Box Limited

Victor De Vansa Vikramaratne

Kave Eshghi

Sesh Jalagam

David Vengerov

Matthew DeLand

Justin Tim Peng

Florian Jourda

Pierre-Alexandre Masse

Jeremy Glassenberg

Bryan Huh

Hieu Minh Nguyen

Winston Yih-Jiun Huang

Josh Kline

Minh-Tue Vo Thanh

Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Detecting anomalous downloads

Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Detection of personally identifiable information

System and methods for summarizing collaboration activity events into a plurality of pages that are then scored with respect to user-specific relevance that is based on a set of comprehensibility characteristic parameters. The collaboration activity events are summarized into groups of activities based on certain common attributes that are deemed to have quantitatively measurable relevance to the user. The groups of activities are assembled into a plurality of personalized candidate pages. The candidate summary pages are then scored using a function that includes parameters that serve to quantify how interesting or readable the particular user would find the particular candidate summary page. One or more of the higher scoring candidate summary pages are selected for presentation to the user.

Collaboration activity summaries

Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Prioritizing operations over content objects of a content management system

Methods, systems and computer program products for recommendation systems. Embodiments commence by gathering a set of pathnames that refer to content objects of a collaboration system. A tokenizer converts at least some of the pathnames into vectors. The vectors comprise hierarchical path components such as folder names or file names, which vectors are labeled with an indication as to whether or not the folder or file referred to in a particular vector had been clicked on by one or more users. Some portion of the labeled vectors are used to train a predictive model. Another portion of the vectors are used to validate the predictive model. When the model exhibits sufficient precision and recall, the predictive model is then used to predict the probability that a particular user would have an interest in a particular folder or file. The folder name or file name is presented as a collaboration recommendation.

Determining collaboration recommendations from file path information

Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates associated with content objects taken from the plurality of content objects. When a document template is identified, template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Form and template detection

Systems and methods for forming collaboration recommendations. Techniques for forming event-based recommendations use time-decayed event values. A shared content management system supports a plurality of users that generate events by interacting with content objects of the shared content management system. Events over the content objects are captured as event objects. Method steps are invoked upon receiving event objects that describes user-to-object interaction events that arise from interactions by users over content objects. Different types of interactions carry different importance values. The importance values can be applied as weights when scoring user-to-object interaction activities. The importance can decay over time. As time progresses and as the importance of older interactions decay, score components of a user-to-object interaction can be updated based at least in part on a time decay function. The system emits collaboration recommendations based on the decayed user-to-user collaboration scores.

Forming event-based recommendations

Systems and methods for presenting relevant collaboration activity to a collaboration system user. A method embodiment commences upon identifying user events that correspond to interactions between a plurality of users and collaboration objects. The interactions that had been performed and the collaboration objects are both associated with permissions attributes. The interactions are recorded as event records that include aspects of the permissions attributes. When a user opens a user interface, a set of event records is selected based at least in part on the permissions attributes with respect to the user. The selected set of event records are then used to generate a set of user-specific feed entries corresponding to particular individual ones of the set of event records. Characteristics of the individual event records and/or aggregations of event records are used to prepare user-specific feed entries that are presented in a user interface of a user device.

Presenting collaboration activities

Systems and methods for filtering collaboration activity to present in an activity feed. A cloud-based collaboration system is configured to identify collaboration interactions that users have taken over collaboration objects. Some of the collaboration objects or interactions are subject to access permissions as well as policy-based access rules. When a subject user interacts with a user interface, system components select a first set of user interaction events that in some way pertain to the subject user. A first filtering pass applies a first filter to determine object access permissions. After reducing the first set to a smaller second set, then a second filter corresponding to policy-based access rules is applied to the second set to form a still smaller third set of user interaction events. Characteristics of user interaction events in the third set are used to generate user-specific activity feed entries that are presented in a user interface.

Filtering collaboration activity

Systems and methods for on-demand generation of customizable collaboration network graphs. A method embodiment operates in a collaboration system that comprises content objects that are operated on by a plurality of users. Interactions with the content objects are detected and streamed into a customizable graph platform. Customization is accomplished by configuring the graph platform to gather particular events and corresponding data that pertain to the entity interaction events and/or to the users that raised the events. The graph platform organizes the data into data structures that codify a collaboration network graph, where the nodes of the collaboration network graph refer to customizable ones of the content objects and where the edges of the collaboration network graph refer to customizable parameters or values that characterize relationships between connected nodes of the collaboration network graph. Multiple behavior overlays can be applied to cause the customizable graph platform to process particular events differently.

On-demand collaboration user interfaces

Systems for identifying misappropriation of forensically-watermarked video content. A method embodiment for forensic watermarking commences upon identifying video sources. A video is partitioned into frame ranges or 'chunks'. Different watermarking schemes are applied to the chunks to generate different watermarked versions of each chunk. Upon receiving a request from a user to view a requested video, a digital signature is generated from a set of request attributes such as a user ID or session ID. A video stream is assembled wherein the stream chunk order comprises a particular recoverable sequence of the differing watermarked chunks, where the sequence is based on bit sequences of the digital signature. A misappropriated video or portion thereof can be analyzed to identify the particular recoverable sequence or portion thereof. Based on the recoverable sequence, the digital signature can be recovered, and based on the digital signature, the source of the misappropriation can be determined.

Forensic watermarking of shared video content

Systems for curating and presenting relevant collaboration activity to newly-added users in a cloud-based content management platform. A method embodiment commences by observing and recording user events that correspond to interactions between any number of users and any number of content objects. When a new person who does not have an event history is added, his/her user profile is updated to indicate he/she is a new user, and a start-up proxy user is identified. The proxy user refers to either a real user that is in some way similar to the newly-added user, or the proxy user is a virtual user as amalgamated from previously recorded user history records. The events in the history records of the proxy user are associated with the newly-added user. When the newly-added user interacts with a user interface of the cloud-based content management platform, feed entries are generated and presented to the newly-added user.

Growing community of inventors

Sunnyvale, CA, United States of America

Victor De Vansa Vikramaratne