Abstract: Deterministic Finite Automatons (DFAs) and Nondeterministic Finite Automatons (NFAs) are two typical automatons used in the Network Intrusion Detection System (NIDS). Although they both perform regular expression matching, they have quite different performance and memory usage properties. DFAs provide fast and deterministic matching performance but suffer from the well-known state explosion problem. NFAs are compact, but their matching performance is unpredictable and with no worst case guarantee. A new automaton representation of regular expressions, called Tunable Finite Automaton (TFA), is described. TFAs resolve the DFAs' state explosion problem and the NFAs' unpredictable performance problem. Different from a DFA, which has only one active state, a TFA allows multiple concurrent active states. Thus, the total number of states required by the TFA to track the matching status is much smaller than that required by the DFA.

Abstract: An aspect of the present invention simplifies grouping of data items previously stored in a database, the data items being stored in the form of rows and columns in respective tables (in the database). In one embodiment, a system displays a cross product of values from two or more columns in the form of multiple lines, where each line contains a respective value from each of the two or more columns to specify a corresponding criterion (combination of values). In response to receiving inputs indicating the respective groups for each of the lines, the system determines a group for each data item (stored in the database) based on the received inputs. A user is accordingly required to only specify the desired groups corresponding to various combinations of values of the columns to cause grouping of data items in the database.

Abstract: Techniques are provided that address the problems associated with prior approaches for clustering a fact table in a relational database management system. According to one aspect of the invention, a database server clusters a fact table in a database based on one or more dimension tables. More specifically, rows are stored in the fact table in a sorted order and the order in which the rows are sorted is based on values in one or more columns of one or more of the dimension tables. A user specifies the columns of the dimension tables on which the sorted order is based in “clustering criteria”. The database server uses the clustering criteria to automatically store the rows in the fact table in the sorted order in response to certain user-initiated database operations on the fact-table.

Abstract: A system, method, and computer-readable medium that facilitate classification of database requests as problematic based on estimated processing characteristics of the request are provided. Estimated processing characteristics may include estimated skew including central processing unit skew and input/output operation skew, central processing unit duration per input/output operation, and estimated memory usage. The estimated processing characteristics are made on a request step basis. The request is classified as problematic responsive to determining one or more of the estimated characteristics of a request step exceed a corresponding threshold. In this manner, mechanisms for predicting bad query behavior are provided. Workload management of those requests may then be more successfully provided through workload throttles, filters, or even a more confident exception detection that correlates with the estimated bad behavior.

Abstract: The invention teaches systems, methods and devices for searching data storage systems and devices by a topical category known as a theme. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. 37 CFR 1.72(b).

Abstract: A user of a network-based system may correspond to a user profile that describes the user. The user profile may describe the user using one or more descriptors of items that correspond to the user (e.g., items owned by the user, items liked by the user, or items rated by the user). In some situations, such a user profile may be characterized as a “taste profile” that describes an array or distribution of one or more tastes, preferences, or habits of the user. Accordingly, the user profile machine within the network-based system may generate the user profile by accessing descriptors of items that correspond to the user, clustering one or more of the descriptors, and generating the user profile based on one or more clusters of the descriptors.

Abstract: Methods and systems for recommending social networking connections are disclosed. Information is received from a mobile device relating to software applications that are installed on a first user's mobile device. A weight for each software application is calculated based on usage information and each software application is designated to at least one category. A priority is calculated for each category based at least in part on respective weights of software applications designated to the category. A second user, who is not connected to the first user, is detected, wherein the second user has a predetermined number of categories that are the same as the first user's categories, and wherein priorities corresponding to the second user's categories are within a predetermined range of priorities corresponding to the first user's categories. A recommendation to connect with the second user is provided to the first user.

Abstract: Techniques, an apparatus and an article of manufacture for distributed scalable clustering and community detection. A method includes generating a label for each node in a graph, wherein said label identifies a community in which a node participates, propagating each label locally within two or more segments of the graph based on a participation percentage of each node in at least one identified community within the graph, and deriving at least one cluster of nodes in the graph that corresponds to the at least one identified community based on said propagating.

Abstract: According to one embodiment, an apparatus stores a plurality of datapoints. A datapoint comprises a first value and a second value that depends upon the value of the first value. The apparatus associates the datapoint with a group from a plurality of groups. The group is associated with an identifying range and the datapoint is associated with the group based at least in part upon the first value of the datapoint and the identifying range of the group. The apparatus calculates a median of the second values of the datapoints associated with the group and a performance value by performing a regression based at least in part upon the identifying range and the calculated median of the group. The apparatus determines that the performance value exceeds a baseline value and in response, presents, on a display, an illustration depicting the identifying range and the associated median of the group.

Abstract: Techniques are described for performing grouping and aggregation operations. In one embodiment, a request is received to aggregate data grouped by a first column. In response to receiving the request, a group value in a row of a first column is mapped to an address. A pointer is stored for a first group at a first location identified by the address. The pointer identifies a second location of a set of aggregation data for the first group. An aggregate value included in the set of aggregation data is updated based on a value in the row of a second column.

Abstract: A user creates an event in a social networking system specifying a location, a time, and a guest list of other users invited to the event. The social networking system generates a page associated with the event that provides information about the event and identifies whether users have responded to invitations to the event. The content of the page may be customized for the user viewing the page to encourage the viewing user to attend the event. For example, the viewing user's relationship to and/or similar characteristics with other users on the guest list is determined and used by the social networking system to identify the users whose responses to invitations are shown to the viewing user via the page. Additionally, a notification method more prominently distributes acceptances of invitations to other users to encourage attendance.

Abstract: A method for computerized batching of huge populations of electronic documents, including computerized assignment of electronic documents into at least one sequence of electronic document batches such that each document is assigned to a batch in the sequence of batches and such that there is no conflict between batching requirements, the following batching requirements being maintained by a suitably programmed processor: a. pre-defined subsets of documents are always kept together in the same batch, b. batches are equal in size, c. the population is partitioned into clusters, and all documents in any given batch belong to a single cluster rather than to two or more clusters.

Abstract: Techniques for facilitating a similarity search of digital assets (e.g., audio files, image files, video files, etc.) are described. Consistent with some embodiments, a cloud-based search service manages one or more search tree data structures for use in organizing digital assets to make the digital assets searchable. Each digital asset is associated with a feature vector based on the various attributes and/or characteristics of the digital asset. The digital assets are then assigned to leaf nodes in one or more search tree data structures based on a measure of the distance between the feature vector of the digital asset and a virtual feature vector associated with a leaf node. When a search for similar digital assets is invoked, a prioritized breadth first search of a search tree is performed to identify the digital assets having the feature vectors closest in distance to the reference digital asset.

Abstract: Defining relationships are described. Defining relationships can include retrieving a number of event notifications that correspond to a number of nodes. Defining relationships can include defining a number of group patterns that correspond to the number of event notifications. Defining relationships can also include grouping the number of nodes into a number of groups that correlate with the number of group patterns, the number of groups defining a number of relationships between the number of nodes. Defining relationships can include assigning a number of weights to the number of relationships between the number of nodes, wherein the number of weights are based on a strength of the number of relationships between the number of nodes.

Abstract: Embodiments for a method for ranking social quality of content published on a plurality of web pages are provided. In an embodiment, the method includes receiving at least one log record from a tracking component on at least one web page. The one log record is indicative of at least one user activity on the at least one web page. The method further includes aggregating the at least one log record corresponding to preferably each of the plurality of web pages based on one or more parameters. The method also includes assigning a first score for preferably each of the plurality of web pages based on the aggregating. The first score is indicative of a social quality of content published in the at least one web page. The method includes ranking the plurality of web pages based on the first score.

Abstract: Methods and apparatuses for assessing user interest scores of users of a mobile network are provided. A method includes for each of a plurality of users (A) determining initial interest scores corresponding to user's interests and interest scores of friends of the user for the user's interests, based on browsing information, and (B) assessing user's interest scores based on the initial interest scores, the interest scores of the friends and friends' influence. The method further includes outputting a list including a subset of the users selected based on the user's interest scores.

Abstract: A method and system for mining a database for product migration analysis includes querying product usage data for a legacy product and a new product from the database as time series data. The product usage data is representative for a large number of consumers of the legacy and new products. A mathematical model may be used to determine a relationship between the two time series data. Product migration values and other features related to product migration, such as a transition period of product usage, may be estimated, determined or predicted.

Abstract: Methods and/or systems are provided that may be utilized to rank categories of an entity based at least in part on relevance.

Abstract: A technique of extracting hierarchies for multilabel classification. The technique can process a plurality of labels related to a plurality of documents, using a clustering process, to cluster the labels into plurality of clusterings representing a plurality of classes. The technique classifies the documents and predicts a plurality of performance characteristics, respectively, for the plurality of clusterings. The technique selects at least one of the clusterings using information from the performance characteristics and adds the selected clustering into a resulting hierarchy.

Abstract: Disclosed are methods and apparatus for correlating metadata from a plurality of different sources. The methods and apparatus may use an order for the data sources. The metadata from each of the data sources may be divided or split into one or more chunks. The metadata from each of the chunks may be filtered and sorted, e.g., to ensure that the metadata relate to the same multimedia content. The metadata chunks from the first data source in the order and the second data source in the order may then be aligned to produce currently aligned metadata. The metadata data chunks from the next data source in the order may then be aligned with the currently aligned metadata to produce new currently aligned metadata. This process may be repeated until the metadata from all of the sources are aligned, thereby providing a set of correlated metadata.

Abstract: Embodiments of an inspection system and method for a collection of information objects, for example, a collection of executable software applications may be inspected for computer viruses, or a collection of genomes may be inspected for common or unique gene sequences. Information objects may contain identified sequences of instructions, each of which may be labeled with a symbol. In the software context, programming languages may include symbols that indicate functionality. In some embodiments, an inspection of the statistical properties of the information objects and their included symbols may allow for the symbols (and thus instruction sequences) to be grouped into logical components. In some embodiments, objects that include individual logical components may be grouped together. These groupings and their dependencies may be used to determine the structure of each object by detailing its constituent components, how they relate or depend on one another, and how the information object may function.

Abstract: Disclosed are methods and apparatus for processing correlated metadata (e.g., programmatic metadata relating to one or more episodes of a television show). Mappings, or correlations, between chunks of the metadata that originated from a particular data source and the metadata clusters may be determined and displayed, e.g., on a graphical user interface. Using this display, a user (i.e., a human operator) may detect inconsistencies in the correlated metadata. An inconsistency may be an incorrect mapping, the mapping of more than one of the metadata chunks that originated from the same data source to the same metadata cluster, or that one or more of the metadata chunks have not been mapped to a metadata cluster. The mappings may then be edited so as to remove detected inconsistencies.

Abstract: Method, apparatus, and programs for recommending websites. Information related to a user's browsing history of a plurality of websites is obtained. A browsing co-occurrence of at least some of the plurality of websites in one or more time periods is determined based on the obtained information related to the user's browsing history. The plurality of websites are assigned to a plurality of website groups based on the determined browsing co-occurrence. Each of the plurality of website groups is associated with one of the one or more time periods. At least one of the plurality of website groups is presented to the user based on their associated time periods.

Abstract: A contents distribution server using an identification code of contents is disclosed. The apparatus includes an interface providing unit configured to provide an interface for registration of the contents to a device, if a request for the registration of the contents is received from the device; an code information extraction unit configured to extract code information from input information through the interface; an identification code generation unit configured to generate the identification code by combining codes corresponding to the extracted code information, and a contents distribution unit configured to match the contents with the generated identification code, register the matched contents in a database and transmit the registered contents to a contents managing server with reference to the identification code.

Abstract: A system and method of managing online social networking which includes identifying a plurality of users related to a primary user on a social networking tool using a computer. The method and system identifies a plurality of activities performed by the plurality of users on the social networking tool, and assigning a score to each of the activities. A threshold cumulative score for users to enter a group is defined. The system and method evaluates the activities of each of the users, and calculates a cumulative score for each of the users based on their respective activities, and evaluates the cumulative score of each of users in relation to the group. One or more of the plurality of users who meet the threshold cumulative score are assigned to the group. A status for each user in the group based on their cumulative score is determined.

Abstract: Embodiments of the invention include methods for identifying one or more clusters in a streaming graph, the method includes receiving a stream of edges and sampling the stream of edges to create a structural reservoir and support reservoir. The method also includes creating a sampled graph from the structural reservoir and identifying the one or more clusters in the sampled graph by grouping one or more connected vertices in the sampled graph.

Abstract: A system for clustering vertices in a streaming graph includes a structural sampler configured to receive a stream of edges. The structural sampler includes a reservoir manager configured to receive the stream of edges and create a structural reservoir and a support reservoir and a graph manager configured to receive the structural reservoir from the reservoir manager and to create a sampled graph from the structural reservoir, wherein the sampled graph includes one or more clusters that each include one or more connected vertices.

Abstract: A method for automatically extracting and organizing information by a processing device from a plurality of data sources is provided. A natural language processing information extraction pipeline that includes an automatic detection of entities is applied to the data sources. Information about detected entities is identified by analyzing products of the natural language processing pipeline. Identified information is grouped into equivalence classes containing equivalent information. At least one displayable representation of the equivalence classes is created. An order in which the at least one displayable representation is displayed is computed. A combined representation of the equivalence classes that respects the order in which the displayable representation is displayed is produced.

Abstract: Embodiments of the invention relate to a modeling activity area associated with groups of data items. Tools are provided to profile activity area involvement, both from the data item and from associated participants. The data items are placed into clusters and one or more activity areas are derived from the formed clusters. Each activity area is defined from the perspective of a single user. Participants in an activity area are connected to a user, but not necessarily to each other. The combination of formations of clusters and activity areas provides a multi-facetted organization of connections between data items and associated participants.

Abstract: Embodiments of the invention relate to modeling communities associated with groups of data items. Tools are provided to iteratively assign data items to communities and to update topic and participant distribution in the assigned communities. As the distributions are updated, the characteristics of the communities are updated. Each activity area is defined from the perspective of a single user. Participants in a community are connected to a user, but not necessarily to each other. The combination of formations of communities and the statistical aspect of evaluating characteristics of the communities provides a multi-facetted organization of connections between data items and associated participants.

Abstract: The disclosure generally describes computer-implemented methods, software, and systems for providing a homogeneous data model based on in-memory database views. One computer-implemented method includes creating an application view field associated with an application view, indicating a base database field in a base database table for the created application view field, collecting additional information associated with the indicated base database field, determining at least a data element and a domain associated with the indicated base database field using the collected additional information, determining, by operation of a computer using the collected additional information, that multiple determined catalog entries associated with the indicated base database field exist in a catalog, and proposing names for the application view field, wherein the proposed names are presented from most specific to least specific.

Abstract: A system and method obtain a database stored on a storage device containing information on multiple assets, the information including measurements taken from devices monitoring each asset, and context information corresponding to the environment the items are subjected to. The system and method groups assets via a computer system into a homogenous group as a function of selected context information and performs analytics via the computer system on the grouped assets to manage the assets.

Abstract: A method and a system for coreference resolution are provided. The method includes receiving a set of document clusters, each cluster in the set of document clusters including a set of text documents. Instances of each of a set of candidate named entities are identified in the document clusters. For a pairs of the candidate named entities, at least one socio-temporal feature is computed that is based on the similarity of the distributions of identified instances of the respective candidate name entities among the document clusters. A decision for merging for the candidate named entities into a common real named entity is based on the socio-temporal features.

Abstract: A method, system and computer program product for controlling enterprise data on mobile devices. Data on a mobile device is tagged as being associated with either enterprise data or with personal data. Upon identifying the storage location of the tagged data and the identifier of the application that generated the tagged data, the tag, the storage location of the tagged data and the identifier of the application are stored in an index. A mobile agent residing on the mobile device may be directed by a mobile device management server of the enterprise to perform various actions (e.g., deleting, encrypting, backing-up) on the enterprise data using the index. In this manner, the enterprise has the ability to control their applications and data that resides on employees' mobile devices to ensure that such data is not lost or used in a manner that is contrary to the wishes of the employer.

Abstract: Method, system, and programs for providing identifiers to objects. Input data representing a plurality of objects is received and categorized into a plurality of entity categories. A first graph of entities is generated using the plurality of entity categories. The first graph of entities are matched with a second graph of entities. A comparison of object pairs is then made, in which each object pair includes a first object from the first graph of entities and a corresponding second object from the second graph of entities. Identifiers are assigned to each object based on comparing the object pairs.

Abstract: Systems, methods and computer program products manage collections of information using latent semantic analysis. The collections of information may be text based such as collections of documents or non-text data such as audio, image, video or multimedia data. Semantic information groups are created by grouping collections of information according to a degree of relatedness. A system allocates discontiguous node locations of one or more distributed databases to the semantic information groups. The system manages a dynamic semantic table that maps the discontiguous node locations to a semantic virtual table having a contiguous memory space.

Abstract: A classification system executing on one or more computer systems includes a processor and a memory coupled to the processor. The memory includes a discovery engine configured to navigate through non-volatile memory storage to discover an identity and location of one or more files in one or more computer storage systems by tracing the one or more files from file system mount points through file system objects and to disk objects. A classifier is configured to classify the one or more the files into a classification category. The one or more files are associated with the classification category and stored in at least one data structure. Methods are also provided.

Abstract: A monitoring system includes a database storing configuration information about a plurality of objects in the data center; a first inventory instance that adds a first object to the database, where the first inventory instance classifies the first object based on a set of classification rules to select a set of monitoring rules for the first object based on its classification and add configuration information about the first object to the configuration database; and a first monitoring instance to monitor the first object, the monitoring instance monitoring status of the first object based on respective configuration information in the database; at least one of the first inventory instance and the first monitoring instance identifying a further object functionally connected to the first object, the further objects added to the database by the first or a second inventory instance and monitored by the first or a second monitoring instance.

Abstract: A system for extracting customer feedback from a microblog site includes a retrieval unit coupled to the microblog site to capture microblog updates. A filter unit coupled to the retrieval unit filters the captured microblog updates according to filter criteria that remove non-actionable items from the captured microblog updates. A learning unit coupled to the filter unit prioritizes the filtered microblog updates, and a classification unit coupled to the learning unit classifies the filtered and prioritized microblog updates. An action unit coupled to the classification unit performs appropriate actions based on the classified, filtered and prioritized microblog updates.

Abstract: A system is disclosed for automation-assisted curation of technical information from technical support tickets into a technical information knowledge base. In one example, a method includes mapping information from a plurality of fields of a support ticket in a technical support reporting tool to a plurality of corresponding fields of a structured information file. The method further includes rendering the structured information file in a user-editable format in a user interface; saving user inputs to the structured information file, thereby generating a curated structured information file that incorporates the mapped information and the user inputs; and saving the curated structured information file to a searchable technical support information data store.

Abstract: A security application manages security and reliability of networked applications executing collection of interacting computing elements within a distributed computing architecture. The security application monitors various classes of resources utilized by the collection of nodes within the distributed computing architecture and determine whether utilization of a class of resources is approaching a pre-determined maximum limit. The security application performs a vulnerability scan of a networked application to determine whether the networked application is prone to a risk of intentional or inadvertent breach by an external application. The security application scans a distributed computing architecture for the existence of access control lists (ACLs), and stores ACL configurations and configuration changes in a database.

Abstract: A knowledge extraction framework may iteratively enrich an ontology that is used to classify structured knowledge obtained from web pages based on structured knowledge previously acquired from other web pages. The framework may enable a user to define the ontology for extracting structured knowledge from a plurality of web pages. The framework applies the ontology using a supervised extraction algorithm to extract seed information from a set of web pages. The framework further applies an unsupervised extraction algorithm to extract the structured knowledge from an additional set of web pages. The framework subsequently maps the structured knowledge to the ontology based on the seed information to enrich the ontology.

Abstract: A canopy clustering process merges at least one set of multiple single-center canopies together into a merged multi-center canopy. Multi-center canopies, as well as the single-center canopies, can then be used to partition data objects in a dataset. The multi-center canopies allow a canopy assignment condition constraint to be relaxed without risk of leaving any data objects in a dataset outside of all canopies. Approximate distance calculations can be used as similarity metrics to define and merge canopies and to assign data objects to canopies. In one implementation, a distance between a data object and a canopy is represented as the minimum of the distances between the data object and each center of a canopy (whether merged or unmerged), and the distance between two canopies is represented as the minimum of the distances for each pairing of the center(s) in one canopy and the center(s) in the other canopy.

Abstract: A method is provided in one example embodiment and it includes receiving a state request and determining whether a state exists in a translation dictionary for the state request. The method further includes reproducing the state if it is not in the dictionary and adding a new state to the dictionary. In more specific embodiments, the method includes compiling a rule, based on the state, into a given state table. The rule affects data management for one or more documents that satisfy the rule. In yet other embodiments, the method includes determining that the state represents a final state such that a descriptor is added to the state. In one example, if the state is not referenced in the algorithm, then the state is released. If the state is referenced in the algorithm, then the state is replaced with the new state.

Abstract: Computer program products and systems are provided for mining for sub-patterns within a text data set. The embodiments facilitate finding a set of N frequently occurring sub-patterns within the data set, extracting the N sub-patterns from the data set, and clustering the extracted sub-patterns into K groups, where each extracted sub-pattern is placed within the same group with other extracted sub-patterns based upon a distance value D that determines a degree of similarity between the sub-pattern and every other sub-pattern within the same group.

Abstract: Methods, computer program products and systems are provided for mining for sub-patterns within a text data set. The embodiments facilitate finding a set of N frequently occurring sub-patterns within the data set, extracting the N sub-patterns from the data set, and clustering the extracted sub-patterns into K groups, where each extracted sub-pattern is placed within the same group with other extracted sub-patterns based upon a distance value D that determines a degree of similarity between the sub-pattern and every other sub-pattern within the same group.

Abstract: Systems and methods are described that calculate the interestingness of a set of one or more records in a database, either absolutely (i.e., compared to an overall collection of records) or relative to some other set of records. In one embodiment, the measure is a relative entropy value that has been normalized. Various applications of the measure are described in the context of an information retrieval system. These applications include, for example, guiding query interpretation, guiding view selection and summarization, intelligent ranges, event detection, concept triggers and interpreting user actions, hierarchy discovery, and adaptive data mining.

Abstract: The invention provides in some aspects methods of digital data processor-based analysis of digital data that represent interactions to identify distinct individuals and/or the entities with which they are affiliated (e.g., households, businesses, social or other groups) involved in those interactions. The methods can be employed, for example, to analyze digital data representing retail purchase, marketing and visitor interactions for tracking and/or reporting purposes.

Abstract: An approach for enabling mobile device users to acquire information regarding events in their proximity on demand is described. An event determination platform processes and/or facilitates a processing of captured data (e.g., images, audio, video, etc.) that depict, at least in part, one or more events to determine one or more characteristics of the one or more events, the captured data, or a combination thereof. The event determination platform further causes, at least in part, an identification of one or more events based, at least in part, on a comparison of the one or more characteristics against one or more other characteristics associated with one or more registered events.

Abstract: A method for identifying an auto-complete communication pattern within a sequence of request entities includes grouping the request entities into a plurality of clusters according to a criterion. Clusters are removed from the plurality according to at least one of pattern analysis, a cluster size, and a cluster timing. Remaining clusters are identified as having an auto-complete communication pattern.