A system and process extract software application performance data from disparate ownership sources and make the various source data compatible for comparison data. A software application's performance in the marketplace may be compared to other applications in a same group with comparable data information. A M2M (mobile-to-mobile) technology is an interface layer connection to a backend server that builds machine learning pipelines and may use artificial intelligence to turn massive datasets into identifiable patterns, algorithms and statistical models. This layer is capable of cleaning, aggregating, and organizing data from disparate sources to produce meaningful conclusions to complex problems to inform strategic business decisions.

Systems and methods for presenting relevant collaboration activity to a collaboration system user. A method embodiment commences upon identifying user events that correspond to interactions between a plurality of users and collaboration objects. The interactions that had been performed and the collaboration objects are both associated with permissions attributes. The interactions are recorded as event records that include aspects of the permissions attributes. When a user opens a user interface, a set of event records is selected based at least in part on the permissions attributes with respect to the user. The selected set of event records are then used to generate a set of user-specific feed entries corresponding to particular individual ones of the set of event records. Characteristics of the individual event records and/or aggregations of event records are used to prepare user-specific feed entries that are presented in a user interface of a user device.

Techniques for in-band modification of event notification preferences for server events are provided. One method comprises obtaining an event notification; providing the event notification to a target device based on rule-based preferences of a user associated with the target device;

obtaining a reply to the event notification from the target device, wherein the reply comprises event preferences of the user; and updating the rule-based preferences of the user based on the event preferences of the user. The updating of the rule-based preferences of the user may comprise creating, modifying and/or canceling at least one event preference rule of the user. A plurality of the event preference rules matching the event notification may be resolved in an order determined by one or more event preference rule resolution criteria.

Methods, apparatuses, systems, and computer-readable media for identifying and executing one or more interactive condition evaluation tests and collecting and analyzing user behavior data to generate an output are provided. In some examples, user information may be received and one or more interactive condition evaluation tests may be identified. An instruction may be transmitted to a computing device of a user and executed on the computing device to enable functionality of one or more sensors that may be used in the identified tests. Upon initiating a test, data may be collected from the one or more sensors. The collected sensor data may be transmitted to the system and processed using one or more machine learning datasets. Additionally, user behavior data may be collected and processed using one or more machine learning datasets. The sensor data, the user behavior data, and other data may be used together to generate an output.

An example system includes a processor to receive mouse dynamics data of a session to be analyzed and a uniform resource locator (URL) category mapping. The processor can group the mouse dynamics data into a plurality of groups using the URL category mapping. The processor can separately extract features from each of the plurality of groups to generate a plurality of groups of features for the session. The processor can input the groups of features into a trained classification model. The processor can receive an output score from the trained classification model.

An example operation may include one or more of acquiring, by an organization node, a user profile from a blockchain, determining, by the organization node, a role of the user based on the user profile, detecting, by the organization node, user actions directed to graph expansions, and executing, by the organization node, a smart contract to analyze user behavior based on the detected user actions and the role to produce role-based user behavior parameters.

A method, system and computer-usable medium for adaptively assessing risk associated with an endpoint, comprising: determining a risk level corresponding to an entity associated with an endpoint; selecting a frequency and a duration of an endpoint monitoring interval; collecting user behavior to collect user behavior associated with the entity for the duration of the endpoint monitoring interval via the endpoint; processing the user behavior to generate a current risk score for the entity; comparing the current risk score of the user to historical risk scores to determine whether a risk score of a user has changed; and changing the risk score of the user to the current risk score when the risk score of the user has changed.

An apparatus in one embodiment comprises at least one processing platform including a plurality of processing devices. The processing platform is configured to receive a request to deploy one or more applications of a plurality of selected applications, wherein the plurality of selected applications are selected based on a determined role of an individual within an enterprise, and to deploy the one or more applications for at least one user device responsive to the request. The processing platform is further configured to monitor execution of the one or more applications in connection with the at least one user device, to receive and analyze data corresponding to the execution of the one or more applications, and to automatically generate one or more recommendations in connection with the deployment of the one or more applications for the at least one user device based on the received and analyzed data.

A system for detecting malicious software, comprising at least one hardware processor adapted to: execute a tested software object in a plurality of computing environments each configured according to a different hardware and software configuration; monitor a plurality of computer actions performed in each of the plurality of computing environments when executing the tested software object; identify at least one difference between the plurality of computer actions performed in a first of the plurality of computing environments and the plurality of computer actions performed in a second of the plurality of computing environments; and instruct a presentation of an indication of the identified at least one difference on a hardware presentation unit.

In some examples, a system processes event data and video frames produced by a program during execution of the program, the event data representing user actions with respect to a graphical user interface (GUI) of the program. The system identifies an area of the GUI that corresponds to a respective user action of the user actions, wherein identifying the area of the GUI uses a first video frame before an event corresponding to the respective user action, and a second video frame after the event corresponding to the respective user action. The system identifies, based on the identified area, a test object representing a user interface (UI) element, and generates a test script for testing the program, the test script including the test object.