Abstract: Queries may be made against a non-relational database without impacting the capacities of the non-relational database by enabling performance of queries to a non-relational database via an external query management, backup management, and a non-relational database backup hosted in an external data storage. The query management and backup management of the non-relational database service may split transactional load to the non-relational database and analytical load, and furthermore allow selection of a desired data freshness for queries including various time ranges, such as seconds, minutes, or days.

Abstract: A quality check apparatus, a quality check method, and a quality check program can check the quality of input data output to a processing module. A device outputs the input data and first metadata indicating an attribute regarding the quality of the input data to the processing module. The quality check apparatus includes a first obtaining unit and a check unit. The first obtaining unit obtains the first metadata. The check unit checks the quality of the input data based on the first metadata.

Abstract: A method for data processing includes identifying, for communication of a content object, a segment of entities including entities of a first entity class of a plurality of entity classes defined by a data model that is configured for a tenant of a multi-tenant system, where the data model defines relationships between entity classes of the plurality of entity classes. The method may further include activating for selection at a user interface at least one second entity class that is related to the first entity class based on the relationships and identifying a set of additional entities of the second entity class from the remaining entities that are related to the segment of entities as defined by the data model. The method may include transmitting to a content communication system an indication of the plurality of entity identifiers corresponding to a modified segment of entities that includes the additional entities.

Abstract: Embodiments provide cloud based identity management by receiving a request from an application for a resource that includes an operation on a resource type out of a plurality of resource types and the request specifies a tenant out of a plurality of tenants, the resource type including a schema, and the schema includes a plurality of schema attributes and metadata for each of the schema attributes, the resource type including one of a user or a second application. Embodiments store multiple versions of the resource type, at least a first version of the resource indicating a deprecated attribute with respect to a first previous version of the resource type, and at least a second version of the resource type indicating an added attribute with respect to a second previous version of resource type, where the request indicates one of the multiple versions of the resource type.

Abstract: Methods, systems, and devices supporting data storage are described. A database system may implement a hierarchical organization in which child data objects store hierarchical data for parent data objects. However, to support low latency time-series volume planning and analysis, the database system may additionally store a data object with a first set of data fields that includes object-specific data for the data object and a second set of data fields that includes hierarchical data (e.g., time-based hierarchical data organized into separate data fields for different time segments) for the data object. The database system may support both transactions and analytical queries using the data model. For example, the database system may receive a query indicating a time period for predictive analysis and may execute the query on the second set of data fields for the data object (e.g., without searching for child data objects storing the time-based hierarchical data).

Abstract: Systems and methods of the present disclosure can facilitate managing a computing device. The computing device can be a managed device that is managed by a device management server. In some embodiments, the system includes a generation module and an interface module. The generation module may be configured to receive a site location for the computing device, identify an address of the device management server, and generate an optical representation of a configuration based on the site location and the address. The interface module may be configured to provide the optical representation to the computing device and receive a communication from the computing device, the communication corresponding to the configuration.

Abstract: Examples include techniques for backing up a file to long term “cold” storage by using circuitry, and logic for execution by the circuitry, to receive a request to back up the file in a distributed file system to cold storage, to copy the file from at least one data node of the distributed file system to cold storage, to set a location of the file in cold storage in a name node of the distributed file system, and to set a length of the file to zero in the name node.

Abstract: A communication server supports automatic content receipt and distribution. The communication server receives a set of content objects, where a content object of the set is associated with a set of target group identifiers. A content object of the set may include different versions of content for ABn and/or multivariate testing. The communication server generates target segment identifier combinations and distributes versions of messages proportionally to each user identifier associated with the target segment combinations. The server generates engagement metrics corresponding to interaction by the user identifiers with the messages. The metrics may be generated for each message version, each group of users, and each group combination.

Abstract: Systems and methods for managing multiple voice assistants are disclosed. Audio input is received via one or more microphones of a playback device. A first activation word is detected in the audio input via the playback device. After detecting the first activation word, the playback device transmits a voice utterance of the audio input to a first voice assistant service (VAS). The playback device receives, from the first VAS, first content to be played back via the playback device. The playback device also receives, from a second VAS, second content to be played back via the playback device. The playback device plays back the first content while suppressing the second content. Such suppression can include delaying or canceling playback of the second content.

Abstract: A synchronization protocol for multi-premises hosting of digital content items. In an embodiment, a method includes receiving a first commit request including a first set of one or more identifiers of one or more first content item blocks. The one or more first content item blocks make up a content item stored at a computing device. Further, the method includes, based at least in part on the first commit request, determining a second set of one or more identifiers that includes one or more identifiers of the first set of one or more identifiers not yet stored at a content item block server. The method also includes sending, to the computing device, the second set of one or more identifiers, and receiving a second commit request including the first set of one or more identifiers of the one or more first content item blocks, and an identifier of the content item block server.

Abstract: New methods to represent variables as parts of the classical truth table lead to complete evaluation methods that generate a compiled, efficient version of logical expressions. The new methods are suitable for use in, e.g., relational database applications in which both, efficient query times as well as logical completeness and consistency are required in the context of general constraint treatments. Input/output operations remain linear in the length of the input character strings regardless of the complexity of the logical theory. A new processing method of formulas is described as the basis for the efficiency increase. In order to find a specific truth-value, pattern trees are used representing the extension of the logical theory.

Abstract: An in-memory database server hosting a tenant of a multi-tenant software architecture can receive a definition of a custom data field that is unique to an organization having isolated access to the tenant. The custom data field can extend a standard table defined by central metadata stored at a system tenant of the multi-tenant software architecture. Tenant private metadata that includes the definition can be stored in memory accessible only to the tenant. A tenant-dependent table that includes the custom data field can be formed, for example by retrieving central metadata defining the standard table from the system tenant and adding the custom data field using the definition. The tenant-dependent table can be presented for access via a database client at the organization. Related systems, articles of manufacture, and computer-implemented methods are disclosed.

Abstract: In certain embodiments, techniques are provided (e.g., a method, a system, non-transitory computer-readable medium storing code or instructions executable by one or more processors) to provide data visualization and management services for files stored in a cloud storage system. In some embodiments, a tenant (e.g., an end user, customer, or subscriber to a cloud storage service) can view how their data is stored across data centers within a cloud storage service. A cloud file manager can analyze the tenant's data stored in the cloud storage service, and generate a data visualization interface that provides a fine grained visual representation of the tenant's data across the cloud storage service. In some embodiments, the tenant can define storage profiles and/or modify existing data storage locations dynamically through the data visualization interface. This simplifies data management for the tenants and provides increased flexibility of managing data in the cloud storage service.

Abstract: A computer-implemented method of analyzing text documents, includes identifying a relationship in a text document associated with an entity, building a predictive model from training data, in response to said identifying a relationship, wherein the predictive model includes a prediction error, and determining whether to store the identified relationship in memory, based on the prediction error.

Abstract: A calculation engine of a database management system is described. In some implementations, the calculation engine receives a calculation scenario including a plurality of calculation views comprising one or more relational operations. The calculation engine determines whether a first calculation view includes a second calculation view configured as an operand of one of the relational operations of the first calculation view, and also determines whether the second calculation view comprises a non-relational operation. The calculation engine further converts the plurality of calculation views into a calculation plan via merging the first calculation view with the second calculation view when the first calculation view is determined to comprise the second calculation view as an operand, and replacing the second calculation view with a view search operation when the second calculation view is determined to comprise the non-relational operation.

Abstract: A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and processing circuitry operably coupled to the interface and to the memory. The processing circuitry is configured to execute the operational instructions to perform various operations and functions. The computing device detects memory error(s) associated with memory device(s) of set(s) of storage units (SUs). The computing device processes the memory error(s) to generate a rebuilding priority level for at least some EDS(s) and establishes an EDS scanning rate. The computing device scans the EDS(s) based on the EDS scanning rate. When an EDS error is detected, the computing device updates the rebuilding priority level to generate an updated rebuilding priority level for the at least some of the set of EDSs and facilitates generation at least one rebuilt EDS for the EDS error based on the updated rebuilding priority level.

Abstract: Among other things, techniques and systems are disclosed for providing sync server process. Processing data sync sessions includes processing a request to initiate a sync session from one or more clients to update one or more data records that include one or more data items. The one or more clients are selectively identified as one of a trusted client and an untrusted client based on one or more properties of the sync session, wherein the trusted client is configured to support all dataclasses defined by the server. The one or more clients are detected as being configured to support field level differencing that sends changed data items only for the one or data records or record level differencing that sends all of the data items included in the one or more data records.

Abstract: A method for execution by a device of a dispersed storage network (DSN) to access a set of encoded data slices. The method begins by performing a first distributed agreement protocol (DAP) function using a slice identifier and a first set of coefficients to identify a set of storage units. The method continues by performing a second DAP function using the slice identifier and a second set of coefficients to identify pillar numbers for the set of storage units. The method continues by sending a set of data access requests to the set of storage units in accordance with the pillar numbers, wherein a data access request of the set of data access requests includes a slice name for a corresponding one of the set of encoded data slices and wherein the slice name includes one of the pillar numbers.

Abstract: In creating recommendations for software upgrades in a computing system, a natural language processing module of a software upgrade analyzer system receives risk analysis reports and a corresponding current application source code. The natural language processing module processes the risk analysis report and the current application source code to identify an application programming interface (API) key set containing key terms. A support vector machine of the software upgrade analyzer system identifies key terms in the API key set. An association rule mining module of the software upgrade analyzer system calculates a support factor and a confidence factor for each key term combination of the key terms. The association rule mining module identifies a highest ranking key term combination based on the confidence factor for each key term combination. The software upgrade analyzer system outputs the highest ranking key term combination as a software upgrade recommendation.

Abstract: According to an embodiment, an information processing system includes a server and a client. The server includes a storage, a receiver, and a storage controller. The storage is configured to store data and its version in a record indexed by a key for identifying the record. The receiver is configured to receive, from the client, a write request including write data, requested key for identifying a record where the write data is to be stored, and a write version that indicates a version of the write data. The storage controller is configured to replace the data and its version in the record identified by the requested key with the requested write data and the requested write version, respectively, if the version in the record identified by the requested key is smaller than the write version.

Abstract: Provided are an information processing apparatus, an information processing method, an information processing program, and a recording medium storing thereon the information processing program, which can prevent a transaction disadvantageous to a user or registration of disadvantageous transaction objects. The information processing apparatus extracts a transaction object, which is identical to or related to a transaction object to be selected by a user and with which a condition more advantageous than the corresponding transaction object is associated, from a storing means that stores information on transaction objects referred to in the past time by the user, and presents the extracted transaction object to the user.

Abstract: In a cloud storage system, fast recovery from a crash of a cloud gateway or the cloud storage is afforded without the necessity of traditional garbage collection. Data objects are each broken up into a plurality of chunk objects that are prefixed with a unique non-repeating forever increasing generation number that is incremented for each different data object. The chunk objects of a particular data object are identified and listed in a manifest file that is also associated with that generation number. Upon a crash of either the cloud gateway or the cloud storage, a query identifies the cloud and deletes all orphaned chunk objects prefixed by and all manifest files associated with the prevailing generation number at the time of the crash. The deleted chunk objects and manifest files are regenerated and restored to cloud storage to return to consistency.

Abstract: A cluster allocation bitmap determines which clusters in a band of storage remain unallocated. However, concurrent access to a cluster allocation bitmap can cause CPU stalls as copies of the cluster allocation bitmap in a CPU's level 1 (L1) cache are invalidated by another CPU allocating from the same bitmap. In one embodiment, cluster allocation bitmaps are divided into L1 cache line sized and aligned chunks. Each core of a multicore CPU is directed at random to allocate space out of a chunk. Because the chunks are L1 cache line aligned, the odds of the same portion of the cluster allocation bitmap being loaded into multiple L1 caches by multiple CPU cores is reduced, reducing the odds of an L1 cache invalidation. The number of CPU cores performing allocations on a given cluster allocation bitmap is limited based on the number of chunks with unallocated space that remain.

Abstract: There is provided an information processing device including a schedule acquisition unit configured to acquire a schedule registered by a user, an action-history acquisition unit configured to acquire an action history of the user, and a past-schedule correction unit configured to correct a past schedule among the schedule on the basis of the action history.

Abstract: Techniques are disclosed for processing a data set that is not organized according to a schema being used for organizing data (referred to herein as an “unstructured data set”). An unstructured data set is analyzed based on a group of structured data sets that are organized according to the schema. A particular structured data set is determined to be associated with the unstructured data set. The unstructured data set is stored in association with the particular structured data set. Periodically, the unstructured data set is re-analyzed based on a current version of the group of structured data sets. Additionally or alternatively, an unstructured data set is analyzed based on a particular schema of a set of schemas. A subset of information is extracted from the unstructured data set, and stored in accordance with the particular schema. Periodically, the unstructured data set is re-analyzed based on a current version of the set of schemas.

Abstract: Aspects of the disclosure relate to optimizing data processing across server clusters and data centers using checkpoint-based data replication. A computing platform may determine to initiate a data processing job associated with identifying one or more features of a source dataset, and the data processing job may include multiple processing steps. Based on determining to initiate the data processing job, the computing platform may generate one or more commands directing one or more cluster server nodes associated with a data center to execute the multiple processing steps. The one or more commands may direct the one or more cluster server nodes to update a checkpoint table as each processing step is completed, and may further direct the one or more cluster server nodes to replicate processing results data to at least one other data center. Subsequently, the computing platform may send the generated commands to the cluster server nodes.

Abstract: In various example embodiments, a system and method for dynamically ordering content and discrete content segments are presented. A set of discrete content segments is received having a first order for distributing the set of discrete content segments during a display of a media stream. Event data is received. The event data is representative of a set of events depicted by the media stream. A set of event instances is determined from the event data representing the set of events depicted by the media stream. A second order is generated for the set of content segments based on the set of event instances.

Abstract: Systems and methods include: receiving digital event type data that define attributes of a digital event type; receiving digital fraud policy that defines a plurality of digital processing protocols; transmitting via a network the digital event data and the digital fraud policy to a remote digital fraud mitigation platform; using the digital event data to configure a first computing node comprising an events data application program interface or an events data computing server to detect digital events that classify as the digital event type; using digital fraud policy to configure a second computing node comprising a decisioning API or a decisioning computing server to automatically evaluate and automatically select one digital event processing outcome of a plurality of digital event processing outcomes that indicates a disposal of the digital events classified as the digital event type; and implementing a digital threat mitigation application process flow that evaluates digital event data.

Abstract: A method begins by a processing module receiving updated weighting factors for each of a plurality of storage sets. The method continues with the processing module identifying locally stored encoded data slices of a plurality of locally stored encoded data slices for transfer to one or more storage sets of the plurality of storage sets based on the updated weighting factors. The method continues with the processing module, for each identified locally stored encoded data slice, assigning a transfer priority level. The method continues with the processing module, for each identified locally stored encoded data slice, facilitating transfer of the identified locally stored encoded data slice to the one or more storage sets in accordance with the corresponding assigned transfer priority level.

Abstract: The present disclosure provides systems and methods for Key-Value-Tuple-encoded (KVT-encoded) object storage. In accordance with an embodiment of the invention, chunks of objects, storing payload data or metadata, are persistently stored by servers using KVT-encoded storage. Furthermore, the KVT encoding may be applied to advantageously re-structure content within a distributed object storage cluster, especially for object storage systems that allow payload references to be cached extensively. For such systems, it is of considerable value to honor (use as valid) existing chunk references after the underlying content has been re-structured. Further, the KVT encoding taught herein is completely compatible with a fully-distributed object storage cluster. One embodiment relates to a storage server that includes a persistent storage module that provides a key-value application programming interface that encodes multiple key-value-tuple (KVT) entries for one chunk.

Abstract: A data source software component generator apparatus for generating a representation of one or more data sources for selection from a plurality of data sources to satisfy a data dependency of a software service, each data source including a definition of at least one semantic identifier corresponding to data accessible via the data source, the data sources being represented organized into clusters of multiple data sources based on a semantic association between semantic identifiers of data sources in a cluster, each cluster being represented as one or more data structures, and the data dependency being defined by a specification including one or more semantic identifiers corresponding to data required for execution of the software service, the apparatus comprising: a data source encapsulator unit adapted to encapsulate each cluster as an executable software component; a semantic identifier selection unit adapted to select, from a set of semantic identifiers for all data sources represented in a cluster of a s

Abstract: Disclosed are methods and systems for implementing extensibility in sales prediction engines. An extensibility framework may be used to modify the metadata schema of the data used by the sales prediction engine to account for extended attributes and entities. The sales prediction engine is also modified to recognize the extended attributes and entities so that a user will be able to create new rules and train new models based on the extended attributes and entities.

Abstract: Mechanisms are provided for performing a cognitive operation. An input graph is received having a plurality of first nodes, where subsets of first nodes are coupled to one another via first edges and each first edge has an associated weight. A blinking graph model is generated based on the graph, where blink rates are associated with second edges and are calculated based on weights of corresponding first edges in the input graph. The blink rate specifies a fraction of time a corresponding second edge is determined to be present in the blinking graph model. A relatedness metric is calculated for a target node relative to a node of interest based on the blink rates of the second edges. The relatedness metric indicates a degree of relatedness of the target node to the node of interest. A cognitive operation is then performed based on the relatedness metric.

Abstract: A storage device includes nonvolatile memories and a device controller configured to store data being received from an external device in an internal RAM, according to a command and an address being received from the external device. The device controller controls the nonvolatile memories according to the data stored in the internal RAM, distinguishes whether phase bits received with the data and also stored in the internal RAM are valid, and processes the data stored in the internal RAM when the phase bits are valid.

Abstract: A method, a computer program product, and a computer system for transmitting a hierarchical data file from a first computer device to a second computer device. The first computer device receives a request for transmitting a first hierarchical data file. The first computer device modifies the first hierarchical data file based on a rule based filter. The first computer device receives from the second computer device a list of unique variables whose contents differ from contents in an existing file on the second computer device. The first computer device sends to the second computer device the contents of the unique variables. The contents of the unique variables are saved on the second computer device in a second hierarchical data file. The second hierarchical data file comprises pointers linking to contents of variables that are not the unique variables in the existing file.

Abstract: A method of storing data items may comprise receiving an uncompressed data item for storage from a client process of a plurality of client processes over a computer network; storing the uncompressed data item; acknowledging storage of the data item to the client process and receiving at least one additional uncompressed data item for storage from the client process or from another one of the plurality of client processes. The stored uncompressed data item may then be compressed and stored. Upon receiving a request for access to the data item from one of the plurality of client processes over the computer network, the compressed data item is decompressed before providing the decompressed data item to the requesting client process over the computer network.

Abstract: In various embodiments, methods, systems, and non-transitory computer-readable media are disclosed that allow developers working within desktop applications to create application-specific documents that integrate with web-based applications. Using a desktop integration framework, a developer can design documents having components that provide user interfaces to data associated with data models of the web-based applications. In one aspect, how a component looks and is configured can be dynamically driven at runtime based on metadata of its underlying data model.

Abstract: In various embodiments, methods, systems, and non-transitory computer-readable media are disclosed that allow developers to place popup or list pickers as components of a document using a desktop integration framework. The popup or list pickers can be tied to model metadata allowing a pick list to be dynamically generated when the document is rendered. This allows workbook developers to leverage existing Model layer metadata combined with simple workbook configuration to easily create powerful Search and Select user interfaces for choosing values for ADF Table cells.

Abstract: A processing system for sensing includes a sensor module that includes sensor circuitry coupled to sensor electrodes, the sensor module configured to acquire a sensor frame, and a determination module connected to the sensor electrodes. The determination module is configured to determine a first delta frame from the sensor frame and a first baseline generated using a first processing mode, and determine a second delta frame from the sensor frame and a second baseline generated using a second processing mode. The second processing mode is different than the first processing mode. The determination module is further configured to determine that the first delta frame and the second delta frame are inconsistent with respect to at least one input object. The processing system copies at least a portion of the second baseline to the first baseline based on the first delta frame and the second delta frame being inconsistent.

Abstract: Implementations are provided herein for sending event notifications based on modifications to files and/or directories. When a file is read, modified or changed under the conditions for a registered event notification, a consistency point can be established. An impact list can then be determined based on the target. It can then be determined whether the version of event caches associated with the files and folders identified in the impact list match a global event cache version determined at the time of the consistency point. If the event caches are an old version, the system call can be restarted, and the event caches can be rebuilt to the current version. If the event caches of the impact list are current, the file system operation can be performed, and notifications can be sent based on the set of listeners identified within the current set of event caches.

Abstract: In embodiments, methods and systems for controlling access to custom objects are provided. These techniques for controlling access to custom objects can enable embodiments to utilize a key for the protection of the security of data that is to remain private while not compromising efficiency of a query. The key for a requested custom object is identified and then used so that only an appropriate portion of a custom entity share table is searched to locate access information. It is then determined whether the user can access at least a portion of the custom object, and the appropriate and allowed data is sent to the user.

Abstract: Exemplary methods, apparatuses, and systems divide data into a plurality of portions such that the data is recoverable using a subset of the plurality of portions. For each portion of the data, a storage device different than storage devices storing all other portions of the data is selected. The selecting of storage devices includes distributing the portions of data based upon diversity of geographic locations of storage devices and diversity of storage device characteristics. The storage device characteristics include at least one of hardware characteristics, software characteristics, and operating history characteristics. Each portion of the data is stored on a corresponding selected storage device.

Abstract: A computer-implemented platform may comprise hardware and software configured to allocate crowdsourced resources. An aggregate effort of a plurality of users may be efficiently directed toward a task by allocating resources according to an aggregate distribution of input from the users. The magnitude of the aggregate input of users may be manifest graphically, in a manner that emphasizes information having high priority. A map may include a representation of network comprising a plurality of nodes connected by connections. A node may include a problem and/or a solution, and a connection may describe a relationship between at least two nodes. Aggregate input may be used to revise the map, and analysis of the revised map may yield a resource allocation that directs users toward higher value effort.

Abstract: An apparatus may include a memory device configured to store instructions, and a processing device that, in response to executing the instructions stored in the memory device, may be configured to perform operations. The operations may include identifying a first set of search results associated with a first user and identifying a second set of search results associated with a second user. The first set of search results may be compared with the second set of search results, and the second set of search results may be modified based, at least in part, on the comparison. The processing device may be configured to generate a modified version of the second set of search results that is displayed to the second user.

Abstract: In a method, system, and computer-readable medium having instructions for sharing information between tenants of a multi-tenant database, information is received on a connection between a first tenant of a multi-tenant database and a second tenant and the connection has information on a scope of data from the first tenant shared with the second tenant, data is allowed for a record of the first tenant to be accessible to the second tenant in accordance with the connection, information is received on a file related to the record of the first tenant, and data is allowed from the file to be accessible to the second tenant in accordance with the connection.

Abstract: Techniques for preventing information disclosure via dynamic secure cloud resources are provided. Data (information) remotely housed on a particular cloud resource of a particular cloud is periodically, randomly, and dynamically changed to a different cloud resource within the same cloud or to a different cloud resource within an entirely different cloud. A requesting principal for the data is dynamically authenticated and a current location for the data is dynamically resolved and the principal is securely and dynamically connected to the current cloud resource and current cloud hosting the data for access.

Abstract: A computing device includes at least one processor and at least one module, operable by the at least one processor to receive an communication, determine, based at least in part on the communication, one or more candidate responses to the communication, and receive an indication of user input that selects a candidate response from the one or more candidate responses. The at least one module may be further operable by the at least one processor, responsive to receiving the indication of user input that selects the candidate response, to send the candidate response, determine, based at least in part on at least one of the candidate response and the communication, an operation that is contextually related to the candidate response, and execute the operation.

Abstract: A setup wizard is executable on a controller for a tractor and configured to interact with configuration modules of each implement operable with the tractor. The implements connected to the tractor may be auto detected or manually indicated by an operator. The setup wizard generates an initial series of questions intended to determine the intended use of the implements. The series of questions may be limited to one that requires one of two answers, such as yes/no. Based on the answers to the initial series of questions, the setup wizard may generate still additional questions or begin execution of each of the configuration modules as a function of these answers. The setup wizard may preload settings of an implement, select a portion of the setup screens that need to be reviewed, or provide a visual indication to the operator on the status of each configuration module.

Abstract: An embodiment for method for identifying and selecting events and routing them into the marketing mix, creating event marketing and marketing portfolios. In the method, events may be extracted from a database of events. The extracted events may then be passed through one or more manual or automatic data filters to identify one or more events that correspond to a predetermined goal of an enterprise (e.g., increase sales, increased product recognition, etc). Information concerning the corresponding events may then be provided in the form of a report.

Abstract: A single virtual machine is implemented upon a computer and an operating system executes within this virtual machine. A sample file suspected of being malware is received and any number of versions of the software application corresponding to the sample file are installed. Each version of the software application is executed within the operating system, each version opening the sample file. Behavior of each version and of the sample file is collected while each version is executing. A score indicating malicious behavior for each version with respect to the sample file is determined and reported. The versions may execute serially in the happening system, each version terminating before the next version begins executing. Or, all versions may execute concurrently within the operating system. Files and registries are hidden to facilitate installation. System information is changed to facilitate execution.