Hewlett-packard Development Company, L.P.

Box Limited

Hewlett Packard Enterprise Development LP

Kave Eshghi

Mark David Lillibridge

George H Forman

Vinay K Deolalikar

Mehran Kafai

Victor De Vansa Vikramaratne

Evan Randy Kirshenbaum

Henri Jacques Suermondt

Pankaj Mehra

Samuel A Fineberg

Peter Thomas Camble

Prakash D Reddy

Shyam Sundar Rajaram

Gregory Keith Trezise

Hongwei Shang

Omar Aguilar Macedo

Ira Cohen

Jun Li

April Slayden Mitchell

David Vengerov

Jerremy Holland

Kei Yuasa

Mark Robert Watkins

Svend Frolund

Hsiu-Khuern Tang

Riddhiman Ghosh

David Malcolm Falkinder

John M Green

Kevin Jones

Pankaj K Garg

Thomas Rathbone

Stephane Chiocchetti

Klaus Wurster

Deepavali Mahendra Bhagwat

Anupriya Ramraj

Thomas Gschwind

Henri Jacques Suemondt

Omar Aguilar

Graham Perry

Hsiu Khuern Tang

Dennis Morgan

Steve Smead

Charlie Dagli

Mark Lillibridge

Mark D Lillibridge

Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Detecting anomalous downloads

Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Detection of personally identifiable information

Disclosed is an improved systems, methods, and computer program products that use a cluster-based probability model to perform anomaly detection, where the clusters are based upon entities and interactions that exist in content management platforms.

Predicting user-file interactions

Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Prioritizing operations over content objects of a content management system

Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates associated with content objects taken from the plurality of content objects. When a document template is identified, template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Form and template detection

An example method is provided in according with one implementation of the present disclosure. The method comprises generating, via a processor, a set of hashes for each of a plurality of objects. The method also comprises computing, via the processor, a high-dimensional sparse vector for each object, where the vector represents the set of hashes for each object. The method further comprises computing, via the processor, a combined high-dimensional sparse vector from the high-dimensional sparse vectors for all objects and computing a hash suppression threshold. The method also comprises determining, via the processor, a group of hashes to be suppressed by using the hash suppression threshold, and suppressing, via the processor, the group of selected hashes when performing an action.

Hash suppression

Examples disclosed herein involve data stream analytics. In examples herein, a data stream may be analyzed by computing a set of hashes of a real-valued vector, the real-valued vector corresponding to a sample data object of a data stream; generating a list of data objects from a database corresponding to the sample data object based on the set of hashes, the list of data objects ordered based on similarity of the data objects to the sample data object of the data stream; and updating a data structure representative of activity of the sample data object in the data stream based on the list of data objects, the data structure to provide incremental analysis corresponding to the sample data object.

Data stream analytics

Incremental automatic update of ranked neighbor lists based on k-th nearest neighbors is disclosed. One example is a system including an indexing module to retrieve an incoming data stream, and retrieve ranked neighbor lists for received data objects. An evaluator determines similarity measures between the received data objects and their respective k-th nearest neighbors. A threshold determination module determines a statistical distribution based on the determined similarity measures, and a threshold based on the statistical distribution. The evaluator determines additional similarity measures between a new data object in the data stream and the received data objects. A neighbor update module automatically selects a sub-plurality of the received data objects by comparing the additional similarity measures to the threshold, and determines, for each selected data object, if the respective retrieved neighbor list is to be incrementally updated based on neighborhood comparisons for the new data object and the selected data object.

Incremental automatic update of ranked neighbor lists based on k-th nearest neighbors

A system may include an access engine to access an input vector as well as a projection matrix. The projection matrix may include a number of rows equal to a number of hash values to generate from the input vector multiplied by the square root of an inverted sparsity parameter specifying a ratio of the hash universe size from which the hash values are generated to the number of hash values to generate. The projection matrix may include a number of columns equal to the dimensionality of the input vector. The system may also include a hash computation engine to determine a projection vector from the projection matrix and the input vector, split the projection vector into a number of sub-vectors equal to the number of hash values to generate, and generate a hash value from each of the sub-vectors.

Hash value generation through projection vector split

A method includes receiving information about a plurality of data chunks and determining if one or more of a plurality of back-end nodes already stores more than a threshold amount of the plurality of data chunks where one of the plurality of back-end nodes is designated as a sticky node. The method further includes, responsive to determining that none of the plurality of back-end nodes already stores more than a threshold amount of the plurality of data chunks, deduplicating the plurality of data chunks against the back-end node designated as the sticky node. Finally, the method includes, responsive to an amount of data being processed, designating a different back-end node as the sticky node.

Systems and methods for data chunk deduplication

Growing community of inventors

Los Altos, CA, United States of America

Kave Eshghi