261 results about "Event (computing)" patented technology

Disclosed are systems and methods that ingest substantial volumes of data from a variety of sources associated with a computing system network to create integrated, intuitive, efficient, and coherent adaptive workspace display interfaces. The ingestion includes event data generated by event source software applications running on end user computing devices as well as call and end user attribute data that is used to determine state, presence, and performance data for the end user computing devices that is formatted for display on the adaptive workspace interfaces and used during performance monitoring and collaboration between system end users. The adaptive workspace interfaces provide functions that facilitate real time collaboration between end users that enhances shared experiences between system end users and customers.

A system and method for reducing data record processing in incident report generation is provided. The method includes: accessing a plurality of event records, each event record generated based on an event in a computing environment; parsing each event record based on a predetermined data field; extracting from each predetermined data field a data value; correlating a group of event records of the plurality of event records based on at least an extracted data value; generating an incident data record based on the extracted data values of the correlated group of event records; generating a prompt based on the incident data record; and generating an incident report by configuring a large language model (LLM) to execute the generated prompt.

Techniques for using machine learning (ML) model(s) to generate a textual summary of a stream of events at least in part by receiving information corresponding to the stream of events corresponding to interactions between a user and application program(s) executing on a computing device, the information comprising, for each of multiple events in the stream of events associated with a process, metadata associated with the event, wherein metadata for a particular event specifies values for attributes of the particular event; processing, using at least one ML model, the metadata associated with the multiple events to generate multiple corresponding textual summaries of the multiple events; generating, using the textual summaries of the multiple events, a textual summary of the process performed by the user through the interactions between the user and the application program(s) executing on the computing device; and outputting the textual summary of the process.

Certain aspects provide techniques and apparatus for executing queries in a computing system using machine learning models. An example method generally includes receiving a plan to satisfy a request in the computing system and event log data associated with execution of the plan. The plan generally specifies a first plurality of function calls at a first level of granularity. Using a plan refinement machine learning model, a refined plan is generated when the event log data indicates that execution of the generated plan results in one or more execution errors and the one or more execution errors are solvable. Generally, the refined plan specifies a second plurality of function calls at a second level of granularity, the second level of granularity being finer than the first level of granularity.

A computer-implemented method, computer program product and computing system for defining a formatting script for use with a Generative AI Model; receiving a plurality of notifications of a security event, wherein each of the plurality of notifications includes a computer-readable language portion that defines one or more specifics of the security event, thus defining a plurality of computer-readable language portions; processing at least a portion of each of the plurality of computer-readable language portions using the Generative AI Model and the formatting script to summarize each of the computer-readable language portions and generate a plurality of event summaries; and′ processing at least a portion of each of the plurality of event summaries using the Generative AI Model and the formatting script to summarize the plurality of event summaries and generate a summarized human-readable report.

A system and method for initiating remediation actions in a computing environment based on similar incident detection is presented. The method includes: generating a first incident record, based on a correlated plurality of event records, each event record indicating an event in a computing environment; generating a first vector based on the first incident record; detecting a similar incident record based on the first vector and a corresponding vector of the similar incident record; detecting a remediation action associated with the similar incident record, the remediation action previously executed in the computing environment; generating an adapted remediation action based on data extracted from the first incident record; and initiating the adapted remediation action in the computing environment.

Examples of the present disclosure describe systems and methods for automating the identification of events in a text file. In examples, a computing system identifies a subset of a text file that comprises an unknown event using a set of rules. Each rule of the set of rules specifying a first pattern of characters is compared to the subset of the first text file. When the set of rules does not identify the unknown event, the subset of the text file is provided to a language model to generate a new rule with a second pattern of characters and an identifier of the new rule. The system then generates an updated set of rules by adding the new rule to the set of rules.

Certain aspects provide techniques and apparatus for executing queries in a computing system using machine learning models. An example method generally includes receiving a plan to satisfy a request in the computing system and event log data associated with execution of the plan. The plan generally specifies a first plurality of actions to be performed by the computing system at a first level of granularity. Using a plan refinement machine learning model, a refined plan is generated when the event log data indicates that execution of the generated plan results in one or more execution errors and the one or more execution errors are solvable. Generally, the refined plan specifies a second plurality of actions to be performed by the computing system at a second level of granularity, the second level of granularity being finer than the first level of granularity.

Techniques for a service provider network to communicatively couple services and / or applications in a serverless computing environment. A pipe component can configure a pipe to integrate two services by transmitting data between services and / or applications using the pipe. The pipe may also be configured to transform how a service processes an event, control timing of event transmissions using the pipe, define an event structure for an event, and / or batch events. Pipes enable an application or service to exchange data with a variety of services provided by the service provider network while controlling what type of data is generated, stored, or transmitted.

A data platform monitors a compute environment by performing multi-stage heuristic analysis of event data representing a plurality of events occurring within the environment. The platform utilizes multiple event analyzers, each configured according to a distinct analysis heuristic, to evaluate different subsets of the event data and generate corresponding output signals. A higher-level event analyzer applies a further heuristic to the multiple output signals to generate a composite alert signal, indicating whether the combination of analyzed events collectively represents a security intrusion or other anomalous condition of sufficient severity to warrant alerting. Based on the composite alert signal, the platform performs an alert-based operation, such as generating a user-facing alert, initiating an automated mitigation, or updating a contextual model of system behavior. By combining the analytical outputs of heterogeneous heuristics, the disclosed architecture enhances the accuracy and contextual relevance of automated intrusion detection within complex computing environments.

Systems and methods for automatically populating documents about special entities are disclosed herein. An example method is performed by one or more processors of a computing system. The example method may include receiving user data, extracting a list of entities associated with the user and a list of events that occurred between the user and the entities, transforming metadata for the events associated with entities of interest into vectorized embeddings, selectively classifying, using a binary classifier model, ones of the entities as special entities and ones of the events as special events for a set of documents, assigning, using a multi-class classifier model, one of a plurality of categories to each special event associated with each special entity, each of the categories mapping to a corresponding section within the set of documents, and populating, for each special entity, the corresponding sections within the set of documents based on the categories.

A method of monitoring a network for linked events includes receiving an indication of an occurrence of a first event in a computing environment, calculating a first estimated rate of occurrence of the first event based on a first cache associated with the first event, and identifying an occurrence of a second event within a threshold amount of time prior to the occurrence of the first event. The method further includes calculating a second estimated rate of occurrence of the second event based on a second cache associated with the second event and determining, based on the first estimated rate of occurrence of the first event and the second estimated rate of occurrence of the second event, whether the occurrence of the first event and the occurrence of the second event have a common cause.

A system and method for ingesting delayed logs for cybersecurity detection is presented. The method includes detecting a resource deployed in a computing environment, the resource configured to generate a local log on a disk of the resource; periodically fetching the local log from the disk, the local log including a plurality of event records written by at least a software application executed on the resource; applying a control on the fetched local log; and detecting a cybersecurity issue on the resource based on a result of applying the control.

Systems and methods include an Information Handling System (IHS) that is adapted to diagnose root causes of issues reported by hardware and / or software of the IHS. Telemetry is monitored that specifies operating status information for hardware components of the IHS. Stress event are detected that are related to the hardware components. One or more stress tests are identified for evaluation of each hardware component that is related to stress event. While monitoring the telemetry, the stress tests are conducted in order to replicate the detected stress event. When the detected stress event is replicated, a root cause hardware component of the IHS is determined based on machine learning evaluation of the telemetry generated during replication of the stress event.

An operations computing system receives event data for one or more events and generates, based on the event data, an incident object for an incident. The incident object includes incident data including a priority level. The operations computing system generates an incident workflow for the incident object. The operations computing system applies, using an application programming interface, a machine learning model to determine an adjusted priority level for the incident object, in which the machine learning model is configured to receive one or more valid natural language prompts related to incident priority level. The operations computing system receives the adjusted priority level for the incident object, and updates the incident object associated with the incident workflow with the adjusted priority level. The operations computing system performs one or more actions included in the incident workflow for the incident object based on the adjusted priority level for the incident workflow.

A targeted event monitoring and alert service may be implemented by a computing system. The system can provide a live dashboard on a graphical user interface for a respective user. The live dashboard can provide (i) real-time, localized contextual information of an event for a location corresponding to the respective user, and (ii) a set of real-time risks to the property of the respective user. The computing system executes an engagement monitor comprising a machine learning computer model to (i) monitor the respective user's interactions with the live dashboard, and (ii) dynamically adapt content flows of the live dashboard based on learned response information corresponding to the respective user's interactions with the targeted event monitoring and alert service.

Provided herein are systems and methods for methods for detecting expected reductions of interactions across sessions. A computing system can identify event data identifying interactions by a user with a first session for digital therapeutic content to address a condition. The computing system can apply the event data to a machine learning (ML) model. The computing system can generate a likelihood of the user interacting with a second session for digital therapeutic content based on applying the event data to the ML model. The computing system can detect an expected reduction in interactions by the user with the second session, responsive to the likelihood of the user not satisfying a threshold. The computing system can provide an output for the user based on detecting the expected reduction in interactions. In this manner, the efficacy of the medication that user is concurrently taking to address the condition may be improved.

A computing system comprising one or more computing devices can access a file comprising documentation that includes a textual description and a source code snippet written to comply with a programming language syntax. The computing system can identify the source code snippet. The computing system can generate an executable based on the source code snippet. The computing system can initiate a test process that accesses the executable, the test process causing the executable to cause an event. The computing system can determine that the event is a valid event or an invalid event.

Embodiments include methods and devices for media application function (AF) exposure functionality. Various aspects may include receiving an access configuration message for a service or application provider, the access configuration message including an indication of one or more event types and parameters, one or more exposure levels, and aggregation rules. Various embodiments may include an AF server subscribing other computing devices to event types and parameters for the service or application based on the exposure level of the other computing device.

The invention provides a load diagnosis and processing method and device, electronic equipment, a medium and a program product, which can be applied to the technical field of cloud computing. The method comprises the following steps: acquiring a performance index sequence of at least one candidate application process, and in response to meeting a high-load triggering condition, determining a target process to be diagnosed and generating an abnormal event identifier; obtaining thread resource occupation information of the target process in response to the abnormal event identifier, determining an abnormal thread based on the thread resource occupation information, and obtaining execution stack information corresponding to the abnormal thread; thread features are extracted based on the thread resource occupation information and the execution stack information, and a root cause classification label is determined based on the thread features; and generating processing suggestion information for the target application process based on the root cause classification label.

Confidence-based event group management, workflow exploitation and anomaly detection, including: detecting an event in a computing system; adding the event to an event group; and calculating a group confidence level for the event group based on an event confidence level for the event and at least one of: one or more attributes of the event or one or more relationships between a source of the event and sources of events in the event group.

The invention discloses a kernel process scheduling associated information monitoring method and device, a medium and a product, which are applied to the field of cloud computing, and the method comprises the following steps: tracking a related function of kernel process scheduling to determine a calling condition of the related function; when the process awakening function or the new process awakening function is called, recording awakened process information according to the called related function; and when the process scheduling switching function is called, respectively generating a scheduling time delay record and a preemption event record according to the process scheduling switching function. By tracking the calling condition of the related function, the key event of kernel process scheduling can be obtained in real time, and the system overhead caused by kernel modification or additional tool deployment is avoided. By recording the waken process information, a foundation is laid for the subsequent calculation of the scheduling time delay. By generating the time delay record and the preemption event, the scheduling time delay of the container process can be directly quantified, the resource preemption relationship between the containers can be positioned, and the event record can be directly used for subsequent interference source positioning and automatic disposal.

The invention discloses an event determination method and device, computer equipment and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: clustering a plurality of obtained texts to obtain a plurality of candidate text clusters; in the multiple candidate text clusters, the candidate text clusters with the number of texts meeting a first number condition are determined as target text clusters, and events associated with the multiple texts in the target text clusters belong to target type events; determining weights of the plurality of texts in the target text cluster based on the interaction information of the plurality of texts in the target text cluster; based on the multiple texts in the target text cluster and the weights of the multiple texts in the target text cluster, an event description text is generated, the semantics of the event description text is the same as the semantics of the multiple texts in the target text cluster, and the event description text is used for describing target type events associated with the multiple texts in the target text cluster. According to the method, computing resources can be saved, and the interpretability of the event determination method can be improved.

A system and method for applying policies across data loss prevention (DLP) systems of a computing environment is presented. The method includes receiving a plurality of events, including a first event from a DLP system, and a second event from a second DLP system, each providing a software service to the computing environment; normalizing the plurality of events into normalized events based on a normalizing schema; configuring a generative artificial intelligence (AI) model to output an event summary based on: a normalized event, a metadata associated with the normalized event, and an enrichment; configuring the generative AI model to output a severity based on: the normalized event, the metadata, the enrichment, and a service level agreement; configuring the generative AI model to output a reason based on the severity and the event summary; and initiating a remediation action based on an output of the generative AI model.

The invention belongs to the technical field of artificial intelligence middleware and cloud computing task arrangement, and discloses an agent arrangement system and method based on a graph structure and a response type programming technology. Comprising a graph structure construction and compiling unit, a node operation unit, a routing and confluence control unit, a graph signal and event management unit and a response type operation and execution regulation and control unit, and an execution path has integrity and verifiability before deployment through analysis of a service graph, topology verification and confluence supplementation of parallel branches; the nodes trigger execution according to graph signals and write products into a result data area or a shared data area, and the routing and confluence control determines a convergence mode of signal transmission and parallel branches according to a connection predicate and a confluence rule. The event management unit generates a structured event for a node operation state, and the operation regulation and control unit schedules through a leading edge queue and in-transit counting and feeds back a back pressure signal to the upstream when a load changes, so that stable propulsion of a graph structure is realized.

Embodiments are directed to security analysis agents. Events associated with a computing environment may be provided. Prompt fragments may be determined based on the events. A prompt may be generated for a large language model (LLM) based on a prompt template and the prompt fragments such that the prompt fragments may be included in the prompt and provided to the LLM. Actions for evaluating the events may be determined based on the LLM response. These actions may be executed to evaluate the events. Portions of the response that correspond to the prompt fragments may be determined. A performance score may be determined for each prompt fragment based on its corresponding portion of the response such that the prompt may be modified to exclude a portion of the prompt fragments that have a performance score less than a threshold value.

Embodiments of the disclosure provide for detection and mitigation of anomalous cyber activity in a computing environment. Some embodiments monitor system data associated with an operation occurring in a computing environment. Some embodiments predict a predictive output using a machine learning (ML) model and based on the system data. In some embodiments, the predictive output is indicative of whether the system data is associated with one of a plurality of anomalous event definitions. In some embodiments, the ML model generates the predictive output based on whether the system data indicates an aspect of an anomalous event as defined by a plurality of intrusion detection models. In some embodiments, the ML model is trained on historical classifications of data processed using the plurality of intrusion models. Some embodiments in response to the predictive output, perform a response action that reduces vulnerability of the computing environment to anomalous activity in the operation.

A system and method for cross-entity correlation of software containers in a cloud computing environment is presented. The method includes detecting in a log an event record related to a software container platform utilized in a cloud computing environment; extracting from the event record a software container identifier and a principal identifier; cross-referencing the software container identifier with a unique software container identifier list based at least on the principal identifier; associating in a security database the event record and the unique software container identifier; and applying a control based on the event record and the unique software container identifier.

The invention provides a large model reasoning task processing system and method and a medium, an event encapsulation module encapsulates reasoning task parameters into structured events through a preset event encapsulation rule and stores the structured events into a distributed message queue, asynchronous decoupling of task requests and model instance processing is achieved, and the efficiency of reasoning task processing is improved. And the task concurrent response efficiency is improved. Secondly, the event processing module dynamically allocates matched model instances according to reasoning events in the message queue, resources are called in real time based on event loads, the allocation mode of whole card monopolization or fixed quota of a static resource pool is changed, and the problems of resource fragmentation and scrambling are avoided. And finally, the resource prediction module analyzes historical resource consumption data, event resource demand characteristics and resource consumption data of the model instance, pre-judges the resource demand of the next stage in advance and formulates a resource allocation strategy, so that the computing resources can be elastically expanded and contracted according to the actual demand, and the utilization rate of the computing resources is effectively improved.

A computer-implemented method for a digital security system receives unlabeled event data associated with a computing environment, clusters via an unsupervised machine learning model the unlabeled event data into clusters of unlabeled event data where unlabeled event data in one cluster are more similar to each other than to unlabeled event data in other clusters, selects a respective subset of unlabeled event data for each cluster of unlabeled event data, translates via a large language model artificial neural network each unlabeled event datum in each respective subset of unlabeled event data into a description for the unlabeled event datum, and applies a label via a labeling algorithm to at least one unlabeled event datum in a respective cluster responsive to and representative of the respective description for the unlabeled event datum in the respective subset, thereby transforming the at least one unlabeled event datum to a labeled event datum.