Microsoft Technology Licensing, LLC

Jonathan Karl Larson

Darren Keith Edge

Christopher M White

Nathan Roy Evans

Chris M White

Anna Swanson Bertiger

Chris Trevino

Alexander Donald Modell

Disclosed is a scalable, graph-based approach to detecting anomalous accesses to resources in a computer network. Access events are represented as edges between resource nodes and accessing nodes (e.g., corresponding to users) in a bipartite graph, from which vector representations of the nodes that reflect the connections can be computed by graph embedding. For an access event of interest, an anomaly score may be computed based on dissimilarities, in terms of their embedding distances, between the associated accessing node and other accessing nodes that have accessed the same resource, and/or between the associated resource node and other resource nodes that have been accessed by the same accessing node.

Network access anomaly detection via graph embedding

Systems and methods for modeling higher-level metrics from graph data derived from already-collected but not yet connected data are disclosed. A method includes extracting a first set of actor-related data, a second set of object-related data, and a third set of temporal data from the set of the already-collected but not yet connected data representative of a unit-level contribution to the target activity. The method further includes generating graph data for a graph using the set of the already-collected but not yet connected data, where each of the plurality of nodes of the graph corresponds to the actor or the object, and where an attribute associated with each of the plurality of edges of the graph corresponds to a measurement associated with the target activity. The method further includes modeling a relationship between graph attributes associated with the graph data and a higher-level metric associated with the target activity.

Modeling higher-level metrics from graph data derived from already-collected but not yet connected data

Systems and methods for graph embedding already-collected but not yet connected data are disclosed. A method includes extracting a first set of actor-related data, a second set of object-related data, and a third set of temporal data from a set of the already-collected but not yet connected data representative of a unit-level contribution to the target activity. The method further includes generating graph data for at least one graph having a plurality of nodes and a plurality of edges using the set of the already-collected but not yet connected data, where each of the plurality of nodes corresponds to the actor or the object, and where an attribute associated with each of the plurality of edges corresponds to a measurement associated with the target activity during a temporal dimension of interest. The method further includes converting the graph data into metric space data using a graph embedding process.

Graph embedding already-collected but not yet connected data

Systems and methods for managing content provenance are provided. A network system accesses a plurality of documents. The plurality of documents is then hashed to identify one or more content features within each of the documents. In one embodiment, the hash is a MinHash. The network system compares the content features of each of the plurality of documents to determine a similarity score between each of the plurality of documents. In one embodiment, the similarly score is a Jaccard score. The network system then clusters the plurality of documents into one or more clusters based on the similarity score of each of the plurality of documents. In one embodiment, the clustering is performed using DBSCAN. DBSCAN can be iteratively performed with decreasing epsilon values to derive clusters of related but relatively dissimilar documents. The clustering information associated with the clusters are stored for use during runtime.

Revealing content reuse using coarse analysis

A set of unstructured data is analyzed to infer structural elements from the unstructured data, and quantized data quality levels, indicative of data quality in the structural elements, are assigned to the structural elements. A set of structured data is generated to include the structural elements inferred from the unstructured data and associations between respective ones of the structural elements in the set of structured data and the corresponding quantized quality levels assigned to the structural elements. The set of structured data, including the associations between respective ones of the structural elements and the corresponding quantized quality levels assigned to the structural elements, is provided to a user interface application to enable the user interface application to visually display varying data qualities in the set of structured data.

Quality-aware data interfaces

The disclosed implementations can provide a state-based history based on capture, representation, and navigation of a user's exploratory interactions with a user interface of an application. States may be represented in a history board, and one or more states may form a path. As a user explores an application's user interface, the user may branch from a given path and/or return to a prior state. Displaying a visual indication of states and a relationship of those states within a given path to states in other paths, provides a much improved user experience.

History aware interfaces

Systems and methods for managing content provenance are provided. A network system accesses a document of a plurality of documents to be analyzed. The network system extracts text fragments from the document including a first fragment and a second fragment. A determination is made whether each of the text fragments match an entry in a hash table. Based on a first fragment not matching any entries in the hash table, the network system creates a new entry in the hash table, whereby the first fragment is used to generate a key in the hash table. Based on a second fragment matching an entry of the hash table, the network system associates the document with a key of the matching entry in the hash table, whereby the associating comprising updating the hash table with an identifier of the document.

Growing community of inventors

Bremerton, WA, United States of America

Jonathan Karl Larson