A computer system, and a method at a computer system, the method including applying a mapping function to a received message to create an characteristic value, wherein the mapping function is adapted to map similar messages to similar characteristic values; comparing the characteristic value to a value associated with each of a plurality of message extractors; determining that the characteristic value does not match any value associated with the plurality of message extractors; identifying at least one message extractor from the plurality of message extractors, the identifying determining that the value associated with the message extractor and the characteristic value from the received message, when compared, satisfy a similarity criterion; and using the identified at least one message extractor to extract information from the received message.

A method for execution by a query processing module includes determining a query expression indicating a query for execution. An operator tree is generated based on a nested ordering of a plurality of operators indicated by the query expression. Conjunctive normal form (CNF) conversion cost data is generated based on the operator tree, and disjunctive normal form (DNF) conversion cost data is also generated based on the operator tree. Conversion selection data is generated based on the CNF conversion cost data and the DNF conversion cost data. The conversion selection data indicates a selection to perform either a CNF conversion or a DNF conversion. A normalized query expression is generated by performing either the CNF conversion or the DNF conversion upon the query expression based on the conversion selection data. Execution of the query is facilitated in accordance with the normalized query expression.

Techniques are described to improve query evaluation in computer systems. In an embodiment, a system receives a full text query for evaluation against a collection of hierarchically marked data object sets. The query specifies token(s) and context(s) which indicate hierarchical location(s) to match within a queried hierarchical data structure. To evaluate the query, the system determines a) data object set(s) that contain the query specified token(s) using token list(s), and/or b) data object set(s) that contain the query specified context(s) using label list(s).

The present disclosure relates to a statement presentation system. The statement presentation system may include a computer-readable storage medium that may be configured to store executable modules. The computer-readable storage medium may include a statement browser that may be configured to receive a statement file and present a statement. The computer-readable storage medium may also include a statement generation engine that may be configured to modify the statement file, and generate a modified statement file. The statement generation engine may extract data from a data source based on the modified statement file, and operate the extracted data. The operation may be conducted by loadable operation code, a loadable operation library file, or a loadable operation tool. The statement generation engine may render the operated data and display the rendered data on the statement browser in the form of a statement.

A multi-domain operational system is provided. The system includes a data collection engine configured and operable to collect operational data from one or more collection resources within time constraints imposed by operational requirements. The system further includes a business rules engine configured and operable to execute a plurality of rules each of which comprise a plurality of conditions grouped in a sequence by a set of logical connectors. The plurality of rules are associated with a mission task. The system also includes a security engine configured to facilitate information sharing across multiple security domains based on one or more security protocols. The system further includes a mission manager software component configured and operable to manage operation of at least the data collection engine, the business rules engine and the security engine using a common information layer.

A method of generating a digital audio-visual sequence comprising one or more three-dimensional structures and an audio stream in real time is disclosed, comprising the steps of capturing and processing vocal input from a user, identifying at least one semantic construct from the captured vocal input, matching identified semantic construct with at least one structure tag and at least one case tag, wherein the structure tag is associated with a three-dimensional structure and the case tag is associated with an alphanumerical description of the three-dimensional structure, and generating a sequence based on one or more matched structure tag(s) and one or more matched case tag(s). Generating comprises scheduling synchronous rendering of the three-dimensional structure in a user interface and voice synthesising of the alphanumerical description. An apparatus embodying the method is also disclosed, including display means for displaying the user interface, voice synthesising means for processing the alphanumerical description into an audio signal, and audio means for outputting the audio signal.

Discussed herein are devices, systems, and methods for dynamic IPB product updates or generation. A method can include storing, by a memory device, information used to generate IPB products, receiving, by a server coupled to the memory device, a request for an IPB product of the IPB products, receiving, by the server and from the memory device, information that satisfies conditions of a query, generating the requested IPB product based on the received information, and providing the requested IPB product to a client device.

Discussed herein are devices, systems, and methods for dynamic IPB product updates or generation. A method can include storing, by a memory device, information used to generate IPB products, receiving, by a server coupled to the memory device, a request for an IPB product of the IPB products, receiving, by the server and from the memory device, information that satisfies conditions of a query, generating the requested IPB product based on the received information, and providing the requested IPB product to a client device.

The problem of distinct value estimation has many applications, but is particularly important in the field of database technology where such information is utilized by query planners to generate and optimize query plans. Introduced is a novel technique for estimating the number of distinct values in a given dataset without scanning all of the values in the dataset. In an example embodiment, the introduced technique includes gathering multiple intermediate probabilistic estimates based on varying samples of the dataset, 2) plotting the multiple intermediate probabilistic estimates against indications of sample size, 3) fitting a function to the plotted data points, and 4) determining an overall distinct value estimate by extrapolating the objective function to an estimated or known total number of values in the dataset.

Disclosed herein are methods, systems, and processes to distribute and disperse search loads to optimize security event processing in cybersecurity computing environments. A search request that includes a domain specific language (DSL) query directed to a centralized search cluster by an event processing application is intercepted. The event processing application is inhibited from issuing the search request to the centralized search cluster if a structured or semi-structured document matches the DSL query.