Microsoft Technology Licensing, LLC

Uri Barash

Yair Helman

Efim Hudis

Arie Friedman

Shai Rubin

Yosef Dinerstein

Joseph Malka

Marc Eliot Davis

Nir Nice

Ying Li

Haim Somech

Shira Weinberg

Hadas Bitran

Colleen Elizabeth Hamilton

Scott Vernon Fynn

Oded Nahir

Robert J Howard, Iii

William Henry Gates, Iii

Alexander G Gounares

Melissa Wood Dunn

Michael Joseph Toutonghi

Cynthia Dwork

Michael Goldbach

Teresa Mah

Boaz Feldbaum

Darrell J Cannon

Sefy Ophir

Vu Anh Ha

Eric Picard

Dov Harel

Amit Shaked

Eric Don Van Valkenburg

Friedman Arie

An online service may maintain or create data for a user, and a user may be allowed to exert control over how the data are used. In one example, there may be several categories of data, and the user may be able to specify who may use the data, and the purpose for which the data may be used. Additionally, a user may be able to see how many of his 'friends' (or other contacts) have extended trust to a particular entity, which may aid the user in making a decision about whether to extend trust to that entity. User interfaces may be provided to allow users to specify how their data are to be used.

Data policies for online services

One or more techniques and/or systems are provided for constructing a complementary calendar and/or a shadow calendar. A user may maintain a primary calendar within which the user may schedule user specified tasks and/or meetings, but may inadvertently omit other entries. Accordingly, a complementary calendar may be constructed based upon inferences derived from user signal data (e.g., information used to identify/infer activities of the user, such as social network profile information, messages, temporal information, locational information, documents, etc.). The complementary calendar may be automatically populated with entries corresponding to inferences derived from user signals and/or real-time conditions (e.g., weather, store hours, traffic conditions, etc.). The primary calendar and the complementary calendar may be merged to create a shadow calendar. The complementary calendar and/or the shadow calendar may be displayed to the user and/or may be used to provide dynamic notifications and/or suggestions to the user (e.g. regarding conflicting entries/obligations, etc.).

Complementary and shadow calendars

Systems, methods, and computer program products are described for controlling malicious activity detection with respect to information technology assets based on behavioral models associated with the respective information technology assets. Protection rules and corresponding sensitivities associated with the behavioral models are applied by protection services to detect malicious activity with respect to the information technology assets.

Controlling malicious activity detection using behavioral models

A client-based ad agent dynamically determines whether an advertisement campaign should bid on an impression for an end user and/or sets the bid price of the advertisement campaign for the impression. When an opportunity for an impression on a web page is identified, the ad agent accesses user data associated with an end user. The ad agent analyzes the user data to identify the relevance and/or value of serving an impression to the end user to the advertisement campaign. Based on the analysis, the ad agent controls whether the advertisement campaign bids on the impression for the end user and/or sets the bid price of the advertisement campaign for the impression.

User centric real-time advertisement bidding

An enterprise-wide sharing arrangement uses a semantic abstraction, called a security assessment, to share security-related information between different security products, called endpoints. A security assessment is defined as a tentative assignment by an endpoint of broader contextual meaning to information that is collected about an object of interest. Its tentative nature is reflected in two of its components: a fidelity field used to express the level of confidence in the assessment, and a time-to-live field for an estimated time period for which the assessment is valid. Endpoints may publish security assessments onto a security assessment channel, as well as subscribe to a subset of security assessments published by other endpoints. A specialized endpoint is coupled to the channel that performs as a centralized audit point by subscribing to all security assessments, logging the security assessments, and also logging the local actions taken by endpoints in response to security threats.

Enterprise security assessment sharing

An enterprise-wide sharing arrangement uses a semantic abstraction, called a security assessment, to share security-related information between security products, called endpoints. A security assessment is defined as a tentative assignment by an endpoint of broader contextual meaning to information that is collected about an object of interest. Endpoints utilize an architecture that comprises a common assessment sharing agent and a common assessment generating agent. The common assessment sharing agent is arranged for subscribing to security assessments, publishing security assessments onto a channel, maintaining an awareness of configuration changes on the channel (e.g., when a new endpoint is added or removed), and implementing security features like authorization, authentication and encryption. A common assessment generating engine handles endpoint behavior associated with a security assessment including assessment generation, cancellation, tracking, and rolling-back actions based on assessments that have expired. The common assessment generating engine generates and transmits messages that indicate which local actions are taken.

Endpoint enabled for enterprise security assessment sharing

Endpoints in an enterprise security environment are configured to adaptively switch from their normal data collection mode to a long-term, detailed data collection mode where advanced analyses are applied to the collected detailed data. Such adaptive data collection and analysis is triggered upon the receipt of a security assessment of a particular type, where a security assessment is defined as a tentative assignment by an endpoint of broader contextual meaning to information (i.e., data in some context) that is collected about an object of interest. A specialized endpoint is coupled to the security assessment channel and performs as a centralized audit point by subscribing to all security assessments, logging the security assessments, and also logging the local actions taken by endpoints in response to detected security incidents in the environment. The specialized endpoint is arranged to perform various analyses and processes on historical security assessments.

Adaptive data collection for root-cause analysis and intrusion detection

Methods, systems, and computer-readable media for facilitating personalization of web content is provided, while protecting the privacy of the user data utilized to personalize the user's experience. A privacy vault may collect user data including user activity data, demographic data, and user interests submitted by a user. In one embodiment, the privacy vault operates on a user client device. The privacy vault sends the user data to a community vault that collects user data from multiple users. The community vault generates segment rules that whether a user belongs to a user segment, which expresses a user's interest. The segment rules are then communicated back to the privacy vault, which assigns one or more user segments to the user based on the user data available to the privacy vault and the segment rules. The privacy vault may communicate user segments to one or more content providers that supply personalized content that is selected based on the user segments provided.

Privacy vault for maintaining the privacy of user profiles

A system and method track changes to a document and analyze the changes to the document against a set of predefined queries without re-analyzing the entire document. Hence, after a document has been processed in the system (i.e., had its terms matched against the set of predefined queries), only a small subset of the document needs to be reprocessed and analyzed after changes (i.e., edits) are made. The analysis of the small subset is accomplished by maintaining an incremental-results data set for each document. The incremental-results data set is much smaller than the actual document, only comprising a set of unique words found in a document. After a document is changed, only the words deleted or added to the changed portion are used to update the incremental-results data set.

Incremental filtering in a persistent query system

Growing community of inventors

Tel Mond, Israel

Uri Barash