Abstract: A cognitive security analytics platform is enhanced by providing a computationally- and storage-efficient data mining technique to improve the confidence and support for one or more hypotheses presented to a security analyst. The approach herein enables the security analyst to more readily validate a hypothesis and thereby corroborate threat assertions to identify the true causes of a security offense or alert. The data mining technique is entirely automated but involves an efficient search strategy that significantly reduces the number of data queries to be made against a data store of historical data. To this end, the algorithm makes use of maliciousness information attached to each hypothesis, and it uses a confidence schema to sequentially test indicators of a given hypothesis to generate a rank-ordered (by confidence) list of hypotheses to be presented for analysis and response by the security analyst.

Abstract: An example operation may include one or more of storing a unique identification code encapsulating encoded information about a trusted group of member devices within a decentralized network, the unique identification code being generated by the trusted group of member devices, decoding the stored unique identification code to generate decoded information which verifies that the user device is a member device of the trusted group of member devices and provides contact information for other member devices of the trusted group of member devices, and establishing a communication session with the trusted group of member devices based on the contact information obtained by decoding the unique identification code.

Abstract: An electro-optical module assembly is provided that includes a flexible substrate having a first surface and a second surface opposite the first surface, wherein the flexible substrate contains an opening located therein that extends from the first surface to the second surface. An optical component is located on the second surface of the flexible substrate and is positioned to have a surface exposed by the opening. At least one electronic component is located on a first portion of the first surface of the flexible substrate, and at least one micro-energy source is located on a second portion of the first surface of the flexible substrate.

Abstract: An example operation may include one or more of receiving, by a mobile service provider, a mobile number portability request from a mobile device connected to a current mobile service provider; fetching mobile device porting data from a blockchain ledger accessible by the mobile service provider and by the current mobile service provider; verifying fetched mobile device porting data; in response to a successful verification, sending a request to the blockchain ledger to update current mobile service provider data; and receiving a notification from the blockchain indicating that a connection between the current mobile service provider and the mobile device is disconnected; porting a mobile device number; and updating the mobile device porting data in the blockchain ledger.

Abstract: A multi-layer substrate with metal layers as a moisture diffusion barrier for reduced electrical performance degradation over time after moisture exposure and methods of design and manufacture. The method includes determining a diffusion rate of an insulator material provided between an upper metal layer and an underlying signal line. The method further includes calculating a diffusion distance between a plane opening of the upper metal layer and the underlying signal line using the diffusion rate of the insulator material.

Abstract: Methods and systems for population of user identifiers based on nearby devices are disclosed. One or more user identifiers are entered into a first electronic device. When the first electronic device is in proximity to a second electronic device, and a user prepares to log on to the second electronic device, the one or more user identifiers from the first electronic device are retrieved by the second electronic device and presented to the user for selection. The user identifiers may be displayed in a prioritized state based on particular factors. Sharing policies for particular user identifiers may be set based on user input. The user can then select one of the presented user names for logging on to an account with the second electronic device.

Abstract: Systems and methods for redirecting notifications, including determining that a first mobile device is in motion at a speed that exceeds a threshold value; determining that the while the first mobile device is in motion at a speed that exceeds the threshold value, the first mobile device is within a threshold distance of the second mobile device; determining, from an input received by the first mobile device that the first mobile device is in a position of a driver of an automobile; determining that a second mobile device is in a position of a passenger of the automobile; and automatically transmitting the notification from the first mobile device to the second mobile device, without providing an indication to a user of the first mobile device that the notification was received by the first mobile device.

Abstract: Methods and systems for bias control in an optical switch fabric include monitoring optical power at outputs of a plurality of switch elements in an N×N switch fabric that has N inputs, N outputs, and M?2 stages, each switch element having a respective unique radio frequency tone. A bias control of each of the plurality of switch elements is adjusted. It is determined whether the optical power at the outputs of each respective switch element after bias control adjustment conform more closely to a predetermined criterion relative to the monitored optical power at the outputs of the respective switch element prior to adjustment.

Abstract: Methods, computer program products, and systems are presented. The method, computer program products, and systems can include, for instance: obtaining position data for a plurality of mobile devices, wherein mobile devices of the plurality of mobile devices have associated identifiers, and wherein the obtained position data is data that has been derived using wirelessly emitted signals; examining data of the position data to determine that one or more user is present within a neighboring zone of a venue, the neighboring zone being a zone that neighbors a certain zone of the venue; predicting that at least one user of the one or more user within the neighboring zone intends to be in the certain zone; specifying a zone association of the at least one user as the certain zone of the venue; and providing one or more output based on the specifying.

Abstract: A channel programming associated with a channel can be selected. The channel can be associated with a programming broadcasting system. The channel programming can be displayed upon a presentation device. An immediate content from a content delivery entity interrupting the presentation of the channel programming can be received. The channel programming and the immediate content can be simultaneously presented on the presentation device.

Abstract: Techniques for peer-to-peer attribution including receiving, at a server and from a first user profile of a P2P application executing on a first user device, an image of an item, a plurality of radio-frequency identifiers, and a plurality of other user profiles respectively executing on a plurality of other user devices communicatively coupled to the first user device by a wireless personal area network (WPAN). The techniques further include performing object recognition on the image, retrieving a first product, transmitting inventory information for the first product from a third-party server to the first user device, receiving an order confirmation for the first product, executing a smart contract between the first user profile, a second user profile, and the third-party, and adding the first product to a first inventory of the first user profile.

Abstract: A method of migrating an application to a computing environment including: obtaining a service topology and a deployment sequence from an existing application; choosing a deployment preference, each deployment preference containing factors and a weight of each of the factors; outputting the service topology and the deployment preference; reading service records for the chosen service topology and deployment preference from a repository, the service records containing a value score and weight mapping information of each factor of each service record; performing a mock conversion of migrating the application to the computing environment; adjusting the value score and weight mapping of the service records according to the results of the mock conversion; responsive to a user choosing one service record representing a solution for migrating the application to the computing environment, generating files for the solution; and deploying the solution into the computing environment using the files.

Abstract: Determining a type of actor performing an activity includes monitoring the performance of the activity via at least one sensor to produce activity readings over a dimension. The activity readings are then compared to reference readings that are generated based on a machine performing same activity. The comparison of the reference readings to the activity readings is used to determine a variance between the activity readings and reference readings. Once the variance is determined, the variance is compared with a threshold value to determine the type of actor performing the activity.

Abstract: A computer-implemented method includes receiving an input, from a user, in the form of a destination to be navigated to; calculating a route to the destination based on the input; recognizing at least one object on a route taken by the user; processing data from the received input, the calculated route, and the recognized at least one object; and providing an output to the user based on the recognized at least one object, the output being based on natural language processing.

Abstract: Zinc oxide compositions and methods for controlling zinc oxide particle size for sunscreen applications are provided herein. A method includes manipulating the size of multiple zinc oxide particles to be below a maximum threshold; selecting one or more media to be used in a sunscreen composition, wherein said selecting is based on the refractive index of each of the media; and integrating the manipulated zinc oxide particles into the selected media to create the sunscreen composition. A composition includes multiple zinc oxide particles, wherein each of the zinc oxide particles is (i) coated with an optical coating material and (ii) of a size that is below a maximum threshold; and a medium layer within which the zinc oxide particles are suspended, wherein the medium layer comprises a mixture of one or more media, and wherein each of the media has a refractive index below a predetermined threshold.

Abstract: A system for dispensing packages from an underground storage facility is disclosed, more specifically to disclose systems for handling packages using gravity and buoyancy. An underground storage system comprises a storage facility and at least one open air fluid column. The storage facility has an above ground portion connected to a hollow underground portion with a bottom. A helical ramp extends from the above ground portion to the bottom of the storage facility. Devices are located adjacent to the helical ramp to dispense packages to the helical ramp. A conveyor is located at the bottom of the underground portion to receive packages from the helical ramp. An airlock is located adjacent to the bottom of the underground portion and is connected to a conveyor. Packages are discharged from the storage facility via the airlock.

Abstract: Zinc oxide compositions and methods for controlling zinc oxide particle size for sunscreen applications are provided herein. An example composition includes multiple zinc oxide particles, wherein each of the zinc oxide particles is (i) coated with an optical coating material and (ii) of a size that is below a maximum threshold; and a medium layer within which the zinc oxide particles are suspended, wherein the medium layer comprises a mixture of one or more media, and wherein each of the media has a refractive index below a predetermined threshold.

Abstract: A device for converting heat into mechanical energy is disclosed. The device includes a channel flow boiler having at least one channel adapted to heat a working fluid for generating a liquid-gas mixture; an expansion device adapted to expand the liquid-gas mixture; and a movable element arranged such that the expanding liquid-gas mixture at least partially converts an internal and/or kinetic energy of the liquid-gas mixture into mechanical energy associated with the movable element; wherein the channel flow boiler and/or the expansion device is adapted to supply heat to the liquid-gas mixture.

Abstract: The subject matter of this invention relates to block copolymers (BCPs) and, more particularly, to block copolymers capable of self-assembly into nanoparticles for the delivery of hydrophobic cargos. The BCPs include a hydrophobic block that contains a thioether functional group that is susceptible to oxidation, transforming the solubility of the block from hydrophobic to hydrophilic, thereby releasing the hydrophobic cargo of the nanoparticle.

Abstract: Embodiments herein discuss tuning a testing apparatus to better match the input response of a target system in which a cable will be used. For example, conductors in the cable may have a different skew depending on the system in which they are used. The testing apparatus may be tuned using frequency information regarding the type of signals that will be driven on the cable when installed in the target system. In one embodiment, the testing apparatus adjusts a testing cycle refresh rate for generating a testing signal which changes the frequency content of the testing signal. Using the adjusted testing cycle refresh rate results in the driver outputting a testing signal that better reflects the actual signals that will be transmitted on the cable in the target system.

Abstract: An unmanned aerial vehicle for providing ameliorative action. The unmanned aerial vehicle includes a processor-based monitoring device to monitor a plurality of individuals to determine crowd data associated with the plurality of individuals, a crowd estimator configured to receive the crowd data to estimate a crowd pressure estimation value indicative of a likelihood of a crowd event, the crowd pressure estimation value being based on the crowd data, and an ameliorative action generator to automatically perform a function when the crowd pressure estimation value exceeds a predetermined threshold value, wherein the function includes activating one or more feedback outputs configured to provide an ameliorative action.

Abstract: A process of in-situ detection of hollow fiber formation includes immersing a plurality of individual glass fibers in an index-matching material. The index-matching material has a first refractive index that substantially matches a second refractive index of the glass fibers. The process also includes exposing the individual glass fibers to a light source during immersion in the index-matching material. The process further includes utilizing one or more optical components to collect optical data for the individual glass fibers during immersion in the index-matching material. The process also includes determining, based on the optical data, that a particular glass fiber of the plurality of individual glass fibers includes a hollow fiber.

Abstract: A computer-implemented method generates a graphical user interface (GUI). A graphical user interface (GUI) development server receives a candidate GUI element. The candidate GUI element is in use by one or more current GUIs, and the candidate GUI element performs a computer-based function. The GUI development server receives a rating of the candidate GUI element from users of the one or more current GUIs, and determines whether the rating of the candidate GUI element exceeds a predefined value. In response to determining that the rating of the candidate GUI element exceeds the predefined value, the GUI development server identifies the candidate GUI element as a preferred GUI element to perform the computer-based function in future GUIs, and utilizes that preferred GUI element to generate a new GUI that needs the computer-based function.

Abstract: Embodiments of the invention are directed to a biosensing integrated circuit (IC). A non-limiting example of the biosensing IC includes a plurality of semiconductor substrate layers. A sensor element is formed over a first one of the plurality of semiconductor substrate layers, wherein the sensor element is configured to, based at least in part on the sensor element interacting with a predetermined material, generate data representing a measurable electrical parameter. An adhesion enhancement region is configured to physically couple the sensor element to the first one of the plurality of semiconductor substrate layers. In some embodiments of the invention, the biosensing IC further includes an electrically conductive interconnect network configured to communicatively couple the data representing the measurable electrical parameter to computer elements.

Abstract: A sequence of tuples, each having one or more attributes, is received at one of one or more processing elements operating on one or more processors. Each processing element may have one or more stream operators. A first stream operator may be identified as one that only processes an instance of a first attribute in a currently received tuple when a difference between an instance of the first attribute in a previously received tuple and the instance of the first attribute in the currently received tuple is outside of a difference threshold. A second stream operator may generate a difference attribute from a first instance of the first attribute in a first one of the received tuples and a second instance of the first attribute in a second one of the received tuples. The difference attribute may be transmitted from the second stream operator to the first stream operator.

Abstract: A method of operating a message system can include maintaining a list of users of the message system and maintaining a connection list and a message stream for each user of the message system. After receiving a message from a first user of the message system, the received message can be published on the message stream of the first user and on the message streams of the users identified in the first user's connection list. If the received message is detected to be a reply to an earlier message from a second user, then the earlier message can be published on the message streams of the users identified in the first user's connection list, who are not in the second user's connection list.

Abstract: Aspects of the present disclosure relate to adaptive mesh wiring. A clock signal is provided to a clock mesh area, wherein the clock mesh area includes a plurality of wires configured in a grid. A pair of loads with impermissible skew within the clock mesh area is identified based on a threshold value. A mesh network area partition enclosing the pair of loads with impermissible skew is determined. Modifications are then made to the mesh network area partition to attempt to reduce skew. In some embodiments, a wire width of a portion of wires included in the mesh network area partition is increased. In some embodiments, a wire is added in between two wires present in the mesh network area partition.

Abstract: According to some embodiments, a computer-implemented method for performing sparse matrix dense matrix (SpMM) multiplication on a single field programmable gate array (FPGA) module comprising a k-stage pipeline is described. The method may include interleaving k-stage threads on the k-stage pipeline comprising a plurality of threads t0 to tk-1, wherein a first result of thread t0 is ready one cycle after the first input of thread tk-1 is fed into the pipeline, and outputting a result matrix Y.

Abstract: A method and system for improving an automated mobile device charging detection system is provided. The method includes automatically detecting a connection between a mobile device and a charging apparatus. A voltage signal between the charging apparatus and circuitry of the mobile hardware device is detected via a hardware sensor that includes a motion sensor for charging attempt detection. A specified time period is determined to have elapsed since detecting the voltage signal and a subsequent loss of the voltage signal between the charging apparatus and the circuitry of the mobile hardware device is detected. In response, a notification indicating the loss of the voltage signal is presented to a user.

Abstract: Tamper-respondent assemblies, electronic assembly packages, and methods of fabrication are provided which include multiple, discrete tamper-respondent sensors that overlap, at least in part, and facilitate defining a secure volume about one or more electronic components to be protected, such as an electronic assembly. The tamper-respondent sensors include a first tamper-respondent sensor and a second tamper-respondent sensor, which may be similarly constructed or differently constructed. In certain embodiments, the tamper-respondent sensors wrap, at least in part, over an electronic enclosure, and in other embodiments, the tamper-respondent sensors cover, at least in part, an inner surface of an electronic enclosure to facilitate defining a secure volume in association with a multilayer circuit board to which the electronic enclosure is mounted.

Abstract: Mechanisms are provide for modifying the selection of modes of communication for communicating with patients based on a simulation of vendor communications. A communication simulation is configured with configuration parameters defining expected results of a plurality of communications with patients handled by a communication vendor system associated with a personalized care plan creation and monitoring (PCPCM) system. The plurality of communications are simulated to generate simulated results and a response of the PCPCM system to the simulated results of the plurality of communications is determined. The response of the PCPCM system is evaluated to determine if the PCPCM system responds correctly to the simulated results, and an operation of the PCPCM system is modified based on results of the evaluation.

Abstract: An experiment manager is discussed for the design and execution of numerical experiments in composite simulation models, such as those created using the Smarter Planet Platform for Analysis Simulation of Health (Splash). The experiment manager independently elicits experiment-related information from each contributor of a component model, and uses this information to subsequently assist the creator of a composite model in selecting experimental factors, creating experimental designs based on these factors, and executing the experiments. This functionality permits cross-disciplinary modeling, simulation, sensitivity analysis and optimization in the setting of complex systems.

Abstract: A secure cloud computing environment protects the confidentiality of application code from a customer while simultaneously protecting the confidentiality of a customer's data from intentional or inadvertent leaks by the application code. This result is accomplished without the need to trust the application code and without requiring human surveillance or intervention. A client secure virtual machine (SVM) is accessible by a client who supplies commands, operand data and application data. An appliance SVM has the application code loaded therein and includes an application program interface that accesses a memory area shared by both SVMs. All access to the appliance SVM is initially revoked by an ultravisor, except for the shared memory. The appliance SVM processes the commands without ever saving any persistent state of the application data. The ultravisor manages an SVM by maintaining exclusive control over a device tree used by the operating system of the SVM.

Abstract: Approaches for providing data protection in a networked computing environment are provided. A method includes detecting, by at least one computer device, a breach of a first system in the networked computing environment. The method also includes generating, by the at least one computer device, a second system in the networked computing environment, wherein the second system includes a patch based on the breach. The method additionally includes converting, by the at least one computer device, the first system to a decoy system. The method further includes generating, by the at least one computer device, a third system in the networked computing environment, wherein the third system has reduced security relative to the first system.

Abstract: A computer-implemented method includes receiving a request to authenticate a user to remotely access a secure device and establishing, in response to the user being granted remote access to the secure device, a remote user session for the user. The computer-implemented method further includes identifying a plurality of actions performed during the remote user session. The computer-implemented method further includes comparing a first combination of actions in the plurality of actions to a plurality of policies for malicious intent. The computer-implemented method further includes determining a level of risk for malicious intent for the first combination of actions. The computer-implemented method further includes generating, in response to the level of risk of the first combination of actions exceeding a given threshold level, one or more preventive actions. A corresponding computer system and computer program product are also disclosed.

Abstract: A system and method to perform capacitance extraction involves defining a location of signal wires and floating metal of an integrated circuit design. The method includes designating one of the signal wires as a target wire, defining a first area within which first capacitances between the target wire and the floating metal and other signal wires are determined, defining a second area, within which second capacitances between floating metal within the first area and the floating metal and the other signal wires not within the first area are determined, and generating an intermediate capacitive network. The intermediate capacitive network includes the target wire, the floating metal, and the other signal wires within the second area, the first capacitances and the second capacitances. A capacitive network is generated from the intermediate capacitive network. The first capacitances and the second capacitances are used to generate third capacitance values of the capacitive network.

Abstract: A computer-implemented method for protecting a kernel for secure boot of an operating system includes preparing a kernel component with a signature for a secure boot. A processing unit modifies a machine owner key (MOK) file to include a trusted certificate. The MOK is separate from the kernel file. The processing unit validates the kernel component using a modified Grub file, a modified Shim file, and the MOK, and executes a secure boot using the validated kernel component. The kernel is unchanged by the secure boot process. The kernel component that is protected may be either a program executable (PE) file or a non-PE file.

Abstract: A method, computer program product, and computer system for detecting creation of a first portion of a table and a second portion of the table, wherein the first portion of the table may include a first label and wherein the second portion of the table may include a second label. It may be determined that a pattern exists between the first label and the second label based upon, at least in part, historical use of the first label relative to the second label. The pattern between the first label and the second label may be automatically recreated in a third portion of the table and a fourth portion of the table based upon, at least in part, receiving at least a portion of the first label in the third portion of the table.

Abstract: A method for operating a secure storage device with a non-volatile memory on a computer system which executes multiple operating system instances. The non-volatile memory comprises one or more domains which are used by the operating system instances. A separate trusted key entry system is used to configure secret data of an operating system instance stored in the non-volatile memory. The method comprises setting a domain to either secure or non-secure mode; generating a unique identifier of the operating system instance; generating a secure hash for the operating system instance; and storing the secure hash in the domain.

Abstract: A method, computer program product, and computer system for detecting creation of a first portion of a table and a second portion of the table, wherein the first portion of the table may include a first label and wherein the second portion of the table may include a second label. It may be determined that a pattern exists between the first label and the second label based upon, at least in part, historical use of the first label relative to the second label. The pattern between the first label and the second label may be automatically recreated in a third portion of the table and a fourth portion of the table based upon, at least in part, receiving at least a portion of the first label in the third portion of the table.

Abstract: A method for classification of suspicious activities is provided. In the method, a first intrusion detection system comprising a normal operation mode and which is connected to a second intrusion detection system by a first communications connection is implemented. In response to detecting a malfunction of the first communications connection, the first intrusion detection system is switched from the normal operation mode to a limited operation mode for receiving first data from one or more honeypot systems and second data from the second intrusion detection system. A prediction model for representing malicious attacks is generated by execution of a predefined classification algorithm with respect to the received data, wherein the predefined classification algorithm further determine a model evaluation metric with respect to the prediction model. The prediction model is deployed to detect the malicious attacks if the model evaluation metric meets a predefined validation condition.

Abstract: A mechanism is provided in a data processing system for managing filesystem inodes. The mechanism monitors inode consumption in a filesystem. The mechanism periodically determines a number of inodes to add to the filesystem based on the inode consumption and adds the number of inodes to the filesystem.

Abstract: Generating a textual description of an image includes classifying an image represented by image data into a domain-specific category, and segmenting one or more elements in the image data based on the domain-specific category. Each element of the one or more elements is compared to a domain-independent model to detect one or more statistical anomalies in the one or more elements. The one or more detected statistical anomalies are characterized using one or more domain-independent text phrases. The one or more domain-independent text phrases are converted to one or more domain-specific descriptions based upon the domain-specific category.

Abstract: A method for selectively compressing unstructured data includes preparing, at a host system, a data blob made up of unstructured data, for storage on a storage system. The method encodes a first portion of the data blob with a first color and a second portion of the data blob with a second color. The first color indicates that the associated portion should remain uncompressed, while the second color indicates that the associated portion should be compressed. The method transmits the encoded data blob to a storage virtualization layer associated with the storage system. In response, the storage virtualization layer stores the first portion in an uncompressed format, and compresses the second portion and stores the second portion in a compressed format. A corresponding system and computer program product are also disclosed herein.

Abstract: An information processing system, computer readable storage medium, and method for accelerated radix sort processing of data elements in an array in memory. The information processing system stores an array of data elements in a buffer memory in an application specific integrated circuit radix sort accelerator. The array has a head end and a tail end. The system radix sort processing, with a head processor, data elements starting at the head end of the array and progressively advancing radix sort processing data elements toward the tail end of the array. The system radix sort processing, with a tail processor, data elements starting at the tail end of the array and progressively advancing radix sort processing data elements toward the head end of the array, the tail processor radix sort processing data elements in the array contemporaneously with the head processor radix sort processing data elements in the array.

Abstract: A computer-implemented method includes determining a key set of properties. Based on the key set, a plurality of keys are generated for a plurality of objects, where the plurality of keys include a respective key for each object based on a value associated with the object for each property in the key set. A request is received to search for matching objects having a set of desired values for a desired set of properties, where the desired set of properties are a subset of the key set and exclude one or more properties in the key set. A Bloom filter search is performed on the plurality of objects. The Bloom filter search is based on the set of desired values for the desired set of properties and further based on the plurality of keys that are based on the key set. The matching objects are identified from the search.

Abstract: A set of transition characteristics can be identified. The set of transition characteristics can include continuities and discontinuities between data fields and data visualization channels among a plurality of data visualizations. The set of transition characteristics can be identified by analyzing the plurality of data visualizations and identifying similarities and differences among the data fields and the data visualization channels. A distribution of the data fields and the data visualization channels across the plurality of data visualizations can be determined. A collection of the data visualizations can be determined based on the distribution of the data fields and the data visualization channels across the plurality of data visualizations. The collection of the data visualizations can include at least a subset of the plurality of data visualizations.

Abstract: The present invention may be a method, a computer system, and a computer program product. An embodiment of the present invention provides a method for judging data consistency in a database. In one embodiment, the method comprises the following: generating a property of data obtained from a first database; associating the property with an attribute of a data model to generate a data property definition; judging whether data obtained from a second database satisfies the data property definition or not; and outputting a result of the judgment. In another embodiment, the method comprises the following: generating a property of data obtained from a database; associating the property with an attribute of a data model to generate a data property definition; judging whether data which is stored in the database satisfies the data property definition or not; and outputting a result of the judgment.

Abstract: A plurality of first event instances of a first event and a plurality of second event instances of a second event are received based on the first event occurring and the second event occurring. Each event instance has an event identifier and a timestamp. A first event type of the plurality of first event instances and a second event type of the plurality of second event instances are identified. A time period of overlap between the first event and the second event are determined by detecting regular intervals between the plurality of first event instances, as compared to each other, and the plurality of second event instances, as compared to each other. A relationship between the first event and the second event are scored based on the time period of overlap. The first event and the second event are grouped based on the scored relationship.

Abstract: A first file and a second file are retrieved from a database, in which the first and second files include an unstructured text stream. Metadata of the first and second files are extracted. The extracted metadata include a description category, entity source, geographic region, and a set of sub-files linked to the file. A data structure indicative of relationship between the first and second files is generated. Weighting factor is applied to the generated data structure. which indicates a degree of relationship between the first file and the second file. The relationship and the degree of the relationship are determined based on the extracted metadata of the first and second files. In response to a user requesting the first file, it is determined whether the second file should be provided in conjunction with the first file based on the weighting factor as applied to the data structure.