КОНСТРУИРУЕМЫЙ ПОТОК ДАННЫХ ДЛЯ УЛУЧШЕННОЙ ОБРАБОТКИ СОБЫТИЙ

Изобретение относится к обработке событий. Технический результат – обеспечение улучшенной обработки событий. Способ для улучшенной обработки событий содержит этапы, на которых принимают запрос на улучшенную обработку событий, причем запрос на улучшенную обработку содержит индикатор входных данных из источника данных в базе данных, осуществляют доступ с использованием конструируемого потока данных к входным данным, указываемым в запросе, при этом конструируемый поток данных предоставляет доступ к совокупности моментальных снимков во времени данных в базе данных из источника данных в базе данных, формируют вывод для запроса на улучшенную обработку событий на основе входных данных, к которым осуществляется доступ с использованием данных конструируемого потока данных. 3 н. и 7 з.п. ф-лы, 5 ил.

ОПРЕДЕЛЕНИЕ ПОИСКОВЫХ ЗАПРОСОВ ДЛЯ ПОЛУЧЕНИЯ ИНФОРМАЦИИ В ПРОЦЕССЕ ПОЛЬЗОВАТЕЛЬСКОГО ВОСПРИЯТИЯ СОБЫТИЯ

Изобретение относится к области вычислительной техники. Техническим результатом является обеспечение предоставления пользователю информации, релевантной событиям. Раскрыт машинореализуемый способ предоставления пользователю информации, релевантной событиям, содержащий этапы, на которых: получают данные, показывающие, какие поиски выполнялись посредством услуги поиска, когда медиа-услугой выводились различные типы событий, которые воспринимались пользователями множества вычислительных устройств; определяют на основе этих данных популярные поисковые запросы, посредством которых осуществлялся поиск данным множеством вычислительных устройств, в то время как пользователи воспринимали один и тот же тип события; формируют на основе упомянутых популярных поисковых запросов правило машинно–обучаемой модели, которое задает конкретный поисковый запрос из этих популярных поисковых запросов, чтобы выполнять его, когда произойдет конкретное действие при восприятии пользователем вычислительного устройства ...

VORRICHTUNG ZUR BEWERTUNG DER PRIORITÄT VON ANOMALIEDATEN UND VERFAHREN ZUR BEWERTUNG DER PRIORITÄT VON ANOMALIEDATEN

Es ist Folgendes bereitgestellt: eine Generierungseinheit von datenbezogenen Informationen (15) zum Generieren von datenbezogenen Informationen DL einschließlich von Detektionsdaten und Klimaanlageninformationen von Klimaanlagen (3); eine Einheit für die Klassierung in Klassen (17) zum Erzeugen von mehreren Klassen auf der Basis der Klimaanlageninformationen, die mit den Alarmdaten in Beziehung stehen, die von einer Alarmdaten-Extrahierungseinheit (14) unter den Klimaanlageninformationen extrahiert wurden, und zum Klassieren der datenbezogenen Informationen DL in die mehreren Klassen; eine Prioritätseinstellungseinheit (18) zum Einstellen der Priorität an jeden aus mehreren Typen von Alarmdaten und die mehreren Klassen; und eine Prioritätsberechnungseinheit (19) zum Bewerten des gleichzeitigen Auftretens von Anomaliedaten, die von einer Anomaliedaten-Extrahierungseinheit (13) extrahiert wurden, und der Alarmdaten, Bewerten des gleichzeitigen Auftretens der Alarmdaten und der mehreren Klassen ...

Multi-granulatory hierarchical aggregate selection based on update, storage and response constraints

Time in databases and applications of databases

In one embodiment, a method of providing entities of a database with a time dependent value for an attribute of the entity is disclosed. The method in that embodiment comprises: i. having values of attributes of said entities in said database; ii. for said entities providing a valid time start time associated with each said value of said attribute; iii. for said entities providing a valid time end time associated with each said value of said attributes; iv. for said entities providing a transaction time associated with said valid time start time and said valid time end time for each said value; whereby v. when querying said database an appropriate said transaction time is used so as to ensure that an appropriate value for said attribute is used and that appropriate valid time start and end times are used.

System and method for monitoring evolution over time of temporal content

System, device, and method for processing of three-dimensional time series data

The present invention provides a system, a device, and a method for generating and displaying data for the purposed of displaying related electronic information included in transmitted or received electronic information, in such a way that associations thereof may be readily understood. This three-dimensional time series data processing system (1) selects a set of electronic information; from an electronic information DB (51), extracts electronic information associated with the selected electronic information selected thereby; calculates a degree of association of the transmission source of the selected electronic information and the transmission source of the extracted electronic information extracted thereby; and generates three-dimensional time series data for three-dimensional depiction of relationships of the selected electronic information and the extracted electronic information, in terms of the respective position information for the extracted electronic information in a virtual ...

Determining trends for a user using contextual data

A method of prioritising event data, in particular for calendar applications, comprises i) accessing, using a processor, a user profile based on user context information, wherein the user context information utilizes user device events; ii) preparing a list of items based on the user profile related to a particular time period organized according to importance based on the user profile; and iii) presenting the list of items related to the particular time period. The method includes deriving contextual data from a variety of sources 301 such as communications received, purchasing activities, locations visited, and internet or device searches and building a user profile 302. A relevance pass will cover a given data or time range and, in association with the user profile, event items relevant to the user are determined 303 and prioritized 304. The method is intended to provide a mechanism for determining what is of interest or trending for the user right now and prioritizing a calendar event ...

Methods and systems for updating information in a timeline of a public safety incident

Detection and visualization of temporal events in a large-scale patient database

MALICIOUS THREAT DETECTION THROUGH TIME SERIES GRAPH ANALYSIS

Malicious threat detection through time-series graph analysis, in which a data analysis device receives a data file including multiple log data entries. The log data entries include parameters associated with a computer network event in a computing network. The data analysis device produces a graphical model of the computing network based on at least one parameter included in the log data. The data analysis device also identifies a parameter associated with a node of the computer network represented by the graphical model, and performs a time-series analysis on the parameter. The data analysis device further determines, based on the time-series analysis on the parameter, at least one of an anomalous event associated with the computing network or a malicious event associated with the computing network. RECEIVE LOG DATA ENTRIES INCLUDING PARAMETERS/FIELDS ASSOCIATED WITH COMPUTER NETWORK EVENTS 302 PRODUCE GRAPHICAL MODEL TO GENERATE AT LEAST ONE TIME-SERIES FEATURE FROM THE LOG DATA ENTRIES ...

Method and apparatus for producing sequenced queries

EVENT CORRELATION

Event correlation may include identifying a feature set for each log file of a plurality of log files, and extracting the feature set for each event of a plurality of events in each log file of the plurality of log files. Event correlation may further include determining a plurality of trace event pairs linkage strength values for an event from a first log file of the plurality of log files and a plurality of events from a second log file of the plurality of log files. The trace event pairs linkage strength values may represent an overlap of the feature set for the event from the first log file and the feature set for each of the plurality of events from the second log file. -a . a > 3 1.. - .0 co e 2 -Z 75a oa o.o -JLuJ o o o czo So -0 n> Li 83 COI cco co Ua z8 0 2 xc a toLL o - o C)) a C E 8U Ec _ cMo W(o 1 Li-g o o o o o a) a ...

SYSTEM AND METHOD FOR GENERATION OF ATTRIBUTE DRIVEN TEMPORAL CLUSTERING

System and methods for rapid generation of attribute driven temporal clustering are provided. In one embodiment, the system includes a data storage device and a server. The data storage device may be configured to store a database comprising a plurality of records. The system may also include a server in data communication with the data storage device. The server may be suitably programmed to receive a first attribute and a second attribute, search a database stored on a data storage device to obtain a first group of records associated with the first attribute, search the first group of records to obtain a second group of records associated with the second attribute, determine a temporal relationship between a first index date of a first attribute and a second index date of the second attribute, and generate an output comprising a graphical representation of the temporal relationship.

TIME-SERIES PATTERN MATCHING SYSTEM

A system includes a pattern engine that, in response to selection by a user of a first data set, generates a similarity self-join of the first data set for a specified length. The similarity self-join indicates, for each reference subsequence, a minimum value of distances between the reference subsequence and other subsequences within the first data set. A user portal generates a user interface visually representing the first data set and identifying two subsequences that correspond to the lowest value of the similarity self-join. An alert system receives an alert request specifying a second data set and a pattern specification. An incremental pattern engine generates an initial state of a similarity join of the second data set and the pattern specification. In response to data being received for the first data set, the alert system transmits an alert message if any value of the similarity join meets a threshold.

SCALABLE DATABASE SYSTEM FOR QUERYING TIME-SERIES DATA

A database system stores data as hypertables that represent partitioned database tables. Each hypertable comprises chunks of data that may be distributed across multiple locations, each location comprising at least a storage device. The database system provides an interface that allows database queries seamlessly to hypertables as well as standard tables. The database system dynamically creates chunks as records are added to a hypertable. The database system defines a new partitioning strategy if the storage configuration of the database system is changed by adding new locations or removing existing locations. The records added to the hypertable before the storage configuration was changed continue to be stored as chunks distributed according to the previous partitioning policy.

AUTOMATED INTEGRATION OF VIDEO EVIDENCE WITH DATA RECORDS

A computer system receives event data associated with data records in a database, receives metadata corresponding to a digital media content file (e.g., a video, audio, or image file), compares the event data with the metadata, automatically identifies a matching event based on the comparison, and automatically tags the content file by modifying the metadata based on event data associated with the matching event. In one usage scenario, the digital media content file may be used as evidence in a criminal investigation. The event data may be provided in the form of a summary or snapshot of the database, which may include data records covering a limited period of time. The digital media content file can be recorded by any suitable digital media device, such as a video camera. The computer system may further include a dock configured to upload digital media content received from the digital media device.

MANAGING STORAGE OF DATA FOR RANGE-BASED SEARCHING

In general, a value of a numerical attribute of a record stored in a data structure is received. A numerical range is generated that includes the value of the numerical attribute. An entry is stored, in an index (204)associated with the data structure, that specifies a location of the record within the data structure and that includes a first index key (1006) and a second index key (1008). The first index key (1006) corresponds to a value of an attribute of the record different from the numerical attribute, and the second index key (1008) corresponds to the generated numerical range.

Advanced insights explorer

A platform includes a time series database. The platform also includes one or more instance data tables. A function library of the platform includes a set of function definitions and a scripting engine of the platform executes scripts. An advanced insight endpoint of the platform is communicatively coupled to and accessible by an advanced insights explorer user interface. The advanced insight endpoint receives one or more expressions from an expression component of the advanced insights explorer user interface, parses the one or more expressions and validates the one or more expressions against the set of function definitions. The endpoint generates and provides one or more scripts corresponding to the one or more expressions and receives results of execution the one or more scripts. Results are provided to a visualization component of the advanced insight user interface, to cause rendering of the results within the advanced insights explorer user interface.

SYSTEM AND METHOD FOR COLLABORATIVE KNOWLEDGE STRUCTURE CREATION AND MANAGEMENT

A collaborative, semantic-based knowledge structure creation and management system and method are provided. The system and method may include knowledge structures which include concept based maps which may be linked according to topic, relationship types, conceptual equivalence, and temporally. The knowledge structures may be managed by users, wherein users may perform at least one of adding a new concept, creating a new relationship, confirming an existing relationship, and breaking an existing relationship.

Processing a query via a lambda application

An approach is described of query processing via a lambda application including a batch processing layer and a speed processing layer. The approach may improve speed and efficiency with respect to computation of query results associated with the batch processing layer. A method pertaining to such approach may include receiving a query including an initial timeframe and computing partial query results within the initial timeframe. The partial query results within the initial timeframe may include a result for data associated with the speed processing layer and results for a first set of data segments associated with the batch processing layer. The method further may include combining the partial query results within the initial timeframe into a final query result. The method further may include computing partial query results outside of the initial timeframe including results for a second set of data segments associated with the batch processing layer.

CASE DATA VISUALIZATION APPLICATION

A case data visualization application is provided that, when executed on a device, allows a user to visualize a chronology of events associated with a case, view a summary of one or more supporting details of an event, and drill-down to view specific case data of each supporting detail of an event. Thus, the case data visualization application provides a way of collecting, organizing, visualizing, and sharing data associated with a case. Furthermore, the case data visualization application allow a plurality of users to collaborate on the case, and synchronizes a plurality of supporting details created by a plurality of users that are associated with an event.

PROGRESSIVE QUERY COMPUTATION USING STREAMING ARCHITECTURES

The described implementations relate to processing of electronic data. One implementation is manifest as a technique that can include obtaining a relational query that references one or more data items and associating progress intervals with the data items. The technique can also include converting the relational query into a corresponding streaming query, and providing the streaming query and the data items with the progress intervals to a stream engine that produces incremental results of the query. For example, the progress intervals can be based on row numbers of a relational database table. The progress intervals can be used to define event lifetimes of streaming events that are provided as inputs to the stream engine.

Deriving session level statistics for temporary tables

Statistics for temporary tables are used in optimizing the execution of a database request. A first temporary table is created using data from a data source as the result of performing an operation while executing the request. A subset of the demographics of the data source is saved in a session level memory as the demographics of the first temporary table. The saved demographics are used in optimizing the execution of the portion of the request involving the first temporary table.

Method and Device for Refreshing News List

Provided is a method and device for refreshing a news list, wherein the method includes: receiving a refreshing signal; reading a refreshing start time according to the received refreshing signal; reading at least one pre-set time threshold, the time threshold is used for defining, in combination with the refreshing start time, a time interval for refreshing a news list; acquiring a recommended news list according to the refreshing start time and the time threshold, the recommended news list including: at least one piece of news to be recommended, the publication time of the news to be recommended falls within the time interval; allocating a recommending time for each piece of news to be recommended in the recommended news list; and refreshing the news to be recommended in the recommended news list according to the recommending time, so as to generate a new recommended news list.

Method and system for characterizing time series

The invention relates to a method for characterizing time series. The method includes obtaining a time series that includes data points for consecutive time intervals, decomposing the time series into a trend component, a seasonal component, and a residual component, and clustering the seasonal component into a number of clusters. Each of the consecutive time intervals is assigned to one of the clusters based on a level of the data points of the seasonality component in the time interval. The method further includes labeling one of the clusters as baseline with the baseline cluster containing more time intervals than any one of the other clusters, determining cluster labels for the other clusters based on the level of the data points of the time intervals assigned to the other clusters; and for each time interval, storing the corresponding cluster label in a vector.

SYSTEMS AND METHODS FOR AUTO DISCOVERY OF FILTERS AND PROCESSING ELECTRONIC ACTIVITIES USING THE SAME

The present disclosure relates to systems and methods for filtering electronic activities. Exemplary implementations may include ingesting a first electronic activity; identifying an associated entity; and selecting a first filtering model based on the entity, the first filtering model trained to indicate whether to restrict further processing of ingested electronic activities. The method may further include generating a plurality of structured data tags for the first electronic activity; applying the selected first filtering model to the plurality of structured data tags for the first electronic activity to determine whether the first electronic activity satisfies a first restriction condition; and responsive to the first electronic activity satisfying the first restriction condition, restricting the first electronic activity from further processing; or responsive to the first electronic activity not satisfying the first restriction condition, further processing, by the one or more processors ...

SYSTEM AND METHOD FOR SEARCHING STRUCTURED DATA FILES

A computer implemented method, program, system, and apparatus for searching structured databases is disclosed. This invention teaches the collation of results based on the time that a search is performed by a user by sending individual time-based queries to the database such that only an subset of results is obtained for each query. The time associated with each query is recorded in one or more datasets which correspond to the search being performed, and the datasets are consulted before each additional time-based query such that no time period is queried twice for the same search. By querying based on a subset of results existing in a particular time frame, the invention serves to limit load on a database and a user device while also removing the need for de-duplication of results, presenting the user with a collated list of the most relevant results based on the current time.

Near Real-time system or network incident detection

Systems and arrangements for using temporal analysis to evaluate incidents to determine whether they are likely to cause a significant business impact are provided. Historical data may be analyzed to identify incidents having a significant business impact. The historical data associated with incidents having a significant business impact may be further analyzed to identify a time and/or date at which the incident occurred, as well as the particular system, or the like, impacted by the incident. Normal business hours associated with the system, or the like, may be retrieved and a profile may be generated for the system, or the like. An incident may be received and processed to identify a system, or the like, associated with the incident and profile may be retrieved. The incident data may be compared to the profile to determine whether the incident is likely to cause a significant business impact based, at least in part, on the date and/or time at which it occurred.

Apparatuses, methods and systems for a rule-integrated virtual punch clock

The APPARATUSES, METHODS AND SYSTEMS FOR A RULE-INTEGRATED VIRTUAL PUNCH CLOCK (hereinafter RIVPC) implement efficient and scalable monitoring, regulation, and allocation of computational processing, data, labor, and/or the like resources within an enterprise. The RIVPC may facilitate tracking employee time, such as time worked, time per activity, break time, vacation time, and/or the like, by providing an electronic time clock interface at an employee terminal device. The RIVPC may further be configured to track, implement and/or enforce one or more labor rules, regulations, laws, company policies, wage schedules, and/or the like based on one or more rulesets embedded in and/or interacting with the virtual clock components of the RIVPC. The embedded rules may be selected and/or enforced selectively based on user characteristics, including one or more descriptive business grammar strings associated with a user.

Searching method and apparatus

A method of searching for a data item in a stored chronological sequence of communication events relating to a user of a user terminal is provided. The method comprises: querying a communication event database comprising individually accessible records of each of the communication events, each record being associated with an event time at which the communication event occurred, wherein the step of querying locates a target event comprising the data item and having an event time earlier than a predetermined first time instance; loading the target event into a storage means; displaying the contents of the target event to the user in a user interface; and loading communication events occurring in a time period between the event time and the first time instance of the target event into the storage means and updating the display to include the contents of the communication events occurring in the time period.

Data allocation containers in a partitioned table of a computer database system for holding data based on usage

An apparatus and method utilize partitioned database tables divided into data allocation containers (DACs) where data is placed into the DACs based on usage of the data in past queries. Records that are used most often are placed together and records that are used less often are placed together to improve database performance. In preferred embodiments, a database manager determines where to place data into the DACs based on how often the data is selected by a database query using a DAC selection ratio (DSR). The database manager may determine when to perform table maintenance to move rows of data to the appropriate DACs based on a timestamp or last check date (LCD) stored in the database.

Nondisruptive overflow avoidance of tuple validity timestamps in temporal database systems

A first epoch column pair includes a first global identification (ID) having first maximum value. A second epoch column pair includes a second global identification having second maximum value. The first epoch column pair receives first snapshots, and the first global ID increases with each of the first snapshots. When first global ID reaches first maximum value minus 1, switch to the second epoch column pair. The second epoch column pair receives second snapshots, and second global ID increases with each of the second snapshots. First global ID and first epoch column pair are reset, based on conditions. When second global ID reaches first maximum value minus 1, switch back to first epoch column pair. The first epoch column pair again receives first snapshots, and the first global ID increases with each of the second snapshots. Second global ID and second epoch column pair are reset, based on conditions.

ASSET ALLOCATION AND RECONCILIATION SYSTEM

Systems and methods for a software asset management, license compliance, and reconciliation techniques are disclosed. Software licenses come in many different types, including but not limited to, subscription based licenses, geographically restricted licenses, globally available licenses, production only licenses, standard shrink wrap licenses, network concurrent usage licenses, etc. With fewer applications being installed directly onto end-users machines, tools that only scan local networks and search hard drives are becoming less effective. Disclosed techniques introduce additional capabilities for software asset discovery, tracking, license allocation, and other functions as part of a comprehensive software asset reconciliation engine. For example, the disclosed software asset reconciliation engine may be configured with sub-engines to perform groupings of discovered information to allow system administrators and license administrators to properly allocate and monitor software application ...

SYSTEMS AND METHODS FOR AUTO DISCOVERY OF FILTERS AND PROCESSING ELECTRONIC ACTIVITIES USING THE SAME

The present disclosure relates to systems and methods for filtering electronic activities. Exemplary implementations may include ingesting a first electronic activity; identifying an associated entity; and selecting a first filtering model based on the entity, the first filtering model trained to indicate whether to restrict further processing of ingested electronic activities. The method may further include generating a plurality of structured data tags for the first electronic activity; applying the selected first filtering model to the plurality of structured data tags for the first electronic activity to determine whether the first electronic activity satisfies a first restriction condition; and responsive to the first electronic activity satisfying the first restriction condition, restricting the first electronic activity from further processing; or responsive to the first electronic activity not satisfying the first restriction condition, further processing, by the one or more processors ...

SYSTEM FOR ORGANIZING AND FAST SEARCHING OF MASSIVE AMOUNTS OF DATA

A system to collect and store in a special data structure arranged for rapid searching massive amounts of data. Performance metric data is one example. The performance metric data is recorded in time-series measurements, converted into unicode, and arranged into a special data structure having one directory for every day which stores all the metric data collected that day. The performance metric data is collected by one or more probes running on machines about which data is being collected. The performance metric data is compressed prior to transmission to a server over any data path. The data structure at the server where analysis is done has a subdirectory for every resource type. Each subdirectory contains text files of performance metric data values measured for attributes in a group of attributes to which said text file is dedicated. Each attribute has its own section and the performance metric data values are recorded in time series as unicode hex numbers as a comma delimited list ...

DIRECTLY SEARCHABLE AND INDIRECTLY SEARCHABLE USING ASSOCIATED INVERTED INDEXES RAW MACHINE DATASTORE

Embodiments are directed towards a method for searching data. The method comprises generating an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises receiving an incoming search query that references a field name. Furthermore, the method comprises generating results to the incoming search query based on the field searchable datastore, wherein the field searchable datastore is directly searchable by the field name.

System and method for providing information to a recipient of a physical mail object

A system and method is provided for transmitting information over a wide area network, such as the Internet, in response to receiving at least a portion of mail data. In one embodiment of the present invention, information is stored in a memory. Mail data is then affixed to a mail object. The mail object is then manually delivered to a recipient. The mail data is then provided to a reception device. The reception device then uses the mail data to retrieve the information from a mail device in communication with the memory. In a preferred embodiment, the mail data includes data corresponding to the recipient of the mail object, and the information includes data that identifies the recipient of the mail object and data that corresponds to a content of the mail object.

Determining trends for a user using contextual data

An aspect provides a method, including: accessing, using a processor, a user profile based on user context information, wherein the user context information utilizes user device events; preparing, using the processor, a list of items based on the user profile related to a particular time period organized according to importance based on the user profile; and presenting, using the processor, the list of items related to the particular time period. Other aspects are described and claimed.

NETWORKED SENSOR SYSTEMS AND METHODS

Embodiments of a system and methods for using a sensing attached to footwear are generally described herein. A device may include an accelerometer to measure a force, a transceiver to: send information about the force to an external device, and receive a response from the external device, the response indicating whether the force exceeded a threshold and occurred within a specified timing window around a sensory output. The device may include feedback hardware to generate feedback when the response indicates that the force fell below the threshold or occurred outside the specified timing window.

Transactional range delete in distributed databases

A database service that receives and manages time series data into a set of generational data tables. The database service maintains subsets of the time series data in a plurality of partitions and a set of virtual keys defining the range of time series of data in each partition. Thereafter, responsive to a transactional range delete command, the database service identifies partitions having overlapping time series data and processes the delete command at each respective partition.

EFFICIENCY FOR REAL-TIME DATA PROCESSING

A computer-implemented method includes receiving a data stream and dividing the data stream into one or more data artefacts for one or more time intervals. The computer-implemented method further includes generating one or more contexts. Each of the one or more contexts are for at least one of the one or more time intervals. The computer-implemented method further includes storing each of the one or more data artefacts in shared storage. The shared storage is accessible for each of the one or more contexts. The computer-implemented method further includes, for each context of the one or more contexts: determining a dependency for the context; monitoring the context for a completion of said dependency; and responsive to the completion, releasing the dependency. The computer-implemented further includes removing those of the one or more data artefacts that do not belong to the dependency for any of the one or more contexts.

Large Dataset Structuring Techniques for Real Time Fraud Detection

Database organizational techniques and structures may impose storage and computational limits that render particular operations too slow to effectively execute within speed guarantees (e.g. allowing a function to be completed within 300 ms). Thus, sometimes it is inefficient to access and maintain certain data, particularly in large data environments. One such environment relates to event logging for security, fraud, and risk purposes. When hundreds or thousands of events can occur in short time periods, database queries can be slow. By using particular algorithms and data structuring, however, event log data can be utilized in a flexible and speedy manner in various embodiments that may still enable service guarantees to be met. In some cases, this may involve updating one or more event counters for one or more particular periods of time, which may be indicative of event velocity (i.e. how often certain events are occurring).

OBJECT TIME SERIES SYSTEM

Methods and systems for structuring, storing and displaying time series data in a user interface. One system includes processors executing instructions to determine, from time series data from a first sensor, a first subset of time series data for the first batch from the first start time and the first end time, determine, from the time series data from the first sensor, a second subset of time series data for the second batch from the second start time and the second end time, generate a time series user interface comprising a chart, the chart including a first plot for the first subset of time series data and a second plot for the second subset of time series data, the first plot being aligned to the second plot, and cause presentation of the time series user interface.

SYSTEMS AND METHODS FOR GENERATING A FILTERED DATA SET

The present disclosure relates to generating a filtered data set. Data from a plurality of systems of record of a plurality of data source providers may be accessed. A master data set generated using the data accessed from the plurality of systems of record may be maintained. Restriction policies including one or more rules for restricting sharing of data may be maintained. A filtered data set may be generated for a data source provider responsive to an application of restriction policies of other data source providers to the master data set. The filtered data set may be provisioned.

ANTICIPATORY PRE-EXECUTION OF DATA QUERIES

Implementations of the disclosure provide for anticipatory pre-execution of queries. In an implementation of the disclosure, a method for anticipatory pre-execution of queries includes the computation of an execution cost of each of a multiplicity of different queries to a data source scheduled at a specified time on a specified date. The method also includes monitoring a querying processing schedule and detecting from the monitoring, unscheduled time on a particular date prior to the specified time on the specified date. Finally, the method includes responding to the detection by first selecting a most expensive one of the different queries in terms of execution cost, for instance an amount of computing resources consumed in executing a corresponding one of the different queries, and then executing the selected most expensive one of the different queries during the unscheduled time on the particular date prior to the specified time on the specified date.

СПОСОБ И УСТРОЙСТВО ДЛЯ ОБРАБОТКИ ФОТОГРАФИЙ

Изобретение относится к обработке изображений, таких как фотографий. Техническим результатом является сокращение времени при обработке фотографий. Способ включает следующие шаги: в процессе менеджмента пространства памяти производится сканирование всех фотографий в директории. Генерируется по меньшей мере одна группа схожих фотографий в соответствии с информацией об атрибуте каждой фотографии и с заранее извлеченными свойствами каждой фотографии. Информация об атрибуте включает по меньшей мере время фотографирования. Фотографии в каждой группе схожих фотографий воспроизводятся в виде элементов группы схожих фотографий, упорядоченных по времени фотографирования, а менеджмент фотографий в каждой группе схожих фотографий осуществляют в соответствии с детектированной операцией. 3 н. и 6 з.п. ф-лы, 8 ил.

Verfahren und System für eine konsequente Zeitfestlegung in verteilten Rechnerdatenbanken

Method and apparatus for data retention in a storage system

Data processing system

Method wherein input data comprising data values associated with time values and threshold criteria are obtained 101, unique datasets are selected or generated from the input data 103 and it is determined whether they meet threshold criteria 105, wherein they are stored in memory in association with the threshold criteria. This is repeated for each threshold criterion. Each stored dataset comprises a plurality of data values and an indication of the time value associated with each of the data values. The threshold criteria may be a level of similarity or fidelity between the dataset and the input data and may be a percentage. Determining whether a dataset satisfies a criterion may comprise calculating the difference in averages between the dataset and input data, dividing the result by the average of the input data and then comparing the result with the criterion. Linear or non-linear interpolation may be used to calculate data values from data values of the input data when selecting or ...

System and method for searching structured data files

System and method for searching structured data files

A computer implemented method, program, system, and apparatus for searching structured databases is disclosed. This invention teaches the collation of results based on the time that a search is performed by a user by sending individual time-based queries to the database such that only an subset of results is obtained for each query. The time associated with each query is recorded in one or more datasets which correspond to the search being performed, and the datasets are consulted before each additional time-based query such that no time period is queried twice for the same search. By querying based on a subset of results existing in a particular time frame, the invention serves to limit load on a database and a user device while also removing the need for de-duplication of results, presenting the user with a collated list of the most relevant results based on the current time.

Source-independent queries in distributed industrial systems

Data processing system

Content-specific keyword notification system

Methods and systems for searching logical patterns

METHODS AND SYSTEMS FOR SEARCHING LOGICAL PATTERNS Methods and systems for searching logical patterns in voluminous multi sensor data from the industrial internet is provided. The method retrieves instances of patterns in time-series data where patterns are specified logically, using a sequence of symbols. The logical symbols used are a subset of the qualitative abstractions specifically, the concepts of steady, increasing, decreasing. Patterns can include symbol-sequences for multiple sensors, approximate duration as well as slope values for each symbol. To facilitate efficient querying, each sensor time-series is pre-processed into a sequence of logical symbols. Each position in the resulting compressed sequence is registered across a TRIE-based index structure corresponding to the multiple logical patterns it may belong to. Logical multi-sensor patterns are efficiently retrieved and ranked using such a structure. This method of indexing and searching provides an efficient mechanism for ...

SCALABLE DATABASE SYSTEM FOR QUERYING TIME-SERIES DATA

METHODS AND SYSTEMS FOR SELECTING AND ANALYZING GEOSPATIAL DATA ON A DISCRETE GLOBAL GRID SYSTEM

Various embodiments are described herein for systems and methods for allowing user at a client terminal to interacts with a graphical user interface having a DGGS globe to perform spatial analysis on DGGS spatial data based on a spatial query on unified spatial data that may be obtained from distributed geospatial data sources having different data formats. The spatial analysis results can include a resulting collection of cells that can be displayed on the DGGS globe and/or aggregated spatial statistics that can be displayed in a DGGS legend at the graphical user interface. In one aspect, the spatial analysis can be iteratively performed to obtain a refined resulting collection of cells and aggregated spatial statistics. In another aspect, the resulting cells and/or aggregated spatial statistics can be added to a geospatial data source that can be accessed by another client terminal that is performing other geospatial analysis.

DATA STORAGE USING A BI-TEMPORAL INDEX

A database system stores data in a bi-temporal index that maintains recordation time and a validity time for recorded values. The index for a given key may be append only, such that the stored data for the key doesn't require modification of previously-recorded data for given validity times. The bi-temporal index comprises a key-value data store that allows values to be recorded for a specific key, validity time, and recordation time. To retrieve a value, a request presents a query with a key, subject time, and observation time. Queries look for values with a validity time most recent to and before the queried subject time and a recordation time, associated with the validity time, most recent to and before the queried observation time. The queries prioritize the validity time over the recordation time and returns the value that satisfies the query request.

ADDING ATTRIBUTES AND LABELS TO STRUCTURED DATA

점진적 빈발패턴 기반의 그래프스트림 압축 방법 및 시스템

... 점진적 빈발패턴 기반의 그래프스트림 압축 방법 및 시스템이 개시된다. 본 발명의 실시예에 따른 점진적 빈발패턴 기반의 그래프스트림 압축 방법은, 실시간으로 입력되는 그래프스트림에 대한 압축 명령에 따라, 상기 그래프스트림 중 제1 시간 동안 입력된 서브스트림으로부터 제1 서브그래프를 추출하는 단계와, 상기 제1 서브그래프를 초기 빈발패턴으로서 패턴 사전에 저장하는 단계와, 상기 그래프스트림 중 상기 제1 시간의 경과시점부터 제2 시간 동안 입력된 서브스트림으로부터 상기 제1 서브그래프와 상이한 제2 서브그래프가 추출되면, 상기 제2 서브그래프를 이용하여, 상기 패턴 사전 내에서 상기 제1 서브그래프를 확장 서브그래프로 업데이트하여 유지하는 단계, 및 상기 제1 및 제2 시간을 합산한 시간이 정해진 시간에 도달하면, 상기 패턴 사전 내에 유지되는 상기 확장 서브그래프를, 기준 빈발패턴으로서, 압축 처리하는 단계를 포함한다.

빅데이터를 활용한 두 주식 종목 사이의 변동 패턴 분석을 통한 주식 정보 제공 장치 및 그 방법

... 본 발명의 일 실시예에 따른 서버에 의해 수행되는, 빅데이터를 활용한 두 주식 종목 사이의 변동 패턴 분석을 통한 주식 정보 제공 방법에 있어서 사용자 단말에 주식 종목 쌍을 이루는 두 주식 종목들 중 제 1 주식 종목에 대한 전체 정보 및 제 2 주식 종목에 대한 부분 정보를 포함하는 제 1 주식 정보를 제공하되, 상기 제 1 주식 종목 및 제 2 주식 종목이 서로 비교 표시되도록 제공하는 단계; 상기 사용자 단말로부터 상기 제 2 주식 종목에 대한 전체 정보 요청을 수신하고 분산저장서버에 분산저장하는 단계; 및 상기 전체 정보 요청에 기초하여 상기 사용자 단말에 상기 2개의 종목을 비교 표시하는 단계에서 제공되지 않은 제 2 주식 종목에 대한 나머지 부분 정보를 포함하는 제 2 주식 정보를 제공하는 단계를 포함하되, 상기 사용자 단말에 상기 2개의 종목을 비교 표시하는 단계는, 동일한 변동 패턴에 기초하여 쌍으로 이루어진, 복수의 주식 종목 쌍들에 대한 상기 제 1 주식 정보를 제공하고, 상기 주식 종목 쌍들에 대한 순위 정보를 더 제공하여, 상기 사용자 단말에서 상기 순위 정보에 기초하여 주식 종목 쌍들이 정렬되어 표시되도록 하고, 상기 주식 종목 쌍들 중 어느 하나의 주식 종목 쌍의 순위가 기 설정된 기준 순위보다 낮은 경우, 상기 사용자 단말에 상기 어느 하나의 주식 종목 쌍의 제 2 주식 종목에 대한 전체 정보를 더 제공하는 것이 포함될 수 있다.

계층적 예측 구조를 갖는 주택가격 예측방법

... 제1수준의 행정구역 하이어라키 레벨에 따른 제1행정구역에서 실측된 주택의 매매가의 대푯값을 미리 결정된 제1기간 동안 1개월 단위로 시계열적으로 획득한 제1수준의 매매값 시계열 데이터를 준비하는 단계, 상기 제1수준의 매매값 시계열 데이터를 제1수준의 예측기에 입력하여, 상기 제1수준의 예측기가 예측하여 출력한 제1수준의 예측 매매값 시계열 데이터를 생성하는 단계, 상기 제1행정구역에 속한 제2행정구역으로서, 제2수준의 행정구역 하이어라키 레벨에 따른 상기 제2행정구역에서 실측된 주택 매매가의 대푯값을 상기 제1기간 동안 1개월 단위로 시계열적으로 획득한 제2수준의 매매값 시계열 데이터를 준비하는 단계, 상기 제2수준의 매매값 시계열 데이터 및 상기 제1수준의 예측 매매값 시계열 데이터를 제2수준의 예측기에 입력하여, 상기 제2수준의 예측기가 예측하여 출력한 제2수준의 예측 매매값 시계열 데이터를 생성하는 단계, 상기 제2행정구역에 속한 제3행정구역으로서, 제3수준의 행정구역 하이어라키 레벨에 따른 상기 제3행정구역에서 실측된 주택 매매가의 대푯값을 상기 제1기간 동안 1개월 단위로 시계열적으로 획득한 제3수준의 매매값 시계열 데이터를 준비하는 단계; 및 상기 제3수준의 매매값 시계열 데이터 및 상기 제2수준의 예측 매매값 시계열 데이터를 제3수준의 예측기에 입력하여, 상기 제3수준의 예측기가 예측하여 출력한 제3수준의 예측 매매값 시계열 데이터를 생성하는 단계를 포함하는, 계층적 예측 구조를 갖는 주택가격 예측방법을 공개한다.

Note management method, system, and computer-readable medium

DATA PROCESSING METHOD AND DEVICE

The invention concerns a method of processing data to provide output data based on a group of data samples having a time stamp falling within at least one rolling time period, the method comprising: receiving a new data sample (DN) and associating said new data sample with a first time stamp; updating said output data corresponding to a first rolling time period to be based on said group of data samples including said new data sample; programming a first callback based on said first time stamp and on the duration of said first rolling time period; and in response to the occurrence of said first callback, updating said output data corresponding to said first rolling time period to no longer be based on said new data sample.

COMPUTATION SYSTEM WITH TIME BASED PROBABILITIES

A system for maintaining consistency of a data value using a probability includes an interface and a processor. The interface is configured to receive a data value for storing. The processor is configured to store the data value in a data element of a data structure and determine, using an adaptive filter, a probability of certainty associated with the data value. The probability of certainty associated with the data value depends on a time since the data value was updated. The adaptive filter provides as output the probability of certainty and store the probability of certainty associated with the data value in the data structure.

Multi-granularity hierarchical aggregate selection based on update, storage and response constraints

Techniques are disclosed for multi-granularity hierarchical aggregate selection based on update, storage and response constraints. For example, for a temporal hierarchy of aggregation statistics associated with a plurality of database records, wherein the temporal hierarchy comprises two or more aggregation statistics levels and each level has a different temporal granularity associated therewith, a method comprises iteratively modifying the temporal hierarchy to at least one of: (a) minimize a storage usage cost while satisfying a temporal hierarchy update constraint and a query response time constraint; (b) reduce a temporal hierarchy update time and a query response time while satisfying a storage usage constraint; and (c) minimize a query response time for frequently applied queries that do not shift in time while satisfying the storage usage constraint, wherein the resulting temporal hierarchy that achieves at least one of (a), (b) and (c) is identified as an optimal temporal hierarchy ...

Non-destructive data storage

Non-destructive data storage is disclosed. An information change is stored that is associated with a business object such that tracking of the information change is enabled with respect to one a transaction time and/or an effective time. The stored information change is accessed with respect to a time.

Managing Storage of Data for Range-Based Searching

In general, a value of a numerical attribute of a record stored in a data structure is received. A numerical range is generated that includes the value of the numerical attribute. An entry is stored, in an index associated with the data structure, that specifies a location of the record within the data structure and that includes a first index key and a second index key. The first index key corresponds to a value of an attribute of the record different from the numerical attribute, and the second index key corresponds to the generated numerical range.

System and Method for Providing Information to a Recipient of a Physical Mail Object

A system and method is provided for transmitting information (e.g., an advertisement, content data, etc.) over a wide area network, such as the Internet, in response to receiving at least a portion of mail data. In one embodiment of the present invention, information is stored in a memory. Mail data is then affixed to a mail object (e.g., on the object itself, on an envelope encasing the object, etc.). The mail object is then manually delivered to a recipient. The mail data is then provided to a reception device. The reception device then uses the mail data to retrieve the information from a mail device in communication with the memory. In a preferred embodiment, the mail data includes data corresponding to the recipient of the mail object, and the information corresponds to a content of the mail object.

Identification of systems with anomalous behaviour using events derived from machine data produced by those systems

Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.

Graphical controls for selecting criteria based on fields present in event data

The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

SYSTEM TO TRACK ENGAGEMENT OF MEDIA ITEMS

An engagement tracking system monitors user interactions with media items to calculate an engagement score of the media item. The engagement tracking system may be or include a group of one or more server machines configured to detect an exposure of a client device to a media item maintained by the engagement tracking system. In response to detecting the exposure of the client device to the media item, the engagement tracking system tracks a location of the client device based on access requests to location based media items. The engagement tracking system may thereby monitor client devices exposed to the media item in order to calculate an engagement score of the media item.

SYSTEM FOR DETECTING AND CHARACTERIZING SEASONS

Techniques are described for characterizing and summarizing seasonal patterns detected within a time series. According to an embodiment, a set of time series data is analyzed to identify a plurality of instances of a season, where each instance corresponds to a respective sub-period within the season. A first set of instances from the plurality of instances are associated with a particular class of seasonal pattern. After classifying the first set of instances, a second set of instances may remain unclassified or otherwise may not be associated with the particular class of seasonal pattern. Based on the first and second set of instances, a summary may be generated that identifies one or more stretches of time that are associated with the particular class of seasonal pattern. The one or more stretches of time may span at least one sub-period corresponding to at least one instance in the second set of instances.

System and Methods For Optimizing Data Transfer Among Various Resources In A Distributed Environment

System providing methodology for optimizing data transfer in a distributed environment is described. In one embodiment, for example, in a distributed shared disk cluster environment comprises a plurality of nodes, each node storing database pages in different size buffer pools configured for local access and configured independent from other nodes in the cluster, the database pages residing at any buffer pool across nodes without requiring that a page be present at an identical buffer pool at all nodes in the cluster, a method of the present invention for transferring database pages among nodes comprises: generating a request at a first node for a set of database pages, the request including a timestamp for determining what are latest versions of the database pages; in response to the request, determining where latest versions of the database pages of the set reside among the plurality of nodes without regard to what size of buffer pool any given database page may reside in; if the database ...

Unified management of time related information

Unified management of time related information presents a user with a single interface by which the data in different ERP systems can be browsed and modified. Each of the ERP systems can contain data specific to a data group such as the address data group in a human resources ERP system, sales data in a sales ERP system, and project data in a project planning ERP system. A view management module obtains records from the ERP systems. The view manager also obtains journaling information that can be kept in the ERP systems or kept separately. The view manager creates a history view and data group views that can be presented to a user. The user interacts with the presentation to sort, browse, analyze, and edit the view and data. Data changed in a data group view can be forwarded to produce changes in the ERP and journaling systems.

TIME SERIES SEARCH ENGINE

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.

SELECTIVE FILTERED SUMMARY GRAPH

In some embodiments, a method may include display of a data summary view of a set of events that correspond to query results of a query. Each event of the set of events may include data items of a plurality of event attributes. In embodiments, the data summary view can include various summary reports. Each summary report can include summary entries and a summary graph that each present a summary of data items of a selected event attribute, of the plurality of event attributes. At least one summary report can include summary entries that are selectable by a user. The method may further include filtering the set of event, in response to, and based on, selection of one or more of the selectable summary entries by the user and updating of at least the first and second summary graphs to correspond to the filtered set of events.

CANDIDATE NAME GENERATION

A method includes searching an initial set of documents for an initial set of query names. Each query name of the initial set of query names is associated with at least one document of the initial set of documents. The method also includes prioritizing the initial set of query names based on at least one topic label. The method also includes searching an additional set of documents to generate candidate query names. The method also includes prioritizing the candidate query names based on the at least one topic label. The method further includes applying a temporal search filter to each candidate query name to determine whether the candidate query name was processed within a time frame. The method further includes performing disambiguation processing on each candidate query name not processed within the time frame.

Managing documents in question answering systems

A first candidate answer to a time-sensitive question received by a question answering (QA) system is identified using a first document. A first temporal confidence subscore of the first candidate answer is then calculated using a first temporal confidence rule. A first general confidence score is then generated based on at least the first temporal confidence subscore. A second candidate answer to the question is identified using a second document. A second temporal confidence subscore of the second candidate answer is then calculated using a second temporal confidence rule. A second general confidence score is then generated based on at least the second temporal confidence subscore. The first general confidence score and the second general confidence score are then compared. Based on this comparison, a final answer is selected from the first candidate answer and the second candidate answer.

Method and apparatus for normalizing and predicting time series data

A computer implemented method and apparatus for normalizing and predicting time series data. The method comprises accessing collected data comprising a plurality of intervals; defining a variation for each interval in the plurality of intervals, wherein each variation is a cost value; clustering the cost values, wherein clustering identifies anomalies in the collected data; correcting the anomalies in the collected data; and creating a set of normalized data from the corrected data.

Dynamically reconfiguring time zones in real-time using plural time zone libraries

A computer program product for dynamically reconfiguring time zones in real-time using plural time zone (TZ) libraries is provided. The method provides integrating a first time zone information data (TZID) version and a second TZID version into a TZ library in an operating system. A first configuration comprising the TZ library and the first TZID version is selected. Responsive to adjusting the first configuration to a second configuration comprising the TZ library and the second TZID version, the second configuration is used automatically without restarting the operating system and without restarting an application.

Updating database records while maintaining accessible temporal history

Certain aspects of the present disclosure provide techniques for updating database records while maintaining accessible temporal history. One example method generally includes receiving a request, at a database, to select an instance of a record from the database at a specific point in time and reading the instance of the record from a snapshot of the database. The method further includes loading one or more deltas associated with the record from the database and chronologically applying the one or more deltas to the instance of the record to create the instance of the record. The method further includes returning the instance of the record, determining that the request has made a percentage of recent requests exceed a threshold for requests for most-current data and creating a new snapshot of the database.

AUTOMATICALLY IDENTIFYING RISK IN CONTRACT NEGOTIATIONS USING GRAPHICAL TIME CURVES OF CONTRACT HISTORY AND DIVERGENCE

In an embodiment, a computer-implemented method comprises storing, in one or more data repositories, digital data representing a contract set of two or more contract documents comprising a template document and one or more contract document versions based on the template document; storing, in one or more data repositories, digital contract metadata, the digital contract metadata including data identifying one or more data fields in each contract document of the contract set, data specifying the data type of the one or more data fields in each contract document of the contract set, and weights assigned to each data type; generating and causing displaying, at a computer associated with a contract administrator, a time curve graph based on the contract set and contract metadata, the time curve graph graphically indicating similarities between contract documents in the contract set and a temporal ordering of contract documents in the contract set; determining whether the contract set is at ...

Aggregation and Display of Search Results from Multi-Criteria Search Queries on Event Data

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.

System and method of grouping search results using information representations

The invention is directed to a system and method of organizing search results. The invention may leverage a chronological timeline of user action information to infer relationships between objects in a search result. The search may be iterative. Search results may be graphically represented as tiles. In one embodiment, the tiles may provide a graphical representation of users associated with an object. The tiles may be updated dynamically upon user action that occurs subsequent to the search. In an alternative embodiment, search results are organized by object type and each tile represents an object within a particular object type. A default action may be associated with an object type.

Real-time-ready behavioral targeting in a large-scale advertisement system

A "Real-Time-Ready Analyzer" combines a data stream management system (DSMS) with a map-reduce (M-R) framework to construct a streaming map-reduce framework that is suitable for real-time Behavioral Targeting (BT) (or other temporal queries). The Real-Time-Ready Analyzer allows users to write "dual-intent" temporal analysis queries for BT. These queries are succinct and easy to express, scale well on large-scale offline data, and can also work over real-time data. Further, the Real-Time-Ready Analyzer uses the aforementioned streaming map-reduce framework to provide dual-intent algorithms for end-to-end BT phases. Experiments using real data from an advertisement system show that the Real-Time-Ready Analyzer is very efficient and incurs orders-of-magnitude lower development effort than conventional systems.

Dеriving sеssiоn lеvеl stаtistiсs fоr tеmpоrаrу tаblеs

Stаtistiсs fоr tеmpоrаrу tаblеs аrе usеd in оptimizing thе ехесutiоn оf а dаtаbаsе rеquеst. А first tеmpоrаrу tаblе is сrеаtеd using dаtа frоm а dаtа sоurсе аs thе rеsult оf pеrfоrming аn оpеrаtiоn whilе ехесuting thе rеquеst. А subsеt оf thе dеmоgrаphiсs оf thе dаtа sоurсе is sаvеd in а sеssiоn lеvеl mеmоrу аs thе dеmоgrаphiсs оf thе first tеmpоrаrу tаblе. Тhе sаvеd dеmоgrаphiсs аrе usеd in оptimizing thе ехесutiоn оf thе pоrtiоn оf thе rеquеst invоlving thе first tеmpоrаrу tаblе.

Dеriving sеssiоn lеvеl stаtistiсs fоr tеmpоrаrу tаblеs

Stаtistiсs fоr tеmpоrаrу tаblеs аrе usеd in оptimizing thе ехесutiоn оf а dаtаbаsе rеquеst. А first tеmpоrаrу tаblе is сrеаtеd using dаtа frоm а dаtа sоurсе аs thе rеsult оf pеrfоrming аn оpеrаtiоn whilе ехесuting thе rеquеst. А subsеt оf thе dеmоgrаphiсs оf thе dаtа sоurсе is sаvеd in а sеssiоn lеvеl mеmоrу аs thе dеmоgrаphiсs оf thе first tеmpоrаrу tаblе. Тhе sаvеd dеmоgrаphiсs аrе usеd in оptimizing thе ехесutiоn оf thе pоrtiоn оf thе rеquеst invоlving thе first tеmpоrаrу tаblе.

EVENT PREDICTION

Methods and systems for event prediction. The system includes at least one connector configured to gather at least partially incomplete data from at least one data source. The gathered data may be communicated to a model definition module that converts at least a subset of the gathered data into a prediction model in accordance with a received definition. A prediction module may receive a prediction query and, in response, supply an event prediction based on the prediction model.

AI-DRIVEN DEFENSIVE CYBERSECURITY STRATEGY ANALYSIS AND RECOMMENDATION SYSTEM

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators.

System and method for cybersecurity reconnaissance, analysis, and score generation using distributed systems

A system and method for cybersecurity reconnaissance, analysis, and scoring that uses distributed, cloud-based computing services to provide sufficient scalability for analysis of enterprise IT networks using only publicly available characterizations. The system and method comprise an in-memory associative array which manages a queue of vulnerability search tasks through a public-facing proxy network. The public-facing proxy network has search nodes configurable to present the network to search tools in a desired manner to control certain aspects of the search to obtain the desired results. A distributed data processing engine and cloud-based storage are used to provide scalable computing power and storage. Each of the cloud-based computing services is containerized and orchestrated for management and efficient scaling purposes.

Fast ad-hoc filtering of time series analytics

Techniques and tools are described for producing time-series data using faceted search based on document creation time. For example, index information can be created from events (e.g., by adding meta-data and indexing the events as documents). In addition, index information can be created that maps document creation time to time ranges. Search queries can then be executed (e.g., comprising ad-hoc filters to filter on the meta-data), and search results can be faceted on the time ranges to produce time-series data. The time-series data can be graphed to display trends of activity (e.g., trends of events based on user activity).

Time-series data storage and processing database system

A database system is described that includes components for storing time-series data and executing custom, user-defined computational expressions in substantially real-time such that the results can be provided to a user device for display in an interactive user interface. For example, the database system may process stored time-series data in response to requests from a user device. The request may include a start time, an end time, a period, and/or a computational expression. The database system may retrieve the time-series data identified by the computational expression and, for each period, perform the arithmetic operation(s) identified by the computational expression on data values corresponding to times within the start time and the end time. Once all new data values have been generated, the database system may transmit the new data values to the user device for display in the interactive user interface.

Systems and methods for updating confidence scores of labels based on subsequent electronic activities

The present disclosure relates to methods, systems, and storage media for updating confidence scores of labels based on subsequent electronic activities. Exemplary embodiments may maintain a plurality of node profiles corresponding to a plurality of unique entities; access a plurality of electronic activities transmitted or received via electronic accounts associated with one or more data source providers; identify a first electronic activity to process; assign a tag to the first electronic activity based on the data included in the electronic activity; determine a confidence score of the tag based on the data included in the first electronic activity; identify a second electronic activity to process; and update the confidence score of the tag assigned to the first electronic activity responsive to parsing the second electronic activity.

Assessments based on data that changes retroactively

A system enables analysis of retroactively changing datasets and/or of various versions of logics. In an example, the system determines a first version of data and/or a first version of a logic and a second version of the data and/or a second version of the logic, wherein at least some of the second version of the data was retroactively added. The system determines two outputs each derived from one of a) applying the first version of the logic to the first version of the data, b) applying the second version of the logic to the first version of the data, c) applying the first version of the logic to the second version of the data, or d) applying the second version of the logic to the second version of the data. The system compares the outputs and determines one or more differences between the outputs.

Systems and methods for maintaining an electronic activity derived member node network

The present disclosure relates to maintaining an electronic activity derived member node network. Exemplary implementations may: generate a plurality of node profiles; generate a node graph generated from the plurality of node profiles; identify a second electronic activity identifying a pair of electronic accounts; identify using the node graph, a pair of participant node profiles corresponding to the pair of electronic accounts identified by the second electronic activity; identify, using the node graph, an edge between a pair of nodes corresponding to the pair of participant node profiles; determine a relevancy score for the second electronic activity corresponding to the pair of the participant node profiles based on context of the second electronic activity; and update the node graph by modifying the connection corresponding to the edge between the pair of participant node profiles based on the relevancy score determined for the second electronic activity.

MASSIVELY SCALABLE COMPUTER PLATFORM USING A DISTRIBUTED COMPUTATIONAL GRAPH

A system for repeatable and flexible predictive analysis of very large data sets using a distributed computational graph using a domain specific language for pipeline and resource declaration has been developed. Data receipt software receives data from one or more sources. In a declared data pathway, data formalization software formats input data for storage, enrichment, or continued processing. An event analysis server inspects stored data for trends, situations, or knowledge. Aggregated data is passed to event message store and data stream handler software. Transformation pipeline software stores, triggers, executes and monitors declared transformation steps and pipelines to manipulate and act on bulk data and data streams, provides results and enables dynamic model and routine re-training and learning.

Surfacing augmented reality objects

Various embodiments provide for a registry for augmented reality (AR) objects, which can provide AR objects to a client device to support various software or hardware applications. For instance, some embodiments provide for an AR object registry that facilitates or enables registration of one or more AR objects in association with one or more locations across a planet.

Techniques for organizing single or multi-column temporal data in r-tree spatial indexes

Techniques for organizing single or multi-column temporal data into R-tree spatial indexes are provided. Temporal data for single or multiple column data, within a database system, is converted into one or more line segments. The resulting line segments are transformed into a minimum bounding rectangle (MBR). Finally, the MBR is inserted into an R-tree spatial index.

Note management methods and systems

Note management methods and systems are provided. First, inputs are received along a timeline, and at least one note is generated according to the inputs. The at least one note is recorded and arranged along the timeline. In some embodiments, a thumbnail is generated for a respective predefined interval on the timeline according to the at least one node in the respective predefined interval, and the thumbnail of the respective predefined interval is displayed along the timeline.

Method and system for selecting, retrieving, visualizing and exploring time-oriented data in multiple subject records

Provided herein system and method for analyzing time oriented data in a plurality of records, by defining a knowledge base in a domain and linking it to a database of a plurality of records, each storing at least one instance of time oriented data based on at least one concept defined in the knowledge base; and specifying at least one constraint on the subject records; and retrieving subject records which satisfy at least one constraint and graphically displaying at least one instance of time oriented data stored in the retrieved subject records; and exploring at least one association between the instance of time oriented data stored in the retrieved records.

Scalable interactive display of distributed data

A method, system, and processor-readable storage medium are directed towards generating a report derived from data, such as event data, stored on a plurality of distributed nodes. In one embodiment the analysis is generated using a “divide and conquer” algorithm, such that each distributed node analyzes locally stored event data while an aggregating node combines these analysis results to generate the report. In one embodiment, each distributed node also transmits a list of event data references associated with the analysis result to the aggregating node. The aggregating node may then generate a global ordered list of data references based on the list of event data references received from each distributed node. Subsequently, in response to a user selection of a range of global event data, the report may dynamically retrieve event data from one or more distributed nodes for display according to the global order.

System for organizing and fast searching of massive amounts of data

A system to collect and analyze performance metric data recorded in time-series measurements, converted into unicode, and arranged into a special data structure. The performance metric data is collected by one or more probes running on machines about which data is being collected. The performance metric data is also organized into a special data structure. The data structure at the server where analysis is done has a directory for every day of performance metric data collected with a subdirectory for every resource type. Each subdirectory contain text files of performance metric data values measured for attributes in a group of attributes to which said text file is dedicated. Each attribute has its own section and the performance metric data values are recorded in time series as unicode hex numbers as a comma delimited list. Analysis of the performance metric data is done using regular expressions.

Time-series data management device, system, method, and program

Disclosed is a time-series management device capable of filtering time-series data having a possibility of matching a specified search pattern and reading in the data from a storage device when performing a time-series analysis. A data accumulation unit ( 120 ) creates a time-series index having a feature value of a data series calculated at a specific regular time interval. In addition, a data search unit ( 130 ) makes a decision as to the feature value for each regular time interval included in the time-series index using an evaluation formula of a specified search condition, identifies a time period of a complying data series group, and performs a time-series analysis for only the data series of the identified time period.

Terminal apparatus, server apparatus, information processing method, program, and interlocked application feed system

Disclosed herein is a terminal apparatus including an extraction portion configured to extract from a content to be reproduced signature data representative of a characteristic of the content; a query generation portion configured to generate a query including the extracted signature data; a communication portion configured to transmit the generated query to a server apparatus and receive a response returned therefrom in reply to the query; and an application execution portion configured to acquire and execute an application corresponding to an application identifier included in the received response.

Systems and methods for handling attributes and intervals of big data

Data management techniques are provided for handling of big data. A data management process can account for attributes of data by analyzing or interpreting the data, assigning intervals to the attributes based on the data, and effectuating policies, based on the attributes and intervals, that facilitate data management. In addition, the data management process can determine relations among data in a data collection and generate and store approximate results concerning the data based on the attributes, intervals, and the policies.

Method for analyzing time series activity streams and devices thereof

A method, non-transitory computer readable medium, and data manager computing device comprises retrieving a time series data of a monitored asset based on one or more tags in response to a request. Further, a heterogeneous data based on the one or more tags is retrieved. Furthermore, a cause of an anomaly period in retrieved time series data of the monitored asset is determined based on the retrieved heterogeneous data. Finally, the determined cause of the anomaly period in the time series data in the monitored asset is provided.

Efficient querying using on-demand indexing of monitoring tables

Embodiments are directed to replicating database tables for efficient data querying and to using a background task to update a database index table on a periodic basis. In one scenario, a computer system accesses an existing, original time-based database table that includes various entities and properties for each entity. Each entity also includes a time stamp value. The computer system receives an indication that the new index table is to be indexed according to a user-specified property and sorts the new index table based on both the value of the user-specified property and the time stamp value of the entity to which the user-specified property belongs. The computer system then periodically copies the entities and associated properties of the original time-based database table into a new database index table.

Retrospective event processing pattern language and execution model extension

A novel and useful method, system and framework for extending event processing pattern language to include constructs and patterns in the language to support historical patterns and associated retrospective event processing that enable a user to define patterns that consist of both on-line streaming and historical (retrospective) patterns. This enables entire functions to be expressed in a single pattern language and also enables event processing optimization whereby function processing is mapped to a plurality of event processing agents (EPAs). The EPAs in turn are assigned to a physical processor and to threads within the processor.

Interactive event-based information system

In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Generating queries based upon data points in a spreadsheet application

Concepts and technologies are described herein for generating queries for data points in a spreadsheet application. In accordance with the concepts and technologies disclosed herein, a computer system can execute a visualization component. The computer system can obtain spreadsheet data having records that include values, temporal information, location information, and other information. The spreadsheet data can be presented in a visualization, and the computer system can detect selection of a representation of a record in the visualization. The computer system can generate a query based upon record, submit the query to a search engine, and obtain results for presentation.

Time-bound batch status rollup for logged events

Techniques for time-bound batch status rollup for logged events are provided. A status for each action defined in a database log is resolved during a configured interval of time. The statuses for the actions are aggregated at the end of the interval of time and then joined back into the log.

Managing activities over time in an activity graph

Systems and processes for managing a data warehouse using an activity graph are disclosed. One example process may include selectively tracking new versions of an entity based on a tracking type, removing entities based on data retention rules, removing entities based on data decay rules, and summarizing decayed data.

Fast path evaluation of boolean predicates

Techniques for managing fast path evaluation of Boolean predicates are provided. In some examples, the fast path evaluation may be based at least in part on received queries and/or query statements associated with a database and/or streaming data. In some examples, a first instruction for enabling execution of a subset of logical operators of the query may be determined. The determination may be based at least in part on the logical operators of the query. Additionally, based at least in part on the first instruction, logical instructions for implementing the query may be generated. Further, the logical instructions may be compiled into machine-readable instructions for implementing only the subset of the logical operators of the query.

ENHANCED CYBERSECURITY USING AN AUTOMATED PLANNING SERVICE

A system and methods for enhanced cybersecurity using an automated planning service is provided, comprising an automated planning service that receives a network analysis job, constructs a simulation using known network and threat information, assigns individual actions to worker nodes for processing, analyzes the results and records new threat mitigation plans as they are produced to expedite future operations, and produces an action plan as output. 1. A system for enhanced cybersecurity using an automated planning service , comprising: operate a plurality of master nodes, each master node in turn operating a plurality of worker nodes;', 'receive a network analysis job at a master node;', 'receive a plurality of security parameters and threat definitions;', 'identify a security threat based on the network analysis job and the plurality of security parameters and threat definitions;', 'determine a desired network end state, the desired network end state being based on the network analysis job and the plurality of security parameters and threat definitions;', 'assign, using the master node, a plurality of actions to a plurality of worker nodes, each of the plurality of actions being based on the identified security threat, wherein each of the plurality of worker nodes is assigned exactly one of the plurality of actions at any given time during operation;', 'analyze results of each of the plurality of actions as they are completed;', 'when the desired network end state is reached, record the specific actions that led to the end state and the order in which they were completed, as a threat mitigation plan for the identified security threat; and', 'provide the analyzed results and the threat mitigation plan as output., 'an automated planning service comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause ...

SYSTEMS AND METHODS FOR FILTERING ELECTRONIC ACTIVITIES BY PARSING CURRENT AND HISTORICAL ELECTRONIC ACTIVITIES

The present disclosure relates to systems and methods for filtering electronic activities. The method includes identifying an electronic activity. The method includes parsing the electronic activity to identify one or more electronic accounts in the electronic activity. The method includes determining, responsive to parsing the electronic activity, that the electronic activity is associated with an electronic account of the one or more electronic accounts. The method includes selecting, based on the electronic account, one or more filtering policies associated with the data source provider to apply to the electronic activity. The method includes determining, by applying the selected one or more filtering policies to the electronic activity, to restrict the electronic activity from further processing based on the electronic activity satisfying at least one of the selected one or more filtering policies. The method includes restricting, the electronic activity from further processing. 1. A method comprising:identifying, by one or more processors, an electronic activity associated with a data source provider;parsing, by the one or more processors, the electronic activity to identify one or more electronic accounts in the electronic activity;determining, by the one or more processors, responsive to parsing the electronic activity, that the electronic activity is associated with an electronic account of the one or more electronic accounts, the electronic account corresponding to the data source provider;selecting, by the one or more processors based on the electronic account, one or more filtering policies associated with the data source provider to apply to the electronic activity, the selected one or more filtering policies including at least one of i) a keyword policy configured to restrict electronic activities including a predetermined keyword; ii) a regex pattern policy configured to restrict electronic activities including one or more character strings that match ...

DISPLAYING EVENT RECORDS WITH EMPHASIZED FIELDS

Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion. 1. A method , comprising:causing display of a set of event records;determining a plurality of extraction rules associated with a first event record of the set of event records;identifying, within the first event record, a first field value of a first field defined by a first extraction rule and a second field value of a second field defined by the second extraction rule; andcausing the first field value to be visually emphasized within the first event record in a first manner and the second field value to be visually emphasized within the first event record in a second manner different from the first manner.2. The method as recited in claim 1 , wherein the first event record comprises at least a portion of one or more lines of data within machine data.3. The method as recited in claim 1 , wherein the first extraction rule comprises a regular expression.4. The method as recited in claim 1 , wherein the plurality of extraction rules are user selected via a graphical user interface.5. The method as recited in claim 1 , wherein at least one of the first manner or the second manner ...

UPDATING HIGH DEFINITION MAPS BASED ON AGE OF MAPS

A computer-implemented method may include monitoring an age of a tile of a map, where the map includes multiple tiles including the tile. The method may also include, based on the age exceeding a threshold age, determining that the tile of the map is to be updated, and receiving a location indicator from a vehicle. The method may additionally include transmitting an update message to a vehicle traversing a track within the tile as indicated by the location indicator, where the update message includes instructions to cause the vehicle to gather and submit sensor data to a computing system. The method may also include receiving the sensor data from the vehicle, and updating the tile of the map based on the received sensor data. 1. A computer-implemented method comprising:monitoring an age of a tile of a map, the map including a plurality of tiles including the tile;based on the age exceeding a threshold age, determining that the tile of the map is to be updated;receiving a location indicator from a vehicle traversing a track within the tile as indicated by the location indicator;transmitting an update message including instructions to cause the vehicle to gather and submit sensor data to a computing system;receiving the sensor data from the vehicle; andupdating the tile of the map based on the received sensor data.2. The method of claim 1 , further comprising updating the age of the tile of the map to be a time associated with one of generation of the sensor data by the vehicle or the reception of the sensor data.3. The method of claim 1 , further comprising subdividing the map into smaller regions until a threshold vehicle coverage is achieved claim 1 , the threshold vehicle coverage including a threshold statistical frequency of sensor-equipped vehicles traversing the tile.4. The method of claim 1 , wherein each of the plurality of tiles includes a corresponding identifier and is representative of a two-dimensional region of the map claim 1 , and a set of data ...

CONTINUOUSLY SCROLLABLE CALENDAR USER INTERFACE

A method is provided to scroll a calendar user interface (UI) comprising: displaying on a device display screen a visible range of a calendar UI, wherein the calendar UI includes a display grid that includes individual date display panes that are associated with individual dates, wherein the date panes are arranged in rows corresponding to weeks and columns corresponding to days of the week and wherein the visible range of the calendar UI includes multiple rows of date panes; receiving user input to indicate a scroll direction in which to scroll the display grid to display a different date range that includes earlier or later date display panes; and in response to the user input, scrolling the calendar UI by rows to the different date range. 1. A method to display a calendar user interface comprising:assigning individual shading levels to individual dates within a visible range of the calendar user interface, a forward date mapping range outside of the visible range, and a backward date mapping range outside of the visible range, the calendar user interface having a display grid in the visible range that includes display grid date panes associated with the individual dates, wherein the display grid shows an individual month wherein the individual shading levels are assigned to the individual dates in the individual month to increment from a first date of the individual month to a last date of the individual month, wherein the incrementing of the individual shading levels assigned to the individual dates from the first date of the individual month to the last date of the month results in each successive day of the individual month becoming progressively darker the closer the individual dates are to the last date of the individual month, with the first date of the month having a lightest shade level and the last date of the month having a darkest shade level, and wherein the individual shading levels assigned to the individual dates are maintained for the individual ...

CLIENT SIDE SYSTEM AND METHOD FOR SEARCH BACKED CALENDAR USER INTERFACE

A method is provided to produce a custom calendar user interface (UI) display on an electronic device display screen comprising: providing a search query to a user device; sending the search query over the network to a server system; receiving over the network by one or more user devices from a server system, information that identifies one or more code objects that match the search query; using the identified one or more identified code objects by the one or more user devices to generate one or more visual content items within a calendar user interface (UI) grid display on their device display screens. 1. A method to produce a custom calendar user interface on an electronic device display screen of a user device , the method comprising:storing, in a computer readable storage device associated with a server system, an information structure that associates attribute information with code objects corresponding to tasks and that associates the code objects with dates, wherein the attribute information corresponds to one or more of the tasks, wherein the code objects are configured to facilitate generation of visual content items corresponding to the tasks assigned to individual users within individual calendar user interfaces presented on individual user devices associated with the individual users, and generation of combinations of multiple visual content items for the tasks assigned to multiple different users within the custom calendar user interface, wherein a first code object corresponds to a first task previously assigned to a first user, wherein the first code object has been used by a first user device to generate the first visual content item within a first calendar user interface on the first user device, wherein a second code object corresponds to a second task previously assigned to a second user, wherein the second code object has been used by a second user device to generate the second visual content item within a second calendar user interface on the ...

FILTERING EVENT RECORDS BASED ON SELECTED EXTRACTED VALUE

Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value. 1. A computer-implemented method , comprising:accessing a set of events, each event associated with a timestamp and including in textual form a portion of machine data that was created to record activity that has previously occurred in an information technology environment;causing display of at least a first event from the set of events, the display including the portion of machine data included in the first event;receiving a user selection of a portion of text from the portion of machine data included in the displayed first event;automatically determining a text extraction rule that, when applied to the portion of machine data included in the first event, would extract the selection of the portion of text from a field in the displayed first event;for each event in the set of events, applying the text extraction rule to the portion of machine data included in the event to extract from the event a value of the field for the event;receiving an indication of a selected one of the extracted values;causing display of a filtered subset of the events including only events associated with the selected ...

Analyzing and Answering Questions

A computer-implemented method includes receiving, at a computer system, a question; identifying one or more first semantic elements in the question; selecting, from one or more electronic documents, a plurality of candidate responses to the question based on comparison of the one or more first semantic elements to second semantic elements; determining completeness scores for the plurality of candidate responses, wherein each of the completeness scores indicates how completely a corresponding candidate response from the plurality of candidate responses answers the question; determining relevance scores for the plurality of candidate responses, wherein each of the relevance scores indicates how relevant a corresponding candidate response from the plurality of candidate responses is to the question; and providing, by the computer system, at least a portion of the plurality of candidate responses based, at least in part, on the completeness scores and the relevance scores. 1receiving, at a computer system, a question;identifying, by the computer system, one or more first semantic elements in the question;selecting, from one or more electronic documents, a plurality of candidate responses to the question based on comparison of the one or more first semantic elements to second semantic elements that have been identified in the plurality of candidate responses;determining completeness scores for the plurality of candidate responses, wherein each of the completeness scores indicates how completely a corresponding candidate response from the plurality of candidate responses answers the question;determining relevance scores for the plurality of candidate responses, wherein each of the relevance scores indicates how relevant a corresponding candidate response from the plurality of candidate responses is to the question; andproviding, by the computer system, at least a portion of the plurality of candidate responses based, at least in part, on the completeness scores and the ...

Data structures for storing and manipulating longitudinal data and corresponding novel computer engines and methods of use thereof

In some embodiments, the present disclosure provides for an exemplary computer-implemented system that may include a longitudinal data engine, including: a processor and specialized index generation software to generate: an index data structure for a respective event type associated with each respective subject or object; where each respective index data structure is a respective event type-specific data schema, defining how to store events of a particular event type to form longitudinal data of each respective subject or object; an ontology data structure that is configured to describe one or more properties of a respective event of a respective subject or object; and longitudinal data extraction software to extract a respective longitudinal data for a plurality of index data structures and a plurality of ontology data structures associated with a plurality of subjects or objects.

SPATIAL-TEMPORAL STORAGE SYSTEM, METHOD, AND RECORDING MEDIUM

A spatial-temporal storage method, system, and non-transitory computer readable medium include dynamically managing a plurality of region servers for querying spatiotemporal data in noSQL databases. 1. A spatial-temporal storage system , comprising:a processor; and 'dynamically managing a plurality of region servers for querying spatiotemporal data in noSQL databases.', 'a memory, the memory storing instructions to cause the processor to perform2. The spatial-temporal storage system of claim 1 , wherein the plurality of region servers are dynamically managed via a group-based replica placement policy to guarantee data locality during region splits.3. A non-transitory computer-readable recording medium recording a spatial-temporal storage program claim 1 , the program causing a computer to perform:dynamically managing a plurality of region servers for querying spatiotemporal data in noSQL databases.4. The non-transitory computer-readable recording medium of claim 3 , wherein the plurality of region servers are dynamically managed via a group-based replica placement policy to guarantee data locality during region splits.5. A spatial-temporal storage method claim 3 , comprising:dynamically managing a plurality of region servers for querying spatiotemporal data in noSQL databases.6. The spatial-temporal storage method of claim 5 , wherein the plurality of region servers are dynamically managed via a group-based replica placement policy to guarantee data locality during region splits. The present application is a Continuation Application of U.S. patent application Ser. No. 16/056,672, filed on Aug. 7, 2018, which is a Continuation Application of U.S. patent application Ser. No. 15/064,161, filed on Mar. 8, 2016, now U.S. Pat. No. 10,108,637, issued on Oct. 23, 2018, the entire contents of which are hereby incorporated by reference.This invention was made with Government support under W911NF-09-2-0053 awarded by the Army Research Office (ARO). The Government has certain ...

Aggregation apparatus and aggregation method

An aggregation apparatus includes one or more memories and one or more processors configured to identify, in response to receiving an instruction for aggregation, one or more aggregation results related to the instruction from a plurality of aggregation results of a plurality of periods stored in the one or more memories, perform determination of whether the identified one or more aggregation results include a first aggregation result aggregated by using first data at first timing before second timing of the receiving of the instruction, the first data being different from second data at the second timing, perform calculation of a second aggregation result by using the first data, and perform output for the instruction based on the calculated second aggregation result and one or more aggregation results other than the first aggregation result in the identified one or more aggregation results.

CYBERSECURITY PROFILING AND RATING USING ACTIVE AND PASSIVE EXTERNAL RECONNAISSANCE

A system and method for generating comprehensive security profiles and ratings for organizations that takes into account the organization's infrastructure and operations in generating the profile, and the context and purpose of the rating to be generated related to the profile. The system and method may further comprise gathering data about the totality of the organization's infrastructure and operations, generating a cybersecurity profile using active and passive internal and external reconnaissance of the organization to determine cybersecurity vulnerabilities and potential impacts to the business in light of the information gathered about the organization's infrastructure and operations, and generating cybersecurity scores and ratings that take into account all of the above information, plus the context and purpose of the score or rating to be generated based on the cybersecurity profile. 1. A system for cybersecurity profiling and rating using internal and external reconnaissance , comprising:a cyber-physical graph module comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to create a cyber-physical graph of the organization using the information, the cyber-physical graph comprising nodes representing entities associated with the organization and edges representing relationships between entities associated with the organization; perform a reconnaissance search using the cyber-physical graph; and', 'apply some or all of the results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and, 'a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, ...

Correlating network event anomalies using active and passive external reconnaissance to identify attack information

A system and method for correlating network event anomalies to identify attack information, that identifies anomalous events within the network, identifies correlations between anomalies and other network events and resources, generates a behavior graph describing an attack pathway derived from the correlations, and determines an attack point of origin using the behavior graph.

System and methods for automated internet-scale web application vulnerability scanning and enhanced security profiling

A system and methods for automated Internet-scale vulnerability scanning and enhanced security profiling. The system utilizes a scheduler that directs web crawlers to scan domains retrieved from a database, interact with the contents of any retrieved web pages using fuzz testing, index and store the results of the scan, and provide the indexed results via an API for inclusion in cybersecurity scoring.

SYSTEMS AND METHODS FOR PARALLEL EXECUTION OF PROGRAM ANALYTICS UTILIZING A COMMON DATA OBJECT

An analytics platform for analyzing medical claims with low latency is configured to compress medical claims records into common data input objects that may be usable by a plurality of independent and parallel program analytics. The common data input objects are then passed as input to all of those program analytics, which are then configured to retrieve at least one compressed parameter file for use in processing data elements of the common data input object in accordance with a framework of a respective program analytic. The program analytics generate respective outputs based at least in part on data elements of the common data input objects, and the analytics platform combines those outputs into a single combined common output object. 1. An analytic platform for processing a claim record , the analytic platform comprising one or more memory storage areas and one or more processors configured to:receive a record data file;compress the record data file to generate a common data input object comprising a plurality of data elements, wherein each data element of the plurality of data elements represents one or more attributes of the record data file; (a) each of the plurality of program analytics independently retrieves at least one compressed parameter file from a plurality of compressed parameters files for use in processing data elements of the common data input object, wherein (1) the at least one compressed parameter file retrieved by the corresponding program analytic of the plurality of program analytics is based at least in part on a data element of the common data input object, and (2) the at least one compressed parameter file comprises a plurality of compressed parameters, and', '(b) each of the plurality of program analytics is configured to generate a respective output based at least in part on (1) one or more of the plurality of data elements of the common data input object, and (2) at least one compressed parameter of the plurality of compressed ...

GENERATING EVENTS IN EXCESS OF LICENSED EVENT COUNT

In various implementations, a computer-implemented method for remotely managing settings of applications includes receiving a network communication from a managed device, the received network communication including a client-side hash value. The method further includes identifying settings for an application on the managed device in response to the receiving of the network communication, where the identified settings include configuration instructions for the application. Based on a comparison between the received client-side hash value and a server-side hash value that corresponds to the identified settings, at least some of the identified settings are transmitted to the managed device. The transmitting of the at least some of the identified settings can be based on the comparison indicating a mismatch between the received client-side hash value and the server-side hash value. The method may also include completing processing of the received network communication after the transmitting of the at least some of the identified settings. 1. A method implemented using a computing device , comprising:receiving raw data from one or more devices;generating a plurality of time stamped events from the raw data;determining a number of events of the plurality of time-stamped events that were generated during a specified time period and that are associated with a particular account or project;comparing the number of events that were generated during the specified time period to an event count associated with the particular account or project;in response to a determination that the number of events that were generated during the specified time period has reached the event count associated with the particular account or project, determining, based on a license associated with the particular account or project, that the particular account or project is permitted to exceed the event count without using an overflow storage location or increasing the event count; andgenerating up to ...

CLOUD INFERENCE SYSTEM

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for storing and accessing data in a cloud system. One of the methods includes receiving an identification of log data that records occurrences of events; receiving a specification of a plurality of different event types to be indexed; indexing the log data according to the specification and group identifiers; receiving a query specifying a reference parameter and requesting one or more predicted events; searching the indexed groups to identify a plurality of groups having events associated with the reference parameter; computing one or more predicted events, from the identified plurality of groups, that are most likely to co-occur in the indexed groups with events associated with the reference parameter; and providing the computed one or more predicted events. 1. A computer-implemented method comprising:receiving an identification of log data that records occurrences of events, wherein the log data associates each event with a respective user-assigned group identifier;indexing the log data including generating respective indexed groups that each include all events in the log data having a same user-assigned group identifier;receiving a query specifying a reference parameter and requesting one or more predicted events;searching the indexed groups to identify a plurality of matching indexed groups having events associated with the reference parameter; andidentifying one or more predicted events from the plurality of matching indexed groups, the one or more predicted events being events that are most likely to co-occur, in the indexed groups, with events associated with the reference parameter.2. The method of claim 1 , further comprising:providing, to a user device, the identified one or more predicted events in response to receiving the query.3. The method of claim 1 , further comprising:identifying, from the log data, one or more respective attributes that are associated ...

SYSTEM AND METHODS FOR GENERATING OPTIMAL POST TIMES FOR SOCIAL NETWORKING SITES

A system and methods are disclosed for determining the ideal times for a person, software client, or other entity to post a message to a social networking site. An ideal time is a time when the post will have a maximum impact, where impact is some measure of success as defined by the posting entity. To determine the ideal times, the posting patterns of individual users are aggregated in a weighted fashion, taking into consideration both the entity's desired impact and the likelihood that the user will be online and able to view the post within a specified time frame. 1. A system for generating an ideal post time for a social network site for a user , the system comprising:a user database for storing captured information about followers that follow activity of the user on the social networking site;a timestamp database for storing collected times at which the followers post to the social networking site; anda computer for generating the ideal post time for the user, wherein the computer calculates the ideal post time by acquiring follower attributes, computes and assigns a score to each of the followers based on the follower attributes and the captured information in the user database, and generates an activity model for each of the followers based on the collected times in the timestamp database.2. The system of wherein the follower attributes are acquired from at least one of a social importance ranking service or a source of data having information about the followers.3. The system of wherein the computer generating the ideal post time smoothes the activity models by applying a smoothing algorithm.4. A method for generating an ideal post time for a user of a social networking site claim 2 , the method comprising:acquiring attributes of followers that follow the activity of the user on the social networking site;collecting timelines for each of the followers according to an available sequence of follower posts and times of those posts;computing and assigning a ...

WIZARD FOR CONFIGURING A FIELD EXTRACTION RULE

The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data. 130.-. (canceled)31. A computer-implemented method comprising: identify a user selection of a source type categorizing a data source of the events;', 'identify a user selection of a first example event of the events from the data source;', 'cause display of a field selection interface comprising a first area displaying the first example event with markups indicating (i) user selected tokens from text within the first example event and (ii) correspondence with the fields;', 'configure the field extraction rule to extract the user selected tokens from the first example event as the values for the fields; and', 'cause display, on a second area of the field selection interface, of a set of the events from the data source and preview extracted values for the fields, corresponding to the user selected tokens, resulting from applying the field extraction rule to the set of the events., 'providing a wizard configured to guide through configuring a field extraction rule to extract values for fields from events of raw data, wherein the ...

ON DEMAND SYNTHETIC DATA MATRIX GENERATION

An data driven approach to generating synthetic data matrices is presented. By retrieving historical network traffic data, probabilistic models are generated. Optimal distribution families for a set of independent data segments are determined. Applications are tested and performance metrics are determined based on the generated synthetic data matrices. 1. A method , comprising:calculating one or more download outcomes for one or more applications using historical network traffic data stored in a historical network data store;determining a set of performance metrics of a particular application among the one or more applications based on the one or more download outcomes;generating TCP parameters for the particular application based on the set of performance metrics, wherein the TCP parameters improve network performance of the particular application;causing a client device that is executing the particular application to be configured with the TCP parameters.2. The method of claim 1 , wherein the performance metrics include inferred performance metrics derived from application performance simulations.3. The method of claim 1 , wherein the performance metrics include performance metrics derived from probabilistic modeling.4. The method of claim 1 , wherein the performance metrics include comparing end user experience and application performance across different combinations of geography and network types.5. The method of claim 1 , further comprising:generating aggregate datasets of performance metrics comparing different combinations of network values that affect application performance.6. The method of claim 1 , further comprising:generating aggregate datasets of performance metrics comparing different combinations of network values that affect application performance; 'evaluating performance of the particular application under the different combinations of network values in the aggregate datasets.', 'wherein determining the set of performance metrics further ...

CONTROLLING TECHNICAL EQUIPMENT THROUGH QUALITY INDICATORS USING PARAMETERIZED BATCH- RUN MONITORING

A control module is adapted to control technical equipment by processing batch-run data from the technical equipment. The control module operates according to parameters that are obtained by a parameter module. The module receives a reference plurality of multi-variate reference time series with data values from sources that are related to the equipment. There are time series with measurement values and time series with data that describes particular manufacturing operations during a batch-run time interval. The module splits the time interval into phases by determining transitions between the particular manufacturing operations, and divides the time series into particular phase-specific partial series. For each phase separately, and for the phase-specific partial series in combination, the module differentiates phase-specific time series into relevant partial time series or non-relevant partial time series and set the parameters accordingly. 1. A computer-implemented method for obtaining parameters to be used by a control module of a computer , wherein the control module is adapted to control technical equipment by processing batch-run data from the technical equipment , the method comprising: a first time series from a first source, with data for first measurement values,', 'a second time series from a second source, with data for second measurement values, and', 'a third time series from a third source, with data describing particular manufacturing operations during the batch-specific batch-run time interval;, 'receiving, from technical equipment that has performed a production process, a reference plurality of multi-variate reference time series, wherein the multi-variate reference time series are based on time points of a batch-specific batch-run time interval and comprises data values from sources that are related to the technical equipment, wherein each multi-variate reference time series comprisessplitting, for each multi-variate reference time series of the ...

System and method for aiding a user decision regarding time-sensitive data elements

Provided is a system and method for aiding a user in deciding upon an appropriate action to take regarding a plurality of time-sensitive data elements, the time-sensitive data elements stored in a first database, based upon stored further information data elements stored in a second database. The user is provided with a report which comprises links between the time-sensitive data elements and the stored further information data elements.

Methods and systems for efficient querying of time-series databases

Disclosed herein are methods and systems for efficient querying of time-series databases. An embodiment takes the form of a method that includes receiving a query-input string that includes delimited character strings. The method includes generating, based on the query-input string, a query structure that includes one or more phrases. The character strings specify one or more segments of one or more clauses of one or more of the phrases. The query-input string is parsed to identify the one or more specified segments that are then added to the corresponding one or more phrases of the query structure. The method includes submitting the query structure to a query-processing system for use in querying a time-series database, receiving a query result set that was obtained from the time-series database as responsive to the query structure, and outputting the query result set for presentation via a user interface.

NON-INTRUSIVE / AGENTLESS NETWORK DEVICE IDENTIFICATION

Maintaining a database of a plurality of time series data sets, wherein each time series data set is associated to a previously known computer device of a computer network; detecting a connection request from a second computer device of the computer network; collecting one or more new data sets related to the second computer device; comparing the one or more new data sets with one or more time series data sets; calculating one or more value scores related to the plurality of time series data sets based on the comparison; and determining a device association score based on the calculated one or more value scores related to the plurality of time series data sets, wherein the device association score determines an association level between the previously known computer device and the second computer device of the computer network. 1. A method comprising:detecting a connection request from a second computer device of a computer network;collecting one or more new data sets related to the second computer device, wherein each data set of the one or more new data sets comprises one or more second data attributes extracted from network traffic data of the second computer device;comparing the one or more new data sets related to the second computer device with one or more time series data sets maintained in a database comprising a plurality of time series data sets collected at different points in time, wherein each time series data set is associated to a previously known computer device of the computer network and comprises one or more first data attributes extracted from network traffic data of the previously known computer device;calculating one or more value scores related to the plurality of time series data sets based on comparing the one or more new data sets related to the second computer device with the one or more time series data sets of the plurality of time series data sets; anddetermining a device association score based on the one or more value scores related ...

SYSTEMS AND METHODS FOR IDENTIFYING A SEQUENCE OF EVENTS AND PARTICIPANTS FOR RECORD OBJECTS

Methods, systems, and storage media for identifying a sequence of events and participants for record objects are disclosed. Exemplary implementations may: access record objects of a system of record; identify a subset of record objects associated with a group entity and having a first record object status; identify one or more electronic activities linked to the record objects; determine an event-participant pattern based on the electronic activities linked to the record object; identify electronic activities linked with a second record object; determine that a first event is performed by the a participant type and a second event is not yet performed by a second participant type; generate a content item identifying an action to trigger a performance of the second event; and transmit the content item to a device of a participant of at least one electronic activity linked with the second record object. 1. A method , comprising:accessing, by one or more processors, a plurality of record objects of a system of record of a data source provider, each record object of the plurality of record objects corresponding to a respective group entity, each record object comprising one or more object field-value pairs and linked to one or more electronic activities;identifying, by the one or more processors, a subset of record objects of the plurality of record objects associated with a group entity and having a first record object status;identifying, by the one or more processors, for each record object of the subset of record objects, one or more electronic activities linked to the record object, each electronic activity identifying one or more participants and corresponding to at least one event;determining, by the one or more processors, for each record object of the subset of record objects, an event-participant pattern based on the electronic activities linked to the record object, the event-participant pattern including at least a first event performed by a first participant ...

ADAPTING TIME SERIES DATABASE SCHEMA

In a computer-implemented method for adapting time series database schema, a plurality of queries to a time series database received over a time period is accessed, wherein time series data is ingested into the time series database according to a time series database schema, wherein time series data comprises a plurality of dimensions. The plurality of queries of the time period is analyzed to determine a relative frequency of the plurality of dimensions within the plurality of queries over the time period. It is determined whether to adapt the time series database schema based at least in part on the relative frequency of the plurality of dimensions within the plurality of queries over the time period. 1. A method for adapting time series database schema , the method comprising:accessing a plurality of queries to a time series database received over a time period, wherein time series data is ingested into the time series database according to a time series database schema, wherein time series data comprises a plurality of dimensions;analyzing the plurality of queries of the time period to determine a relative frequency of the plurality of dimensions within the plurality of queries over the time period; anddetermining whether to adapt the time series database schema based at least in part on the relative frequency of the plurality of dimensions within the plurality of queries over the time period.2. The method of claim 1 , further comprising:adapting the time series database schema based at least in part on the relative frequency of the plurality of dimensions within the plurality of queries over the time period.3. The method of claim 2 , wherein the adapting the time series database schema based at least in part on the relative frequency of the plurality of dimensions within the plurality of queries over the time period comprises:adding a shard corresponding to a dimension of the plurality of dimensions having a high relative frequency within the plurality of ...

TIME SERIES DATABASE COMPRISING A PLURALITY OF TIME SERIES DATABASE SCHEMAS

In a computer-implemented method for maintaining a time series database including a plurality of time series database schemas, time series data including data points are received at an ingestion node of a time series database, the data points comprising a plurality of dimensions. A plurality of time series database schemas of the time series database is determined for storing the time series data. The time series data is ingested according to the plurality of time series database schemas, wherein each data point is stored according to each time series database schema of the plurality of time series database schemas, such that the time series database comprises multiple instances of each data point. 1. A method for maintaining a time series database comprising a plurality of time series database schemas , the method comprising:receiving time series data comprising data points at an ingestion node of a system for maintaining a time series database, the data points comprising a plurality of dimensions;determining a plurality of time series database schemas of the time series database for storing the time series data; andingesting the time series data according to the plurality of time series database schemas, wherein each data point is stored according to each time series database schema of the plurality of time series database schemas, such that the time series database comprises multiple instances of each data point.2. The method of claim 1 , further comprising:analyzing the time series data over a time period to determine a data shape of the time series data of the time period; andadapting at least one time series database schema of the plurality of time series database schemas based at least in part on the data shape of the time series data of the time period.3. The method of claim 1 , further comprising:accessing a plurality of queries to a time series database received over a time period;analyzing the plurality of queries of the time period to determine a ...

Updating change information for current copy relationships when establishing a new copy relationship having overlapping data with the current copy reltionships

Provided are a computer program product, system, and method for updating change information for current copy relationships when establishing a new copy relationship having overlapping data with the current copy relationships. A first copy relationship indicates changed first source data to copy to first target data. An establish request is processed to create a second copy relationship to copy second source data in to second target data. A second copy relationship is generated, in response to the establish request, indicating data in the second source data to copy to the second target data. A determination is made of overlapping data units in the first source data also in the second target data. Indication is made in the first copy relationship to copy the overlapping data units. The first source data indicated in the first copy relationship is copied to the first target data, including data for the overlapping data units.

ADVANCED CYBERSECURITY THREAT MITIGATION USING SOFTWARE SUPPLY CHAIN ANALYSIS

A system and method for comprehensive cybersecurity threat assessment of software applications based on the totality of vulnerabilities from all levels of the software supply chain. The system and method comprising analyzing the code and/or operation of a software application to determine components comprising the software, identifying the source of such components, determining vulnerabilities associated with those components, compiling a list of such components, creating a directed graph of relationships between the components and their sources, and evaluating the overall threat associated with the software application based its software supply chain vulnerabilities. 1. A system for analyzing the cybersecurity threat of software applications from the software supply chain , comprising:a computing device comprising a memory and a processor; receive a software application for analysis;', 'identify one or more software components comprising the software application; and', 'send a component identifier for each software component identified to a reconnaissance engine;, 'a software analyzer comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to receive the component identifier for the one or more software components;', 'search one or more databases to identify a source of each software component;', 'search one or more databases to identify a vulnerability of each software component;', 'send the component identifier, source, and vulnerability for each of the one or more software components to a cyber-physical graph engine;, 'a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the ...

System-level approach to goal-driven design

A design application is configured to perform a system-level optimization of a collection of system components. The design application iteratively executes a multi-objective solver to optimize structural and functional relationships between the system components in order to meet global design criteria and generate a system design. The design application initializes the design process by extracting from a knowledge base system templates having taxonomic, structural, or functional attributes relevant to the system design. The design application generates the knowledge base by mining taxonomic, structural, and functional relationships from a corpus of engineering texts.

INFORMATION PROCESSING APPARATUS, INFORMATION PROCESSING SYSTEM, STORAGE MEDIUM, AND INFORMATION PROCESSING METHOD

An information processing apparatus includes a controller. The controller accumulates a scheduled vacant time period of a medical service, the scheduled period being received from an information management apparatus, in association with a medical facility corresponding to the information management apparatus. When a medical service request is received from a terminal apparatus, the controller searches for a particular medical facility as an available medical facility, being capable of providing a medical service corresponding to a medical service item in the scheduled vacant time period and that can be reached from the location of the terminal apparatus included in the medical service request in the scheduled vacant time period. The controller sends a notification of the available medical facility to the terminal apparatus sending the medical service request. The controller sends a consultation request to receive the medical service to the information management apparatus corresponding to the available medical facility. 1. An information processing apparatus comprising: accumulate a scheduled vacant time period of a medical service, the scheduled vacant time period being received from an information management apparatus, in association with a medical facility corresponding to the information management apparatus,', 'when a medical service request including a desired medical service item and a location of a terminal apparatus is received from the terminal apparatus, search a memory for a particular medical facility as an available medical facility, the particular medical facility being capable of providing a medical service corresponding to the medical service item in the scheduled vacant time period and that can be reached from the location of the terminal apparatus included in the medical service request in the scheduled vacant time period,', 'send a notification of the available medical facility to the terminal apparatus sending the medical service request, and', ...

SYSTEMS AND METHODS FOR STORING, UPDATING, SEARCHING, AND FILTERING TIME-SERIES DATASETS

A method includes generating from a time-series dataset multiple corresponding time-slice datasets. Each time-slice dataset has a corresponding time-slice time index and includes field-value data strings and associated field-value-time-index data strings, or pointers indicating the corresponding strings in an earlier time-slice dataset, that are the latest in the time-series dataset that are also earlier than the corresponding time-slice time index. A query of the time-series dataset for latest data records earlier than a given query time index is performed by using the time-slice datasets to reduce or eliminate the need to directly access or interrogate the time-series dataset. 146-. (canceled)47. A method implemented using a programmed computerized machine , the method comprising:(a) receiving at the programmed computerized machine, via a computer network, or retrieving, from one or more local or remote digital media operatively coupled to the programmed computerized machine, electronic indicia of a time-series dataset that includes, for each one of multiple defined data fields, one or more corresponding field-value (FV) data strings and, for each FV data string, a corresponding field-value-time-index (FVTI) data strings that indicates a time when information represented by that FV data string was acquired, measured, generated, or recorded;(b) using the programmed computerized machine, automatically generating, using the electronic indicia of the time-series dataset, electronic indicia of multiple time-slice datasets, each one of the multiple time-slice datasets (i) corresponding to a designated time-slice time index (TSTI) that differs from the corresponding TSTI of at least one other of the multiple time-slice datasets and (ii) including, for each one of multiple designated subsets of the multiple defined data fields, a corresponding time-slice data subset;(c) using the programmed computerized machine, automatically including in each time-slice dataset, for each ...

EFFICIENT UPDATING OF JOURNEY INSTANCES DETECTED WITHIN UNSTRUCTURED EVENT DATA

Systems and methods are disclosed for efficiently storing information identifying journey instances within unstructured event data of a data intake and processing system. Each journey instance is illustratively associated with a series of events within the unstructured event data occurring over a journey duration. Because the unstructured event data may be constantly updated, any given inspection of the event data may yield both complete and incomplete instances. Storage of instance data over time can require updating of prior incomplete journey instances with complete versions of such instance detected at a later point in time. However, a data store of the unstructured event data may be unsuited for such updating, as the store may maintain version information for deleted data to reduce possibility of data loss. To address this issue, a separate structured data store, such as a columnar time series data store, is provided to efficiently store instance information. 1. A computer-implemented method comprising:executing, on a data store of unstructured event data, a query for instances of a journey representing a series of steps;obtaining, in response to the query, query results representing one or more complete journey instances, each of the one or more complete journey instances representing a series of events conforming to an entirety of the series of steps; andupdating a structured data store with the query results obtained from the unstructured event data, wherein the structured data store is configured to store each journey instance as a distinct data entry within the structured data store, and wherein updating the structured data store comprises replacing an existing data entry within the structured data store representing a partial journey instance, representing at least one event conforming to a beginning of the series of steps and less than the entirety of the series of steps, with a new data entry representing a complete journey instance corresponding to the ...

ANTICIPATORY PRE-EXECUTION OF DATA QUERIES

Embodiments of the invention provide for anticipatory pre-execution of queries. In an embodiment of the invention, a method for anticipatory pre-execution of queries includes the computation of an execution cost of each of a multiplicity of different queries to a data source scheduled at a specified time on a specified date. The method also includes monitoring a querying processing schedule and detecting from the monitoring, unscheduled time on a particular date prior to the specified time on the specified date. Finally, the method includes responding to the detection by first selecting a most expensive one of the different queries in terms of execution cost, for instance an amount of computing resources consumed in executing a corresponding one of the different queries, and then executing the selected most expensive one of the different queries during the unscheduled time on the particular date prior to the specified time on the specified date. 1. A method for anticipatory pre-execution of queries comprising:computing an execution cost of each of a multiplicity of different queries to a data source scheduled at a specified time on a specified date;monitoring a querying processing schedule;detecting from the monitoring, unscheduled time on a particular date prior to the specified time on the specified date; and,responding to the detection by selecting a most expensive one of the different queries in terms of execution cost and executing the selected most expensive one of the different queries during the unscheduled time on the particular date prior to the specified time on the specified date.2. The method of claim 1 , further comprising:filtering the different queries to include only queries not reliant upon underlying data anticipated to be updated after the unscheduled time on the particular date and before the specified time on the specified date.3. The method of claim 1 , wherein the selecting comprising selecting not only a most expensive one of the different ...

Systems and methods for configuring system memory for extraction of latent information from big data

A system for extracting latent information from data includes obtaining or generating components of the data, where the data components include scores indicating how the component relates to the data. Memory is allocated for the components and the components are stored in the allocated memory. The components are then transformed into documents using a suitable transformation function, and the documents are analyzed using natural language processing, to extract latent information contained in the data.

METHODS AND SYSTEMS FOR CLASSIFYING DATABASE RECORDS BY INTRODUCING TIME DEPENDENCY INTO TIME-HOMOGENEOUS PROBABILITY MODELS

Methods and systems are described herein for improving data processing efficiency of classifying user files in a database. More particularly, methods and systems are described herein for improving data processing efficiency of classifying user files in a database in which the user files have a temporal element. The methods and system described herein accomplish these improvements by introducing time dependency into time-homogeneous probability models. Once time dependency has been introduced into the time-homogeneous probability models, these models may be used to improve the data processing efficiency of classifying the user files that feature a temporal element. 1. A system for improving data processing efficiency of classifying user files in a database into disparate states by introducing time dependency into time-homogeneous probability models , the system comprising:cloud-based storage circuitry configured to store a user record for a user; receiving a request to determine respective probabilities that the user record for a user belongs to each of a plurality of user record states, wherein the plurality of user record states comprises user record states defined by a time period for which the user record has been delinquent and a user record state corresponding to a charge-off of the user record;', 'retrieving a user record history for the user record, wherein the user record history comprises periodic status checks;, 'cloud-based control circuitry configured to determining a number of the periodic status checks in the user record history;', 'selecting a first stochastic probability model of a plurality of stochastic probability models based on the number of the periodic status checks in the user record history corresponding to a first range;', 'processing the feature input using the first stochastic probability model; and', 'receiving a first output of the first stochastic probability model indicating the respective probabilities that the user record for the ...

CORRELATING MULTIPLE SOURCES

A method and system of correlating annotations of media files. A first media file is received from a first media recording device. A file record for the first media file is created in the file table. A determination is made whether the first media file belongs to an existing matter group. Upon determining that the first media file belongs to an existing matter group: the file record is related with the existing matter group in the file table; annotations of the first media file that are flagged to be shared, are related to all media files of the existing matter group; and annotations of all the media files of the existing matter group to the first media file are related. Upon determining that the first media file does not belong to an existing matter group, a new matter group is created for the first media file in the matter table of the central server. 111-. (canceled)12. A media recording device comprising:one or more processors;a network interface coupled to the one or more processors configured to enable communications via a communication network;storage device for content and executable instructions; and creating a media file on the media recording device;', 'sending a data packet;', 'receiving an event identifier that is associated with information in the data packet and identifies an event;', 'associating the event identifier with the media file by the association with the information in the data packet;', 'receiving first annotations of media files associated with the event identifier that is associated with the media file;', 'storing the first annotations in the storage;', 'receiving second annotations of the media file;', 'associating the second annotations with the event identifier;', 'storing the second annotations in the storage; and', 'sending the media file, first annotations, and second annotations, configured to be mutually associated by the event identifier., 'instructions stored in the storage, wherein execution of the instructions by the one or ...

Efficient storage and querying of time series metrics

A method for processing time series measurement data is provided. Data including a plurality of network performance metrics is received over a plurality of time periods. The received data is written to a plurality of measure data structures. The measure data structures are stored to a two dimensional array having a first dimension and a second dimension. The first dimension represents time and the second dimension represents a plurality of network entities. Elements of the two-dimensional array are compressed into BLOBs. Each one of the BLOBS is associated with a time period and a measure type associated with the data stored within a corresponding BLOB. The BLOBS are stored in a first table and second table. The first table is indexed by a combination of a network entity and a time period. The second table is indexed by a combination of a network performance metric and a network entity.

Executing alert actions based on search query results

A system that enables a user to configure alert actions based on search results generated by a query is disclosed. During operation, the system presents an alert user interface (UI) to a user, wherein the alert UI enables the user to configure one or more alert actions to be performed based on the search results. Next, the system receives alert configuration information from the user through the alert UI, wherein the alert configuration information includes tokens representing parameters associated with the query and the search results. Then, while generating an alert associated with the search results, the system performs a token substitution operation that substitutes tokens in the alert configuration information with corresponding parameters from the search results to generate a payload that is communicated to alert-generating functionality. This token substitution allows the parameters to be used by the alert-generating functionality while performing the one or more alert actions.

Visualization of Unique Field Values for a Field in a Set of Events

Systems and methods are provided for visualizing the number of events having different values for a field of interest over a selected time range. The events may be derived from machine data obtained from one or more data sources. User input received via a graphical user interface may specify the field of interest, a time range, and a time granularity for displaying counts of the number of events having various values during different time slots within the selected time range. Events including the specified field during the user-selected time range are identified and values for the field are extracted from the identified events. A visualization indicating a relation between a number of the events occurring within each of a plurality of time slots over the selected time range and each of the unique extracted values of the field is provided to the user via the graphical user interface.

Identifying relationship instances between entities

A method, a computing system, and a non-transitory machine readable storage medium containing instructions for identifying relationships between entities are provided. In an example, the method includes receiving a query. The query specifies a first computing entity, a second computing entity, and a window of time. A data structure is queried based on the query to identify a set of relationship instances each corresponding to a relationship between the first computing entity and the second computing entity during the window of time. A representation of the first computing entity, the second computing entity, and the set of relationship instances is provided at a user interface.

System And Method For Compiling Search Results Using Information Regarding Length Of Time Users Spend Interacting With Individual Search Results

A system and method for producing more relevant search results. When a user selects a search result from a search result listing, the amount of time that the user spends interacting with the item associated with the search result is tracked. Such information regarding interaction time is compiled and is used as a factor in assessing relevance of items in future searches.

Selecting network security investigation timelines based on identifiers

Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

Parallel edge scan for single-source earliest-arrival in temporal graphs

Methods, systems, and computer-readable storage media for receiving data representative of the temporal graph, the data representing vertices, edges between vertices, and temporal features, determining a set of earliest-arrival dependencies, each earliest arrival dependency including an earliest feasible edge between vertices from a list of edges of the temporal graph, providing data representative of an edge-scan-dependency graph (ESD-graph) based on the data representative of the temporal graph, and the set of earliest-arrival dependencies, the ESD-graph including vertices representing edges of the temporal graph, and edges representing earliest-arrival dependencies between vertices, providing data representative of a level-assigned ESD-graph including a level assigned to each vertex of the ESD-graph, and determining earliest-arrival times between a source vertex, and each vertex of the temporal graph by executing a parallel edge scan of the level-assigned ESD-graph.

APPARATUS, SYSTEMS, AND METHODS FOR PROVIDING LOCATION INFORMATION

The disclosed apparatus, systems, and methods relate to a location query mechanism that can efficiently determine whether a target entity is located within a region of interest (ROI). At a high level, the location query mechanism can be configured to represent a ROI using one or more polygons. The location query mechanism can, in turn, divide (e.g., tessellate) the one or more polygons into sub-polygons. Subsequently, the location query mechanism can use the sub-polygons to build an index system that can efficiently determine whether a particular location is within any of the sub-polygons. Therefore, when a computing device queries whether a particular location is within the region of interest, the location query mechanism can use the index system to determine whether the particular location is within any of the sub-polygons. 1. An apparatus comprising: represent a region of interest with one or more polygons;', 'determine a plurality of sub-polygons that are contained within the one or more polygons, wherein each of the sub-polygons is associated with a unique code; and', 'generate an index system based on at least a subset of the plurality of sub-polygons,, 'a processor and non-volatile memory comprising a set of computer-readable instructions, wherein the processor is configured to execute the computer readable instructions to [ comparing a first set of bits of one or more bits in the query identifier, corresponding to a lower-precision sub-polygon, to bits in the index system, corresponding to sub-polygons in the region of interest; and', 'comparing a second set of bits of the one or more bits in the query identifier, corresponding to a higher-precision sub-polygon, to bits in the index system, corresponding to the sub-polygons in the region of interest; and, 'compare a query identifier corresponding to the location identifier with the index system to determine that the location identifier is within the region of interest, wherein the step of comparing includes, ...

PIPELINED SEARCH QUERY, LEVERAGING REFERENCE VALUES OF AN INVERTED INDEX TO DETERMINE A SET OF EVENT DATA AND PERFORMING FURTHER QUERIES ON THE EVENT DATA

Embodiments of the present disclosure provide techniques for using an inverted index in a pipelined search query. A field searchable data store is provided that comprises a plurality of event records, each event record comprising a time-stamped portion of raw machine data. Responsive to the receipt of an incoming search query, the search engine accesses an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and value pair that identifies a location in the data store where an associated event record is stored. Once the inverted index is accessed, it can be used to identify and search a subset of the plurality of event records, wherein the subset comprises one or more event records with corresponding reference values in the inverted index. 1. A system comprising:a field searchable data store comprising a plurality of event records, each event record comprising a time-stamped portion of raw machine data; receive an incoming query;', 'responsive to the incoming query, accessing an inverted index, wherein, 'a processing device coupled to access the field searchable data store, the processing device being configured to in a first pipe stage of the pipelined process, using the inverted index to identify a first subset of the plurality of event records, wherein the first subset comprises one or more event records with corresponding reference values in the inverted index that satisfy a portion of the incoming query; and', 'responsive to commands in a subsequent pipe stage of the pipelined process, accessing the first subset of the plurality of event records using the corresponding reference values, and performing a search of raw machine data associated with the first subset of the plurality of event records., 'using a pipelined process to generate results of the incoming query, the pipelined process comprising, 'each entry in the inverted ...

DETERMINING AN EXTRACTION RULE FROM POSITIVE AND NEGATIVE EXAMPLES

The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data. 1. A computer-implemented method comprising:receiving, via a sampling tool, a selection of a primary event and a secondary event from a plurality of events, wherein each event in the plurality of events includes a portion of raw data;receiving, via a selection tool, a selection of a first portion of text within the raw data of the primary event as a positive example of a first value to extract for a field;receiving, via the selection tool, a selection of a second portion of text within the raw data of the secondary event as a negative example of a second value not to extract for the field; andautomatically determining an extraction rule that extracts the first value, but not the second value, into a set of values of the field.2. The method of claim 1 , further comprising presenting an initial markup of the primary event comprising an indication claim 1 , on the primary event claim 1 , (i) of the first portion of text exacted as the first value claim 1 , and (ii) of the field.3. The method of claim 1 , further comprising: ...

Anomaly detection on time series data

In a computer-implemented method for anomaly detection on time series data, time series data is accessed. A forecasting algorithm is applied to at least a portion of the time series data to generate a forecast confidence band for a time window following the at least a portion of the time series data. The forecast confidence band for the time window is compared to the time series data of the time window. It is determined whether the time series data includes an anomaly based at least in part on the comparing.

COMPUTING DEVICE FOR LOGGING CHANGES IN A PERSON'S MOOD OVER TIME

A computing device for logging changes in a person's mood over time, the device comprising a user interface for receiving a user-input selecting one of a plurality of mood descriptors indicative of the user's mood at a current point in time, a processor configured to determine a pair of values associated with the selected mood descriptor, wherein a first value in the pair of values defines a position on a first mood axis and the second value in the pair defines a position on a second mood axis, the first and second mood axes being associated with different aspects of mood, a memory for storing the pair of values together with an indicator of the current point in time, the processor being further configured to compare the pair of values with one or more other pairs of values obtained at respective points in time, thereby to generate trend date reflecting one or more trends in the values over time. 1. A computing device for logging changes in a person's mood over time , the device comprising:a user interface for receiving a user-input indicative of the user's mood at a current point in time;a processor configured to determine a pair of values associated with the user-input, wherein a first value in the pair of values defines a position on a first mood axis, and the second value in the pair defines a position on a second mood axis, the first and second mood axes being associated with different aspects of mood; anda memory for storing the pair of values together with an indicator of a current point in time,the processor being further configured to compare the pair of values with one or more other pairs of values obtained at respective points in time, thereby to generate trend data reflecting one or more trends in the values over time;wherein the computing device stores a predetermined threshold value;wherein, for each pair of values, the processor is configured to determine if one or both of the values lie above or below the predetermined threshold value; andwherein the ...

SUPPORTING REPORTABILITY OF INTERNET OF THINGS (IOT) DATA IN THE CLOUD FOR ENTERPRISE CONTEXTS

Methods, systems, and computer-readable storage media for selective use of Internet-of-Things (IoT) data in data analytics systems. Implementations include receiving IoT data from an IoT device, determining that hardening is to be applied to the IoT data, comparing a timestamp of the IoT data to a hardening value, and in response to comparing, selectively using the IoT data in one or more uses by the data analytics system. 1. A computer-implemented method for selective use of Internet-of-Things (IoT) data in data analytics systems , the method being executed by one or more processors and comprising:receiving IoT data from an IoT device;determining that hardening is to be applied to the IoT data;comparing a timestamp of the IoT data to a hardening value; andin response to comparing, selectively using the IoT data in one or more uses by the data analytics system.2. The method of claim 1 , wherein the hardening value comprises a hardening timestamp and the IoT data is not used in the one or more uses by the data analytics system when the timestamp exceeds the hardening timestamp.3. The method of claim 1 , wherein the hardening value comprises a hardening timespan and the IoT data is not used in the one or more uses by the data analytics system when the timestamp is not within the hardening timespan.4. The method of claim 3 , wherein the hardening timespan is relative to a current time.5. The method of claim 1 , further comprising determining one or more of a type of the IoT data and a use of the IoT data claim 1 , wherein determining that hardening is to be applied to the IoT data is at least partially based on one or more of the type of the IoT data and the use of the IoT data.6. The method of claim 1 , wherein the IoT data is not used for at least one use and is used for another use.7. The method of claim 1 , wherein the IoT data is received in real-time and determining that the hardening is to be applied to the IoT data is executed in response to the receiving the ...

SYSTEMS AND METHODS FOR QUERYING TIME SERIES DATA

A server system may include one or more hardware processors that execute computer-readable instructions from a non-transitory memory that cause the processor to receive a time component associated with a query request and one or more relational identification tags associated with a subset of a plurality of data items stored in one or more databases. The processor may then query the one or more databases to identify one or more time series data items based on the time component and the relational identification tags. After querying the databases, the processor may transmit the one or more time series data items to a computing device configured to display the one or more time series data items. 1. A non-transitory computer-readable medium , comprising computer-executable instructions that , when executed by one or more processors , cause the one or more processors to:receive a time component and a relational component associated with a query request;query a first round robin database based on the relational component to identify a plurality of data items stored in the first round robin database;retrieve one or more relational identification tags that identify each data item of the plurality of data items;query a second round robin database to identify one or more time series data items based on the time component and the one or more relational identification tags;send the one or more time series data items to a computing device configured to apply one or more mathematical operations to the one or more time series data items according to an analysis component of the query request, thereby generating one or more results of the one or more mathematical operations applied to the one or more time series data items;detect one or more anomalies within the one or more results received from the computing device; andprovide a notification indicative of the one or more anomalies.2. The non-transitory computer-readable medium of claim 1 , wherein the time component comprises a ...

Methods and systems for network-sensitive data collection and intelligent process adjustment in an industrial environment

An apparatus, methods and systems for monitoring network-sensitive data collection related to an industrial production process are disclosed. The system may include a data collector communicatively coupled to a plurality of input channels and to a network infrastructure, a data storage circuit structured to store a plurality of collector routes wherein the data collector receives collected data utilizing a selected collector route, a data analysis circuit structured to determine a data collection quality parameter and a state value of the industrial production process, a pattern recognition circuit structured to determine an identified pattern in response to at least a portion of the collected data and at least one of the state value or the data collection quality parameter, and an analysis response circuit structured to adjust one of the collector routes or the industrial production process in response to the identified pattern.

Methods and systems for detection in an industrial internet of things data collection environment with expert system detection and process response for oil and gas processing operations

Methods and systems for a monitoring system for data collection in an industrial environment including a data collector communicatively coupled to a plurality of input channels connected to data collection points operationally coupled to an industrial component in at least one of an oil processing system or gas processing system; a data storage structured to store a plurality of stored process condition states; a data acquisition circuit structured to interpret a plurality of detection values from the collected data; an expert system detection circuit structured to detect a process condition in response to the plurality of detection values, wherein the expert system detection circuit generates a process condition notification if a process condition is detected that matches one of the plurality of stored process condition states; and a response circuit structured to provide an alert in response to the process condition notification.

Distributed processing system throttling using a timestamp

Methods, systems, and apparatus are described for throttling a distributed processing system In one aspect, a method includes identifying records being processed by a distributed processing system that performs agent processes, each of the records including a corresponding timestamp; determining, based on timestamps of the records that have been processed by a first agent process, a first agent progress; identifying a dependent agent process performed by the distributed processing system, wherein the dependent agent process processes only records that have been processed by the first agent process; determining, based on timestamps of records that have been processed by the dependent agent process, a dependent agent progress; and throttling performance of the first process based on the first agent progress and the dependent agent progress. 1. A method for data processing , the method comprising:determining, by one or more processors, a first agent progress in processing a set of records, wherein the first agent progress is based on a timestamp of an oldest record of the set of records processed by a first agent process and in a first queue for a second agent process, the timestamp of the oldest record processed corresponding to a time difference between the oldest record being processed by the first agent process and a current system time; andthrottling, based on the time difference, performance of the first agent process.2. The method of claim 1 , wherein each record of the set of records processed by the first agent process is provided to the first queue.3. The method of claim 1 , wherein throttling performance of the first agent process includes reducing the processing speed of data processors performing the first agent process.4. The method of claim 1 , wherein throttling performance of the first agent process includes removing one or more data processors assigned to perform the first agent process.5. The method of claim 4 , further comprising:determining, by the ...

PRIVILEGE ASSURANCE OF ENTERPRISE COMPUTER NETWORK ENVIRONMENTS USING ATTACK PATH DETECTION AND PREDICTION

A system and method for the privilege assurance of enterprise computer network environments using attack path detection and prediction. The system uses local session monitors to monitor logon sessions within a network, track session details, and log session and network host details. Cyber-physical graphs are produced and used to identify paths within the network based on the logged information, and to apply risk weighting to the identified paths and determine likely attack paths an attacker may use. 1. A system for privilege assurance of enterprise computer network environments using attack path detection and prediction , comprising: receive a plurality of session-based details for an authentication session for a user;', 'log the plurality of session-based details;', 'retrieve a plurality of host details about the first computing device;', 'log the plurality of host details;', 'monitor activity of the authentication session;', 'generate an event log based on the monitored activity;', 'send the event log to a graph engine;, 'a local session monitor comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device within a computer network operating a directory access protocol, wherein the first plurality of programming instructions, when operating on the processor of the first computing device, cause the first computing device to receive the event log;', 'retrieve the logged session-based details and host details;', 'create and store a cyber-physical graph of the computer network using the event log and the logged session-based details and the logged host details, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;', 'perform a plurality of queries over time on the cyber-physical graph to identify paths between nodes;', 'receive results of the plurality of queries ...

System and method for self-adjusting cybersecurity analysis and score generation

A system and method for self-adjusting cybersecurity analysis and score generation, wherein a reconnaissance engine gathers data about a client's computer network from the client, from devices and systems on the client's network, and from the Internet regarding various aspects of cybersecurity. Each of these aspects is evaluated independently, weighted, and cross-referenced to generate a cybersecurity score by aggregating individual vulnerability and risk factors together to provide a comprehensive characterization of cybersecurity risk using a transparent and traceable methodology. The scoring system itself can be used as a state machine with the cybersecurity score acting as a feedback mechanism, in which a cybersecurity score can be set at a level appropriate for a given organization, and data from clients or groups of clients with more extensive reporting can be used to supplement data for clients or groups of clients with less extensive reporting to enhance cybersecurity analysis and scoring.

PRIVILEGE ASSURANCE OF ENTERPRISE COMPUTER NETWORK ENVIRONMENTS USING LATERAL MOVEMENT DETECTION AND PREVENTION

A system and method for the privilege assurance of enterprise computer network environments using lateral movement detection and prevention. The system uses local session monitors to monitor logon sessions within a network, generating and verifying event logs and authentication records to ensure the legitimacy of authenticated user sessions and to revoke credentials when an illicit session is detected, halting lateral movement in real-time. 1. A system for privilege assurance of enterprise computer network environments using lateral movement detection and prevention , comprising:{'claim-text': ['receive a first plurality of session-based details for an authentication session for a user;', 'check the validity of the first plurality of session-based details, using a stored session configuration;', 'log the first plurality of session-based details;', 'receive a second plurality of session details;', 'compare the first and second pluralities of session details against a stored expected pattern to identify any mismatched data;', 'where invalid or mismatched information is identified in the first or second pluralities of session-based details or in the comparison against a stored expected pattern, revoke the authentication credentials for the session and generate an event log indicating the particular session-based details that contain the invalid or mismatched information;', 'send the event log to a graph engine;'], '#text': 'a local session monitor comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device within a computer network operating a directory access protocol, wherein the first plurality of programming instructions, when operating on the processor of the first computing device, cause the first computing device to:'}{'claim-text': ['receive the event log;', 'create and store a cyber-physical graph of the computer network using the event log, wherein the vertices of the cyber-physical ...

SYSTEM AND METHOD FOR AGGREGATING AND SECURING MANAGED DETECTION AND RESPONSE CONNECTION INTERFACES BETWEEN MULTIPLE NETWORKED SOURCES

A system and method for a flexible, high-speed Managed Detection and Response platform that ingests, parses, normalizes, monitors, and correlates nearly any log source or security tool output. The MDR comprising of a declarative connector service that tags events with appropriate data source labels to facilitating data isolation, proper handling, and provenance across multiple customers and security products but otherwise aggregate alerts into a single data stream for consumption by the MDR SOC operators. A connector service further provides a programmatic (API-based) means to interchange data securely across environments. Event data is aggregated by the Managed Detection and Response platform that then utilizes enhanced log ingest capabilities to process the data allowing SOC operators to be able to write rules against the alerts. 1. A system for facilitating data isolation , proper handling , and provenance across multiple entities and security products comprising:a computing device comprising a memory, a processor, and a non-volatile data storage device; receive a service configuration, wherein the service configuration comprises authentication information, access information, and processing information;', 'store the service configuration in the non-volatile data storage device;', 'retrieve data from a service using at least the authentication and the access information in the service configuration, wherein the retrieved data comprises computing and networking events;', 'embed a tag to each event according to the respective processing information;', 'organize the retrieved and tagged data into a single data stream;', 'encrypt the single data stream; and', 'send the encrypted data stream comprising tagged data over a network to a secure processing facility., 'a connector interface service comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of ...

AI-DRIVEN DEFENSIVE CYBERSECURITY STRATEGY ANALYSIS AND RECOMMENDATION SYSTEM

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators. 1. A system for automated cybersecurity defensive strategy analysis and recommendations , comprising:{'claim-text': ['execute a cyberattack on a network under test; and', 'gather system information about the operation of the network under test during the cyberattack, the system information comprising information about the sequence of events and response of affected devices during the cyberattack;'], '#text': 'an attack implementation engine comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:'}{'claim-text': ['use the system information to initiate an iterative simulation of a cyberattack strategy sequence, each iteration comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm;', 'obtain a simulation result comprising the cyberattack strategy sequence and a probability of success of the attack and the defense in each iteration; and'], '#text': 'a machine learning simulator comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the ...

SYSTEM AND METHODS FOR AUTOMATICALLY ASSESSING AND IMPROVING A CYBERSECURITY RISK SCORE

A system and method for automatically assessing and improving a cybersecurity risk score, wherein a cybersecurity risk score and cyber-physical graph for a network are retrieved and analyzed to identify potential improvements that can be made to network topography and device configurations, changes are applied automatically and an updated cyber-physical graph reflecting the applied changes is produced, and the updated cyber-physical graph is reassessed to determine the effect of the changes that were applied. 1. A system for automatically assessing and improving a cybersecurity risk score , comprising:a computing device comprising a memory, a processor, and a network interface;{'claim-text': ['retrieve a cybersecurity risk score for a network;', 'retrieve a cyber-physical graph for the network;', 'provide the cybersecurity risk score and the cyber-physical graph to a directed computational graph engine;'], '#text': 'a cybersecurity scoring engine comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:'}{'claim-text': ['analyze the cyber-physical graph and the cybersecurity risk score;', 'identify a plurality of changes that can be applied to each of a plurality of target devices within the network, the identified plurality of changes being based on results of the analysis;', 'transmit instructions to the plurality of target devices, wherein upon receipt of the instructions each of the plurality of target devices applies at least one of the identified plurality of changes; and', 'update the cyber-physical graph based on the applied changes.'], '#text': 'a directed computational graph module comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of ...

EFFICIENT TIME-RANGE QUERIES ON DATABASES IN DISTRIBUTED COMPUTING SYSTEMS

The present disclosure relates to querying data cores for data items that correspond to a specified time range. Probabilistic data structures corresponding to associated data cores are used to filter the plurality of data cores to identify a subset of data cores that contain data items corresponding to the specified time range. Only the subset of the plurality of data cores determined to contain relevant data items are searched. 1. A method for processing time-range queries on databases with timestamped data items stored across a plurality of data cores in a distributed computing system , the method comprising:at the distributed computing system:receiving a search request for one or more data items, wherein the search request is limited to data items within a specified time range;querying a plurality of probabilistic data structures based on the specified time-range, wherein each probabilistic data structure is used to track a membership of data items stored within a respective data core by tracking which time-ranges of a plurality of time-ranges correspond to a timestamp of one or more data items stored within the respective data core;determining, based on querying the plurality of probabilistic data structures, which of the plurality of data cores contains one or more data items corresponding to the specified time range; andin accordance with a determination that a subset of the plurality of data cores contains one or more data items corresponding to the specified time range, executing the search request on the subset of the plurality of data cores.2. The method of claim 1 , wherein the search request is not executed using any data core not in the subset of the plurality of data cores.3. The method of claim 1 , further comprising:in accordance with a determination that none of the plurality of data cores contain one or more data items corresponding to the specified time range, forgoing execution of the search request.4. The method of claim 1 , wherein a size of ...

Application of search policies to searches on event data stored in persistent data structures

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.

Systems and methods for automated governance, risk, and compliance

Systems and methods for configuration vulnerability checking and remediation are provided. The systems provided herein identify risk based upon service indications of a particular configuration, such that automated risk analysis may be facilitated.

METHODS, SYSTEMS AND APPARATUS TO IMPROVE SPATIAL-TEMPORAL DATA MANAGEMENT

Methods, apparatus, systems and articles of manufacture are disclosed to improve spatial-temporal data management. An example apparatus includes a hypervoxel data structure generator to generate a root hexatree data structure having sixteen hypernodes, an octree manager to improve a spatiotemporal data access efficiency by generating a first degree of symmetry in the root hexatree, the octree manager to assign a first portion of the hypernodes to a positive temporal subspace and to assign a second portion of the hypernodes to a negative temporal subspace, and a quadtree manager to improve the spatiotemporal data access efficiency by generating a second degree of symmetry in the root hexatree, the quadtree manager to assign respective hypernodes of the positive temporal subspace and the negative temporal subspace to respective positive and negative spatial subspaces. 1. (canceled)2. An apparatus comprising:memory;instructions in the apparatus; and in response to a determination that a write request associated with a spatio-temporal data structure includes a data point to be added to the spatio-temporal data structure, extract spatio-temporal data from the data point;', 'determine whether the spatio-temporal data is included in a boundary of a root node of the spatio-temporal data structure; and', 'at least one of expand the spatio-temporal data structure or insert the spatio-temporal data in the spatio-temporal data structure based on the determination of whether the spatio-temporal data is included in the boundary., 'processor circuitry to execute the instructions to at least3. The apparatus of claim 2 , wherein the spatio-temporal data structure is a root hexatree data structure claim 2 , and the processor circuitry is to execute the instructions to:generate the root hexatree data structure to have a plurality of hypernodes;assign a first portion of the plurality of the hypernodes to have a respective positive temporal subspace; andassign a second portion of the ...

METHODS AND SYSTEMS FOR PROCESSING AND STORING STREAMED EVENT DATA

Methods and systems for processing real-time event data by aggregating event data over various time windows and storing aggregate event data records containing the aggregated data. The method may include receiving event data at a current time, determining that the event data relates to a time prior to the beginning of a current time window, and identifying, based on the time, one or more stored aggregate event records each associated with a respective previous time window. The method may include creating, for each of the identified one or more stored aggregate event records, a new aggregate event record containing updated aggregate event data adjusted by the event data, and storing each new aggregate event record in association with its respective previous time window and a creation timestamp reflecting the current time.

Systems and methods for automatic query generation and notification

Systems and methods for providing notifications to users of one or more client interfaces based on data retrieved from a plurality of databases remote to the one or more client interfaces. A notification definition data store can be configured to store one or more notification definitions each comprising one or more query criteria, or data requirements. A notification configuration data store can associate one or more notification definitions with one or more users. A processing server can generate a query request for each query criteria of each notification definition associated with each user in the set of active users. A query management engine can retrieve each query request and retrieve a query response based on the query criteria of the query request from the plurality of databases. A display generator can display user interface elements based on the retrieved query responses for each of the query criteria of the query execution queue.

BLOCK DATA STORAGE SYSTEM IN AN EVENT HISTORIAN

An event historian system receives event data from a client system via a network connection and stores the event data in a block data storage system. An event data block in which to store the received event data is selected based on the time range of the occurrence of the received event data. The received event data is stored in a snapshot within the event data block. Event property data is extracted from the received event data and used to build a plurality of event property index files. 120-. (canceled)21. A system for storing event data from an industrial process comprising:an event historian comprising one or more processors and one or more non-transitory computer readable media, the one or more non-transitory computer readable media comprising instructions stored thereon that when executed by the one or more processors implement:a storage block,wherein the system is configured to receive event data;wherein the event data comprises an individual event from an industrial process;wherein the event data comprises properties including one of an event type and an occurrence time of the individual event;wherein the system is configured to write the received event data to a snapshot;wherein the snapshot includes a time period that includes the individual event;wherein the system is configured to analyze the individual event for one or more common patterns by comparing the event with one or more similar events;wherein the system is configured to separate the individual event into a separated event and the one or more common patterns; andwherein the system is configured to store the one or more common pattern separately from the separated event.22. The system of claim 21 ,the one or more non-transitory computer readable media further comprising instructions stored thereon that when executed by the one or more processors implement:a merge process;wherein the merge process is configured to run iteratively across each of a plurality of snapshots in the storage block; ...

System, method and computer program product for defining custom junction objects in an on-demand database service

In accordance with embodiments, there are provided mechanisms and methods for defining custom junction objects in an on-demand database service. These mechanisms and methods for defining custom junction objects in an on-demand database service can enable embodiments to provide for enhanced security and more efficient querying, etc. The ability of embodiments to provide such features may lead to these and other benefits in an on-line environment.

SYSTEM AND METHOD FOR GENERATING HISTOGRAMS

A method for constructing histograms may include receiving a set of data values, wherein the data values are two-dimensional or three-dimensional and the data values contain at least one measurement over time; creating a plurality of bins in memory, wherein the plurality of bins are log-linear bins using 2 significant digits base 10; creating a zero bin representing the number 0; placing non-zero numbers of the set of data values into the plurality of bins; and generating one or more histograms using the bins. 115-. (canceled)16. A method for constructing histograms with a uniform bin scheme , the method comprising:receiving, by one or more processors, a first set of data values, wherein the first set of data values include a first type of measurement for a first time interval;creating, by the one or more processors, a first set of bins in memory to represent the first set of data values,wherein creating the first set of bins comprises assigning a first bin to represent any data value of zero in the first set of data values, and assigning to each of the remaining bins in the first set of bins a respective range spanning two different numbers, such that the first bin represents the number zero, and the remaining bins represent non-zero numbers;generating, by the one or more processors, a first histogram using the first set of bins and the first set of data values, wherein the first histogram indicates, for each bin of the first set of bins, how many data values of the first set of data values are represented by the bin, and wherein the first histogram is for the first time interval;receiving, by the one or more processors, a second set of data values, wherein the second set of data values include the first type of measurement for a second time interval;generating, by the one or more processors, a second histogram using the first set of bins and the second set of data values, such that the first histogram and the second histogram have a uniform bin scheme by using the ...

CONTINUOUSLY SCROLLABLE CALENDAR USER INTERFACE

A method is provided to scroll a calendar user interface (UI) comprising: displaying on a device display screen a visible range of a calendar UI, wherein the calendar UI includes a display grid that includes individual date display panes that are associated with individual dates, wherein the date panes are arranged in rows corresponding to weeks and columns corresponding to days of the week and wherein the visible range of the calendar UI includes multiple rows of date panes; receiving user input to indicate a scroll direction in which to scroll the display grid to display a different date range that includes earlier or later date display panes; and in response to the user input, scrolling the calendar UI by rows to the different date range. 1. A method to display a calendar user interface comprising:assigning individual shading levels to individual dates of individual months of a calendar user interface, wherein the individual shading levels assigned to the individual dates of the individual months successively increase in darkness, such that the individual shading levels start with a first date of an individual month having a lightest shade level and end with a last date of the individual month having a darkest shade level, and wherein the individual shading levels assigned to the individual dates are maintained for the individual dates and recur for successive months to provide a sharp visual transition in shading between the darkest shade level of the last date of the individual month and a subsequent lightest shade level of a subsequent first date of a subsequent month; anddisplaying, on a device display screen, a visible range of the calendar user interface, the visible range including a display grid comprising date panes associated with the individual dates, wherein the display grid shows the individual months with the date panes having background shading in accordance with the individual shading levels assigned for the individual dates, the date panes being ...

Accelerating Time Series Data Base Queries Using Dictionary Based Representations

A method for accelerating time series data base queries includes segmenting an original time series of signal values into non-overlapping chunks, where a time-scale for each of the chunks is much less than the time scale of the entire time series, representing time series signal values in each chunk as a weighted superposition of atoms that are members of a shape dictionary to create a compressed time series, storing the original time series and the compressed time series into a database, determining whether a query is answerable using the compressed time series or the original time series, and whether answering the query using the compressed time series is faster. If answering the query is faster using the compressed representation, the query is executed on weight coefficients of the compressed time series to produce a query result, and the query result is translated back into an uncompressed representation.

SYSTEM AND METHOD FOR COLLABORATIVE CYBERSECURITY DEFENSIVE STRATEGY ANALYSIS UTILIZING VIRTUAL NETWORK SPACES

A system and method for collaborative cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and creates a virtual network space that provides a virtual reality environment for collaborative insights into network dynamics during a cyberattack. makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a virtual network space model of the networked system created using a virtual network space manager. A simulation interaction server can facilitate secure sharing of virtual network spaces and simulations between and among various real and virtual actors to provide a collaborative space where one or more organization's network can be tested for resilience and mitigation. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators. 1. A system for collaborative cybersecurity defensive strategy analysis utilizing virtual network spaces , comprising: execute a cyberattack on a network under test; and', 'gather system information about the operation of the network under test during the cyberattack, the system information comprising information about the sequence of events and response of affected devices during the cyberattack; and, 'an attack implementation engine comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to [ 'cyber data, sensor data, enrichment data, third party data, cyber physical graph data, and analytic workflow data; and', 'receive a plurality of input data, the plurality of input data comprising at least one of, 'combine the system information with the plurality of received input data to ...

COMPRESSING TIME STAMP COLUMNS

Disclosed is a system and method for improving database memory consumption and performance using compression of time stamp columns. A number of time stamps of a time series is received. The time stamps have a start time, and are separated by an equal increment of time that defines an interval. The start time and interval are stored in a dictionary of a column store of a database. An index is generated in the column store of the database, the index having a number of index vectors. Using the index vectors, each time stamp of the number of time stamps can be calculated from the start time stored in the dictionary and the position in the time series based on the interval stored in the dictionary. 1. A computer-implemented method comprising:receiving a plurality of time stamps of a time series for operations executed on a database of a data platformdetermining that the plurality of time stamps includes at least one gap separating a first subseries and a second subseries, the first subseries having a first start time and a first plurality of successive time stamps separated by an equal time interval, the second subseries having a second start time and a second plurality successive time stamps separated by the equal time interval, and the gap separating the first subseries and the second subseries being different than the equal time interval;storing, by one or more processors of the data platform, the first start time, the second start time and the equal time interval in a dictionary of a column store of the database;generating, by the one or more processors and in response to the storing, an index vector comprising indices corresponding to the first plurality of successive timestamps and the second subseries of successive time stamps; andexecuting, by the one or more processors, the operations on the time series, the executing based at least in part on the equal time interval and the index vector.2. The computer implemented method in accordance with claim 1 , further ...

Linguistic based determination of text location origin

A method and system for determining a location of origin and a time period in which a document was written is disclosed. A text is received and a set of linguistic characteristics for the text are identified. A set of possible locations and time periods for the text are determined based on the set of linguistic characteristics. A set of reference documents are used to determine a proximity rating for the text based upon a determination of how close the text is to the reference documents. The potential locations and time periods are ranked and returned for presentation.

DATA STRUCTURES FOR STORING AND MANIPULATING LONGITUDINAL DATA AND CORRESPONDING NOVEL COMPUTER ENGINES AND METHODS OF USE THEREOF

In some embodiments, the present disclosure provides for an exemplary computer-implemented system that may include a longitudinal data engine, including: a processor and specialized index generation software to generate: an index data structure for a respective event type associated with each respective subject or object; where each respective index data structure is a respective event type-specific data schema, defining how to store events of a particular event type to form longitudinal data of each respective subject or object; an ontology data structure that is configured to describe one or more properties of a respective event of a respective subject or object; and longitudinal data extraction software to extract a respective longitudinal data for a plurality of index data structures and a plurality of ontology data structures associated with a plurality of subjects or objects. 1 at least one processor;', i) at least one index data structure for a respective event type associated with each respective subject or object;', 'ii) at least one ontology data structure that is configured to describe one or more properties of a respective event of a respective subject or object; and, 'wherein, when executing the specialized index generation software, the at least one processor at least generates, 'specialized index generation software;'}, 'wherein, when executing the longitudinal data extraction software, the at least one processor extract a respective longitudinal data for a plurality of index data structures and a plurality of ontology data structures associated with a plurality of subjects or objects.', 'longitudinal data extraction software;'}], 'at least one longitudinal data engine, comprising. A system comprising: This application is a continuation of U.S. patent application Ser. No. 16/454,639, filed Jun. 27, 2019, which claims benefit of U.S. provisional patent application Ser. No. 62/690,647, filed Jun. 27, 2018, which are herein incorporated by reference for ...

System and Method for Providing Information to a Recipient of a Physical Mail Object

A system and method is provided for transmitting information over a wide area network, such as the Internet, in response to receiving at least a portion of mail data. In one embodiment of the present invention, information is stored in a memory. Mail data is then affixed to a mail object. The mail object is then manually delivered to a recipient. The mail data is then provided to a reception device. The reception device then uses the mail data to retrieve the information from a mail device in communication with the memory. In a preferred embodiment, the mail data includes data corresponding to the recipient of the mail object, and the information includes data that identifies the recipient of the mail object and data that corresponds to a content of the mail object.

DISPLAYING NETWORK SECURITY EVENTS AND INVESTIGATION ACTIVITIES ACROSS INVESTIGATION TIMELINES

Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines. 120-. (canceled)21. A computer-implemented method , comprising:adding, to a timeline view for a network security investigation, one or more events that reflect activity in an information technology environment, wherein each event of the one or more events is positioned in the timeline view according to a timestamp associated with the event;adding, to the timeline view, one or more workflow events reflecting investigative activity performed in association with the network security investigation, wherein each investigative event is positioned in the timeline view according to a timestamp associated with the investigative event; andcausing display of the timeline view, wherein each event of the one or more events and each workflow event of the one or more workflow events is represented in the timeline view by a respective graphical indicator.22. The computer-implemented method of claim 21 , wherein an event of the one or more events is associated with a security incident involving one or more computing devices of the information technology environment.23. The ...

File lifetime tracking for cloud-based object stores

Tracking changes to a document by defining a document record having a unique document record and comprising an index and a file name of the document, and defining a backup record for the document in a series of backups, which includes a timestamp for each backup, and a bitmask for the document. The bitmask has a single bit position for each document in the container which is set to a first binary value to indicate that the corresponding document is unchanged and a second binary value to indicate whether the document is changed or deleted. A primary query is received and resolved for the document by analyzing the document record to find the file name. A secondary query using the document record ID is resolved to find all tracked versions of the document, and the results are returned to the user in the form of a version history list.

EFFECTIVE CORRELATION OF MULTIPLE TIME-SERIES RESULT SETS

The technology disclosed relates to a method for storing and time-correlating real-time and queryable test results of a test of a device under test (DUT). The method includes initiating the test applied to the DUT to collect real-time data from a multitude of data streams for multiple aspects of the DUT, the collected data including counters and fact-type values, the collected data having imperfectly synchronized time bases and the collected data being collected from different sources asynchronously at different times, specifying a recording time interval for recording the data collected among multiple databases, recording data according to the specified recording time interval, such that each piece of the recorded data is associated with a particular time interval, and at a conclusion of the test, correlating the recorded data with the test configuration data about a test state in the respective time intervals. 1. A method of efficiently monitoring performance counters of a device under test (DUT) during a high data volume test having data event volumes that cannot be recorded at an event level , the method including:specifying a time interval for recording counters on data planes and control planes;using the time interval during a test of the DUT to control persisting numerous counters on a multitude of data streams and to create numerous time series data of the counters, allowing recording of counters from different sources asynchronously at different times;at a conclusion of the test, correlating the numerous time series data from the recorded counters with test configuration data about a test state in the time intervals; andcorrelating data from external sources that also have imperfectly synchronized time bases.2. The method of claim 1 , wherein the asynchronously recorded counters are correlated according to the specified time interval claim 1 , such that counters having different time stamps are correlated to a same interval.3. The method of claim 2 , ...

MANAGING DATABASE OFFSETS WITH TIME SERIES

Systems and methods of improving the functioning of a streaming platform system by managing database change stream offsets using a time series database are disclosed. In some example embodiments, a computer system retrieves an offset value from a plurality of offset values stored in a time series database, with the plurality of offset values being indexed in the time series database in time order, and the retrieved offset value being retrieved using a time parameter, and then the computer system transmits a data request to a stream-processing platform, with the data request comprising the retrieved offset value, and the data request being operable to retrieve a data record stored in association with the retrieved offset value in a storage layer of the stream-processing platform using the offset value. 1. A computer-implemented method comprising:receiving, by one or more hardware processors, a series of data records;for each one of the data records of the series of data records, storing, by the one or more hardware processors, the one of the data records in a storage layer of a stream-processing platform in association with a corresponding one of a plurality of offset values;retrieving, by the one or more hardware processors, an offset value from the plurality of offset values stored in a time series database, the plurality of offset values being indexed in the time series database; andtransmitting, by the one or more hardware processors, a data request to the stream-processing platform, the data request comprising the offset value, and the data request being operable to retrieve a data record stored in association with the offset value in the storage layer of the stream-processing platform using the offset value.2. The computer-implemented method of claim 1 , wherein the data request is further operable to reposition a stream of data published from the stream-processing platform to an application at a position corresponding to the offset value.3. The computer- ...

EXTRACTION RULE GENERATION USING CLUSTERING

Determining a set of extraction rules include clustering event segments into at least a first group of event segments, and determining, using first field data in the first group of event segments, a first set of extraction rules for extracting the first field data from each event segment of the first group of event segments. A determination is made that the first set of extraction rules fails to successfully extract all of the first field data. Responsive to the determination, the event segments are re-clustered into at least a second group of event segments and a third group of event segments until a successful set of extraction rules are identified. The successful set of extraction rules are stored in computer memory. 1. A computer implemented method , comprising:clustering a plurality of event segments into at least a first group of event segments, wherein each event segment of the plurality of event segments corresponds to an individual event in machine data;determining, using first field data in the first group of event segments, a first set of extraction rules for extracting the first field data in a first plurality of fields from each event segment of the first group of event segments;making a determination that the first set of extraction rules fail to successfully extract all of the first field data in the first plurality of fields;{'claim-text': {'claim-text': ['examining, for the second group of event segments, location, and content of second field data in the second group of event segments to determine a second set of extraction rules that extracts the second field data from a second plurality of fields in the second group, and', 'examining, for the third group of event segments, location, and content of third field data in the third group of event segments to determine a third set of extraction rules that extracts the third field data from a fourth plurality of fields in the third group; and'], '#text': 'wherein identifying the successful set of ...

EXPLANATION FOR TIME SERIES FORECASTING MODELS

A method, system, and computer program product for explaining predictions made by black box time series models. The method may include identifying a black box time series model. The method may also include predicting one or more time instances using the black box time series model. The method may also include selecting a predicted time instance from the predicted data. The method may also include receiving training data for the black box time series model. The method may also include generating a set of white box time series models similar to the black box time series model. The method may also include selecting a preferred white box time series model. The method may also include analyzing behavior of the preferred white box time series model. The method may also include generating an explanation illustrating why the black box time series model forecasted the predicted time instance. 1. A computer-implemented method comprising:identifying a black box time series model;predicting one or more time instances using the black box time series model, resulting in predicted data;selecting a predicted time instance from the predicted data;receiving training data for the black box time series model;generating a set of white box time series models similar to the black box time series model;selecting a preferred white box time series model from the set of white box time series models based on a difference between each white box time series model and the black box time series model;analyzing behavior of the preferred white box time series model; andgenerating, based on the analyzing and the training data, an explanation illustrating why the black box time series model forecasted the predicted time instance.2. The method of claim 1 , wherein generating the set of white box time series models comprises:generating a set of model parameters for each of a plurality of types of white box time series models, resulting in a plurality of initial white box time series models;training each ...

Method and system for caching a generated query plan for time series data

In a method for caching a generated query plan for time series data, a query plan for time series data is generated based on a query comprising an expression, the query plan including a path of execution for resolving the query. The path of execution of the query plan to resolve the query is executed. A result of the path of execution is returned as a response to the query. The query plan is cached for retrieval and execution responsive to receiving another query that matches the query, such that the query plan can be used to resolve the another query.

System, method of real-time processing under resource constraint at edge

Example implementations described herein are directed to systems and methods for managing a relationship between real-time analysis processes and applications, where each of the applications are configured to utilize output from one or more of the corresponding real-time analysis processes. In an example implementation, resource adjustment is applied to the real-time analysis process based on a determined priority.