Charles Lamanna

Embodiments are directed to determining an optimal number of concurrently running cloud resource instances, based on the projected operational metric measurements, a number of cloud resource instances that are to be concurrently running at a specified future point in time.

A classification application identifies patterns and evidences within representative documents. The application constructs a classification rule according to an entity and an affinity determined from the patterns and evidences. The application processes the representative documents with the classification rule to evaluate whether the rules meet acceptance requirements. Subsequent to a successful evaluation, the application identifies confidence levels for patterns and evidences within other… Show more

A classification application identifies patterns and evidences within representative documents. The application constructs a classification rule according to an entity and an affinity determined from the patterns and evidences. The application processes the representative documents with the classification rule to evaluate whether the rules meet acceptance requirements. Subsequent to a successful evaluation, the application identifies confidence levels for patterns and evidences within other documents. Show less

Spam filters use sets of rules to identify unwanted messages. These rules are typically applied in the same static order each time a message is received. The invention uses previously processed rules to more efficiently classify similar messages received in the future. The invention identifies which rules resulted in the classification of a particular message, and, the next time a message with a similar fingerprint is received, those rules are used to classify the message. The rules may also be… Show more

Spam filters use sets of rules to identify unwanted messages. These rules are typically applied in the same static order each time a message is received. The invention uses previously processed rules to more efficiently classify similar messages received in the future. The invention identifies which rules resulted in the classification of a particular message, and, the next time a message with a similar fingerprint is received, those rules are used to classify the message. The rules may also be re-ordered so that the rules that are the most effective at classifying messages are moved to the top of the list and are thus executed first. Claims are directed to generating a customized classification rule execution order and to identifying optimal ordering rules for previously processed data. Show less

Unwanted communication detection and/or management features are providing, including using one or more commonality measures as part of generating templates for fingerprinting and comparison operations, but the embodiments are not so limited. An computing architecture of one embodiment includes components configured to generate templates and associated fingerprints for known unwanted communications, wherein the template fingerprints can be compared to unknown communication fingerprints as part… Show more

Unwanted communication detection and/or management features are providing, including using one or more commonality measures as part of generating templates for fingerprinting and comparison operations, but the embodiments are not so limited. An computing architecture of one embodiment includes components configured to generate templates and associated fingerprints for known unwanted communications, wherein the template fingerprints can be compared to unknown communication fingerprints as part of determining whether the unknown communications are based on similar templates and can be properly classified as unwanted or potentially unsafe communications for further analysis and/or blocking. A method of one embodiment operates to use a number of template fingerprints to detect and classify unknown communications as spam, phishing, and/or other unwanted communications. Show less

The present invention extends to methods, systems, and computer program products for decomposing and merging regular expressions. Embodiments of the invention decompose a regular expression into multiple simple keyword graphs, merge those keyword graphs in a compact and efficient manner, and produce a directed acyclic graph (DAG) that can execute a simplified regular expression alphabet. Several of these regular expression DAG's can then be merged together to produce a single DAG that… Show more

The present invention extends to methods, systems, and computer program products for decomposing and merging regular expressions. Embodiments of the invention decompose a regular expression into multiple simple keyword graphs, merge those keyword graphs in a compact and efficient manner, and produce a directed acyclic graph (DAG) that can execute a simplified regular expression alphabet. Several of these regular expression DAG's can then be merged together to produce a single DAG that represents an entire collection of regular expressions. DAGs along with other text processing algorithms and a heap collection can be combined in a multi-pass approach to expand the regular expression alphabet. Show less

Embodiments are directed to indexing and querying a sequence of hash values in an indexing matrix. A computer system accesses a document to extract a portion of text from the document. The computer system applies a hashing algorithm to the extracted text. The hash values of the extracted text form a representative sequence of hash values. The computer system inserts each hash value of the sequence of hash values into an indexing matrix, which is configured to store multiple different hash value… Show more

Embodiments are directed to indexing and querying a sequence of hash values in an indexing matrix. A computer system accesses a document to extract a portion of text from the document. The computer system applies a hashing algorithm to the extracted text. The hash values of the extracted text form a representative sequence of hash values. The computer system inserts each hash value of the sequence of hash values into an indexing matrix, which is configured to store multiple different hash value sequences. The computer system also queries the indexing matrix to determine how similar the plurality of hash value sequences are to the selected hash value sequence based on how many hash values of the selected hash value sequence overlap with the hash values of the plurality of stored hash value sequences. Show less

Embodiments directed to conditionally executing regular expressions and to simplifying regular expressions by canonicalizing regular expression terms. In an embodiment, a computer system accesses identified regular expression key terms that are to appear in a selected portion of text. The regular expression key terms are identified from terms in a selected regular expression. The computer system determines whether the identified regular expression key terms appear in the selected portion of… Show more

Embodiments directed to conditionally executing regular expressions and to simplifying regular expressions by canonicalizing regular expression terms. In an embodiment, a computer system accesses identified regular expression key terms that are to appear in a selected portion of text. The regular expression key terms are identified from terms in a selected regular expression. The computer system determines whether the identified regular expression key terms appear in the selected portion of text. The computer system also, upon determining that none of the identified regular expression key terms appears in the selected portion of text, prevents execution of the regular expression. Upon determining that at least one of the identified regular expression key terms appears in the selected portion of text, the computer system executes the regular expression. Show less

Similarity is determined between documents based on a method for identifying documents that are likely to be based on another document. The method can include the determination of a containment coefficient, which can indicate when a template document is a subset or substantially a subset of another document. Based on this determination, an appropriate document management action can be taken, such as implementing a security policy or modifying the display of messages from a user interface.