International Business Machines Corporation

Long H Vu

Venkata Nagaraju Pavuluri

Yuan-Chi Chang

Deepak Srinivas Turaga

Saket Sathe

Timothy Rea Dinger

Srinivasan Parthasarathy

Gregory Bramble

Lingtao Cao

Jing James Xu

Chuang Gan

Bei Chen

Theodoros Salonidis

Dakuo Wang

Jun Song Wang

Si Er Han

Ji Hui Yang

Peter Daniel Kirchner

Horst Cornelius Samulowitz

Dhavalkumar C Patel

Syed Yousaf Shah

Xuan-Hong Dang

Udayan Khurana

Nagui Halim

Daby Mousse Sow

Thanh Lam Hoang

Jing Gao

Dharmashankar Subramanian

Alain E Biem

Arunima Chaudhary

Abel Nicolas Valente

Debarun Bhattacharjya

Daniel Karl I Weidele

John Dillon Eversman

Voranouth Supadulya

Rodrigue Ngueyep Tzoumpe

Houping Xiao

Computer hardware and/or software that performs the following operations: (i) assessing a performance of a plurality of unsupervised machine learning pipelines against a plurality of data sets; (ii) associating the performance with meta-features corresponding to respective pipeline/data set combinations; (iii) training a supervised meta-learning model using the associated performance and meta-features as training data; and (iv) utilizing the trained model to identify one or more pipelines for processing an input data set.

Automated unsupervised machine learning utilizing meta-learning

A method, a structure, and a computer system for predicting pipeline training requirements. The exemplary embodiments may include receiving one or more worker node features from one or more worker nodes, extracting one or more pipeline features from one or more pipelines to be trained, and extracting one or more dataset features from one or more datasets used to train the one or more pipelines. The exemplary embodiments may further include predicting an amount of one or more resources required for each of the one or more worker nodes to train the one or more pipelines using the one or more datasets based on one or more models that correlate the one or more worker node features, one or more pipeline features, and one or more dataset features with the one or more resources. Lastly, the exemplary embodiments may include identifying a worker node requiring a least amount of the one or more resources of the one or more worker nodes for training the one or more pipelines.

Distributed resource-aware training of machine learning pipelines

Systems, computer-implemented methods, and computer program products to facilitate visualization of a model selection process are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise an interaction backend handler component that obtains one or more assessment metrics of a model pipeline candidate. The computer executable components can further comprise a visualization render component that renders a progress visualization of the model pipeline candidate based on the one or more assessment metrics.

Visualization of a model selection process in an automated model selection system

Techniques regarding one or more automated machine learning processes that analyze time series data are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise a time series analysis component that selects a machine learning pipeline for meta transfer learning on time series data by sequentially allocating subsets of training data from the time series data amongst a plurality of machine learning pipeline candidates.

Automated machine learning pipeline generation

In an approach to unsupervised feature learning for relational data, a computer trains one or more entity aware autoencoders on one or more tables in a relational database, where each of the one or more entity aware autoencoders corresponds to one of the one or more tables in the relational database, and where each of the one or more entity aware autoencoders are comprised of an encoder and a decoder. A computer transforms each of the one or more tables in the relational database with the encoder of the corresponding trained entity aware autoencoder. A computer joins a first transformed table of the one or more tables in the relational database with each remaining one or more transformed tables in the relational database to form one or more joined tables. A computer aggregates the one or more joined tables. A computer outputs one or more feature representations.

Unsupervised feature learning for relational data

A mechanism is provided for implementing a model update mechanism to update new models in real time while avoiding data loss and system downtime. Responsive to receiving a request to update a scorer model currently being executed by an existing worker thread in the data processing system, the model update mechanism initializing a new worker thread. The model update mechanism loads an updated scorer model into the new worker thread and initializes a state transfer from the existing worker thread to the new worker thread. The model update mechanism executes the updated scorer model such that the updated scorer model scores the input data. The model update mechanism then outputs a prediction based on the updated scorer model processing of the input data.

Data loss machine learning model update

Mechanism are provided to select a machine learning model from an analytics model library based on ingested data. One or more pieces of clarified data are fused to provide time-correlated data tuples of data streams. One or more features are extracted from the time-correlated data tuples and scored based on a set of predetermined rules thereby generating discriminative scoring of trigger data. Utilizing the discriminative scoring of the trigger data, trigger data of a current analytics model being utilized by the data processing and one or more new analytics models from the analytics model library are scored. Responsive to the scoring of the trigger data indicating a selection of a different analytics model from the analytics model library, the current analytics model is replaced with a selected analytics model from the analytics model library such that the data processing system executes the selected analytics model.

Context driven model selection

Split an input dataset into training and test datasets; the former includes a plurality of data examples, each represented as a feature vector, and having an associated true label. Split the training dataset into a plurality of training data subsets; for each, train a corresponding machine learning model to obtain a plurality of such models, and apply same to the test dataset to obtain a plurality of predicted labels and prediction scores. For each of the plurality of examples, compute an agreement metric based on a corresponding one of the associated true labels; corresponding ones of the predicted labels; and corresponding ones of the prediction scores. Based on the computed metric, select, for at least some of the true label values, appropriate ones of the data examples to be added to a regression set. Add the appropriate ones of the data examples from the test dataset to the regression set.

Automated data and label creation for supervised machine learning regression testing

A method, computer program product, and/or computer system improves a future efficiency of a specific system. One or more processors receive multiple historical data snapshots that describe past operational states of a specific system. The processor(s) identify a time series pattern for the time series of data in the multiple historical snapshots and calculate their variability. The processor(s) then determine that the variability in a first sub-set of the time series pattern is larger than a predefined value, and determine that future values of the first set of the time series pattern are a set of non-forecastable future values. The processor(s) also determine that the variability in a second sub-set of the time series pattern for the data is smaller than the predefined value, and utilizes this second sub-set to modify the specific system at a current time.

Modifying a particular physical system according to future operational states

A mechanism is provided to identify wall-clock time reference dependency in one or more software components of a data analytics solution. The data analytics solution is decomposed into a set of software components. A first software component of the set of software components is deployed to a first computer server and the remaining software components are deployed to a second computer server. A system clock time on the first computer server is changed to differ from the system clock of the second computer server. Based on executing a test on the data analytics solution, a determination is made of whether the first software component, is wall-clock time independent. Responsive to the test of the of the software component failing indicating that the wall-clock time of the software component is dependent of the system clock time difference, the software component is recorded as wall-clock time dependent and an administrator is notified.

Testing and modifying calendar and event sensitive timer series data analytics

For a plurality of hosts, observe first time-varying characteristics including network throughput, central processing unit (CPU) usage, and/or memory usage; second time-varying characteristics including software configuration; and time-invariant characteristics including hardware configuration, at a plurality of timestamps. Construct a restricted HMM configured to predict actual host states, wherein the first time-varying characteristics include observed variables. The current observed variables depend on current values of the hidden variables and prior timestamp distribution of the observed variables. The former in turn depend on prior timestamp values of the hidden variables, the time-invariant characteristics of the hosts. and current timestamp values of the second time-varying characteristics. Estimate parameters of the restricted HMM; run the restricted HMM with the estimated parameters for each of the hosts; analyze the results to identify at least one of the hosts which has a potential cybersecurity issue; and take at least one remedial action.

Predicting condition of a host for cybersecurity applications

Embodiments relate to analyzing dataset. A method of analyzing data is provided. The method obtains a description of a dataset. The method automatically generates a plurality of analysis options from the description of the dataset. The method generates a plurality of queries based on the analysis options. The method deploys the queries on the dataset to build a plurality of statistical models from the dataset.

Automatic enumeration of data analysis options and rapid analysis of statistical models

A network security apparatus includes a packet detector detecting transmission of data packets between a plurality of hosts and a plurality of domains and defining a plurality of links therefrom. A model builder circuit receives the plurality of links from the packet detector, receives ground truth information labeling one or more of the plurality of hosts or one or more of the plurality of domains as benign or malicious, generates predictive models from the received links and ground truth information, and stores generated predictive models in a predictive model database. An anomaly detector circuit retrieves the generated predictive models from the predictive model database and uses the predictive models to label each of the plurality of hosts and plurality of domains, that have not previously been labeled by the ground truth information, as benign or malicious.

Network security apparatus and method of detecting malicious behavior in computer networks via cost-sensitive and connectivity constrained classification

A method for performing assisted knowledge discovery includes receiving a dataset. Each of a plurality of analytical techniques is applied to the received data set to generate a plurality of corresponding analytical results. A composite validation metric is applied to each of the plurality of analytical results. The composite validation metric is a single scoring/ranking function that is created from a plurality of different scoring/ranking functions. The plurality of analytical results is presented to a user arranged in accordance with the results of the applying the composite validation metric to each of the plurality of analytical results. A selection from the user from among the plurality of analytical results is recorded. The user's selection is used to modify the composite validation metric such that the analytical techniques responsible for generating the selected analytical result is scored/ranked more highly.

Growing community of inventors

Yorktown Heights, NY, United States of America

Long H Vu