Morgan Stanley Services Group Inc.

Luke A Higgins

Robert R Bruno

A method for caching and deduplicating a plurality of received segments of data is disclosed. The method comprises identifying a value of a first data field in each segment acting as a unique source identifier; and identifying a value of a second data field in each segment, the second data field being densely populated by values in the plurality of segments. The value of the second data field is partitioned into a first partition comprising more significant bits and a second partition comprising less significant bits. A key is generated based on values of the first data field and the first partition. A database entry associates the first key with a bitmap, the bitmap having a length based on the number of possible values a bitmap of equal length to the second partition could validly take. Single bits of the bitmap are set corresponding to received segments, to enable deduplication.

High-compression, high-volume deduplication cache

Computer-implemented methods and systems are disclosed for receiving and indexing a plurality of files for later querying, for dynamically generating scripts to be executed during a query of a data store, and for horizontally distributing a query and aggregating results of the distributed query.

Distributed query execution and aggregation

Dynamic script generation for distributed query execution and aggregation

Data indexing for distributed query execution and aggregation

A method of detecting and responding to anomalous activity within a system involves generating a two-dimensional graphical image of a first dimension and a second dimension, and wherein the first dimension corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the second dimension, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and when a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.

Enterprise-level security method and system

A method of detecting and responding to anomalous activity within a system involves, based upon pivot feature information, for a snapshot interval, generating a frequency structure interrelating a pivot feature, a binning feature and counts, using the frequency structure, generating a graphical image of a pre-specified width and height in pixels, and wherein the pre-specified width corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the pre-specified height, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and if a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.

Growing community of inventors

Silver Spring, MD, United States of America

Luke A Higgins