anomalies distribution space. The outlier anomalies are not subjected to a computationally-intensive anomalies aggregating process and thus, processing resources are conserved.

Abstract: Techniques of detecting malicious events involve generating a relational graph of event data describing events that occur within a specified, limited time window. Along these lines, a malicious event detection computer receives event data describing interactions between entities such as users, devices, and network domains from various servers that occur within a specified time window. In response, the malicious event detection computer generates a relational graph that has graph structures (e.g., nodes and edges) representing these interactions. Analysis of patterns within the resulting relational graph indicates whether there is a malicious event occurring.

Abstract: Disclosed are methods and apparatuses for reducing the number of database calls when transferring data from a database to a server. One embodiment provides an approach for utilizing staging tables to collate and transform core data and related data in the database before transferring the data to the server, so that the number of database calls used may be reduced.

Abstract: Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.

Abstract: A library of cloud templates for configuring cloud-based industrial solutions is provided. A cloud template provisioning system provides a platform for location and retrieval of a variety of cloud templates that facilitate configuration of cloud-based industrial applications, including control panel templates, dashboard templates, data historian templates, virtual machine management templates, and other such templates. The cloud templates can be installed and executed on a client device to provide an intuitive interface for configuring various aspects of the cloud-based solution.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: Mechanisms are provided for generating an answer for an input question when the answer is not directly present in a corpus of information. An input question is received from a computing device and analyzed to determine whether the input question is requesting an answer that is calculable. In response to a determination that the input question is requesting an answer that is calculable, one or more constituent data values are retrieved, from a corpus of information, for calculating the requested answer to the input question. A value corresponding to the requested answer is calculated based on the one or more retrieved constituent data values and is then output as the requested answer to the input question.

Abstract: A non-transitory computer readable storage medium includes instructions to collect explicit feedback from a user regarding user content preferences. Multiple data sources are monitored. Topics associated with the multiple data sources are classified. The importance of the topics to the user is characterized. Content is delivered to the user when a selected topic exceeds an importance threshold for the user. Implicit feedback from the user that characterizes refined user content preferences is tracked. The instructions to characterize the importance of topics evaluates the explicit feedback and the implicit feedback.

Abstract: A computer is used to generate an approximation of a workflow in terms of worklets and transitions. Each worklet represents a phase of work in the workflow. Each transition indicates conditions for completion of a worklet. Each worklet includes at least one assistlet having executable code that will be executed for approximating of its work phase.

Abstract: A method and apparatus for integrating a converged infrastructure platform in a data center is provided. The described apparatus configures the physical and virtual resources that run on the converged infrastructure to communicate with the rest of the data center. The network integration process understands the data center network already in place and extends the set up into the converged infrastructure to enable communication between the converged infrastructure and the rest of the network in the data center. The apparatus uses an infrastructure template that describes the data center and that may be pre-defined for a specific application deployed within the converged infrastructure platform.

Abstract: Embodiments enable the evaluation of injected queries within a monad. One or more operators with closures are received from a first process. The operators with closures represent one or more functions to be applied by a second process. The second process evaluates the received operators with closures to apply the functions within the monad. During evaluation, the second process converts the closures to simply typed closures. Further, the second process binds the converted closures within the monad to restrict execution of the functions. In some embodiments, the queries (e.g., sequences of one or more operators with closures) are composed using a set of query operators from the language integrated query (LINQ) framework encoded in uniform resource locators (URLs) in the representational state transfer (REST) style.

Abstract: The impact of device configuration changes on operational issues and policy compliance in a computer network can be discerned from a visual data presentation that jointly shows representations of changes, issues, and policy compliance in a common view for a group of network devices. Configuration information is collected from devices in the computer network and processed to determine whether a change has occurred in a configuration of any of the devices, whether any operational issues exist for each of the devices, and whether any of the devices are not in compliance with any applicable operational policies. A display device displays the visual data presentation to allow an operator to see trends and relationships between device configuration changes and operational issues and incidents of policy non-compliance. The visual data presentation can be depicted as a graphical timeline view, a network topology view, or a table view of the information.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for identifying implicit question queries. In one aspect, a method includes receiving a query in unstructured form, comparing terms of the query to query templates, determining, based on the comparison, a match of the query terms to a first query template, wherein the first query template is not determined to be indicative of a question query, determining, based on the first query template, a second query template, and determining that the query is an implicit question query in response to the second query template being indicative of a question queries.

Abstract: Methods, systems, and computer-readable media are disclosed for event processing with a query based on a reusable XML query template. A particular method includes receiving a plurality of events from a source and generating a plurality of event objects based on the plurality of events. A query represented by an XML file based on a reusable XML query template is executed with respect to the plurality of event objects to produce a plurality of result objects. Each result object is produced based on an application of at least one operator of the query. A plurality of results is generated based on the plurality of result objects, and the plurality of results is transmitted to a sink.

Abstract: A method and apparatus where the method includes detecting a plurality of events related to the activities of users within a security system wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical and wherein a data distance between events is a function of event attributes, evaluating the detected events using a density based anomaly detection method f(r), where r is a size of a neighborhood around a data point, comparing a value of the evaluated expression with a margin threshold value (msg(r)) and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: A method and apparatus for a data analysis system for analyzing data object collections is provided. The data analysis system includes one or more graphical user interfaces comprising various interface elements that enable users to create visual queries. A visual query is constructed as a graph representing a pattern of interest in a collection of data objects. A visual query may include one or more graph elements and property information associated with the specified graph elements. After a user has constructed a visual query, the system may transform the visual query into a query template. A query engine may then execute the query template to search a data object collection for data object results corresponding to the specified pattern. The search for instances of a specified pattern in a collection of data objects is referred herein to as a “search around.

Abstract: A system and method of the subject technology automatically constructs a database instruction from a template instruction, including one or more variable tokens, and one or more document object representations, each including an object type and a user-generated parameter. The one or more variable tokens in the template instruction are substituted by the user-generated parameter of a corresponding document object representation when the type of a respective variable token is matched to the type of the corresponding document object representation.

Abstract: Disclosed is an improved approach for implementing an on-demand scheduler in a mobile device and the structures to support realtime on-demand schedulers. A lightweight word-based structure is disclosed for storing scheduling-related data on the mobile device. Using this lightweight word-based structure enables on-demand and real-time scheduling. This type of lightweight structure also permits scheduling activities to be performed in a disconnected mode, which can then be later synchronized with the server to confirm the booking In addition to appointment scheduling, this technique can also be implemented for scheduling of any type of resource.

Abstract: Systems and methods generating schemas that represent multiple data sources are provided herein. According to some embodiments, methods may include determining a schema for each of the multiple data sources via a computing device communicatively couplable with each of the multiple data sources, each of the multiple data sources including one or more data structures that define how data is stored in the data source, generating a negotiated schema by comparing the schemas of the multiple data sources to one another and interrelating data points of the multiple data sources based upon the schemas, interrelating the negotiated schema with the schema for each of the multiple data sources based upon the interrelation of the data points, and storing the negotiated schema in a storage media by way of the computing device.

Abstract: Embodiments of the present invention facilitate the solicitation of user input while allowing for dynamic changes to that input while concurrently ranking the same. Ranking occurs in real-time and allows for a user to alter their contribution or vote until the close of a contribution period allowing real-time influences to be taken into account. Contributions may be provided in response to or as a part of a template driven nomination process. Solicitations of input may occur in the context of a pre-defined slate of options for voting, nominating certain options for a subsequent or concurrent voting process, or choosing/suggest more than one option such as the best of a slate of options or the individual ranking of a slate of options. Embodiments of the present invention capture all user nominations or suggestions while simultaneously providing the real-time ranking and dynamic re-ranking of those nominations or suggestions.

Abstract: A method, computer program product, and system for visually modeling architectures or system designs are described. A method may comprise providing an architectural model having a plurality of elements of one or more types. The method may further comprise providing a platform for a user to develop a non-software code query relating to the elements of the model. The method may also comprise executing the developed query to extract one or more of the plurality of elements from the model. The method may additionally comprise populating a diagram with the extracted one or more of the plurality of elements.

Abstract: According to certain embodiments, a set of samples of sensor data is accessed. The set of samples records environmental measurements taken by one or more environmental sensors. A characteristic function is generated from the set of samples. The characteristic function indicates whether a given sample is a member of the set of samples. One or more samples of the set of samples that are associated with a given environmental annotation are identified according to the characteristic function.