International Business Machines Corporation

Kyndryl, Inc.

Andrea Giovannini

Stefan Ravizza

Florian Graf

Tim Uwe Scheideler

Frederik Frank Flöther

Erik Rueger

Arjun Udupi Raghavendra

Patrick Lustenberger

Matthias Seul

Adam Ivankay

Tanveer Fathima Syeda-Mahmood

Thomas Allen Snellgrove

Ashutosh Jadhav

Joy Tzung-yu Wu

Markus Pelnar

Thomas J Brunschwiler

Tamas Visegrady

Emanuel Loertscher

Harold D Dykeman

Chiara Marchiori

Richard Obinna Osuala

Stefan Mayer

David Ocheltree

Serge Monney

Kevin Thandiackal

Mario Zusag

Avdyl Haxhaj

Simon Streit

Matthias Reumann

Dominik Moritz Stein

Markus Brandes

Georgios Chaloulos

David Mesterhazy

Eric Slottke

Thomas Pfeiffer

Ivan Girardi

The exemplary embodiments disclose a method, a computer system, and a computer program product for detecting malware. The exemplary embodiments may include aggregating known malware patterns by storing malware patterns and related malware categories of the malware patterns. The exemplary embodiments may additionally include training a first machine-learning system, comprising a generator portion and a discriminator portion, by using the known malware patterns and the related malware categories as training data. The exemplary embodiments may also include generating additional synthetic code patterns by feeding random code samples to the trained first machine-learning system. The exemplary embodiments may further include training a second machine-learning system by using benevolent code patterns and the generated additional synthetic code patterns as training data. The exemplary embodiments may include determining a statistical distribution of predicted malicious code patterns and related categories, and determining a quality value of the training of the second machine-learning system.

Self-learning and adapting cyber threat defense

A processor may gather raw data comprising a plurality of characteristic data samples of a target user group. The processor may categorize the characteristic data samples into a plurality of user-related classes and triggers. The processor may build an input property graph for each characteristic data sample. The processor may augment the input property graph by a concept of hierarchies. The processor may determine a modification vector from the augmented input property graph. The processor may train an encoder/decoder combination machine-learning system. An embedding vector and a modification vector are used as input for the decoder to build a trained machine-learning generative model.

Modification and generation of conditional data

An approach for locating suspect patterns of transactions in a financial network may be provided. The approach may include generating a transaction graph for a financial network by processing transaction data defining transfers between accounts in that network. The approach may include modifying the transaction graph to include synthetic suspect transaction patterns at multiple locations in the graph and extracting subgraphs from the transaction graph. The approach may include training a graph neural network model to classify subgraphs containing a synthetic suspect transaction pattern as suspect. The approach may also include locating suspect transaction patterns in a new financial network by generating a new transaction graph for that network and classifying a subgraph of the new financial network as suspect.

Locating suspect transaction patterns in financial networks

Mechanisms are provided to implement a visual analytics pipeline. The mechanisms generate, from an input database of records, a chronology-aware graph data structure of a plurality of records based features specified in an ontology data structure. The chronology-aware graph data structure has vertices representing one or more of events or records based features corresponding to events, and edges representing chronological relationships between events. The mechanisms execute a chronology-aware graph query on the chronology-aware graph data structure to generate a filtered set of vertices and corresponding features corresponding to criteria of the chronology-aware graph query. The mechanisms execute a pattern discovery operation on the filtered set of vertices and corresponding features to identify a subset of vertices and corresponding features that correspond to a relatively higher frequency set of patterns of event paths, and generate a visual analytics graphical representation for the subset of vertices and corresponding features.

Scalable visual analytics pipeline for large datasets

In several aspects for querying a data source represented by data object embeddings in a vector space, a processor inputs, to a trained embedding generation model, a received query and at least one token for receiving from the trained embedding generation model a set of embeddings of the vector space. The set of embeddings comprises an embedding of the received query and at least one embedding of the at least one token respectively, wherein the embedding of each token is a prediction of an embedding of a supplement of the query. The data object embeddings may be searched for data object embeddings that match the set of embeddings. This may result in search result embeddings of the set of embeddings. Data objects that are represented by the search result embeddings may be determined. At least part of the determined data objects may be provided.

Searching a data source using embeddings of a vector space

The exemplary embodiments disclose a system and method, a computer program product, and a computer system for assigning medical codes. The exemplary embodiments may include receiving a medical record in machine-readable text-form, wherein the medical record comprises at least one treatment, converting a portion of the medical record into a determined first medical code of a first length, querying a knowledge graph comprising medical records and a coding catalog for a second medical code of higher order than the first medical code, wherein the second medical code relates to the first medical code, and searching evidence in the medical record for the second medical code by comparing at least a portion of clear text relating to the second medical code with the medical record.

Model augmented medical coding

A method includes receiving a first query by a computing device and assigning the first query to a plurality of cognitive engines, wherein each of the plurality of cognitive engines include different characteristics for processing data. The method also includes, responsive to receiving a response from each of the plurality of cognitive engines for the first query, comparing the received responses from the plurality of cognitive engines. The method also included responsive to determining a difference between a first response from a first cognitive engine and a second response from a second cognitive engine is above a predetermined threshold value, performing a response mediation process until the difference is below the predetermined threshold value. The method also includes selecting a first final response from the received responses for the first query and the second query and displaying the first final response to a user.

Cognitive moderator for cognitive instances

Aspects of the present invention disclose a method, computer program product, and system for detecting a malicious process by a selected instance of an anti-malware system. The method includes one or more processors examining a process for indicators of compromise to the process. The method further includes one or more processors determining a categorization of the process based upon a result of the examination. In response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, the method further includes one or more processors executing the process in a secure enclave. The method further includes one or more processors collecting telemetry data from executing the process in the secure enclave. The method further includes one or more processors passing the collected telemetry data to a locally trained neural network system.

Malware detection by distributed telemetry data analysis

A computer-implemented method for classification of data by a machine learning system using a logic constraint for reducing a data labeling requirement. The computer-implemented method includes: generating a first embedding space from a first partially labeled training data set, wherein in the first embedding space, content-wise related training data of the first partially labeled training data are clustered together, determining at least two clusters in the first embedding space formed from the first partially labeled training data, and training a machine learning model based, at least in part, on a second partially labeled training data set and the at least two clusters, wherein the at least two clusters are used as training constraints.

Semi-supervised learning with group constraints

The present disclosure relates to a method for query expansion. The method comprises: a) receiving a current query having at least one search term; b) inputting the at least one search term of the current query to a set of one or more query expansion modules, wherein the query expansion modules are configured to predict expansion terms of input terms; c) receiving from the set of expansion modules candidate expansion terms of the search term; d) modifying the current query using at least part of the candidate expansion terms, resulting in a modified query having at least one modified search term, The method further comprises repeating steps b) to d) using the modified query as the current query, the repeating being performed until a predefined stopping criterion is fulfilled.

Query expansion in information retrieval systems

Original idea extraction from written data is provided by capturing expression as written text data, obtaining a knowledge graph representing concepts and relationships between the concepts automatically topic modeling the written text data to ascertain thought units and identify respective concepts of the thought unit, mapping a thought unit to the knowledge graph, determining that the thought unit is an original idea, and based on determining that the thought unit is an original idea, storing a representation of the original idea to an idea repository and invoking processing of at least one computer.

Original idea extraction from written text data

Computer-implemented methods and systems are provided for digitally signing predetermined arrays of digital data. Such a method may provide a secret neural network model trained to classify arrays of digital data in dependence on data content of the arrays. The array of the arrays may be signed by supplying the array to the secret neural network model to obtain an initial classification result; and effecting a modification of data in the array to change the initial classification result to a predetermined, secret classification result, the modification being effected via a backpropagation process in the secret neural network model to progressively modify the array in response to backpropagated errors dependent on a difference between a current classification result for the array and the secret classification result.

Signing and authentication of digital images and other data arrays

A computer-implemented method for generating a group of representative model cases for a trained machine learning model may be provided. The method comprising determining an input space, determining an initial plurality of model cases, and expanding the initial plurality of model cases by stepwise modifying field values of the records representing the initial plurality of model cases resulting in an exploration set of model cases. Additionally, the method comprises obtaining a model score value for each record of the exploration set of model cases, continuing the expansion of the exploration set of model cases thereby generating a refined model case set, and selecting the records in the refined model case set based on relative record distance values and related model score values between pairs of records, thereby generating the group of representative model cases.

Growing community of inventors

Zurich, Switzerland

Andrea Giovannini