International Business Machines Corporation

Business Machines Corporation

Ying-Chen Yu

June-Ray Lin

Chih-Wen Su

Ci-Hao Wu

Li-Ju Chen

Jeff Hsueh-Chang Kuo

Hui Wang

Jia Wei Zhou

Ming Qiao Shang Guan

Jeff H C Kuo

Pao-Chuan Liao

Hsieh-Lung Yang

Kuei-Ching Lee

Jacqueline Li-Ling Yen

Chen-Yu Huang

Kai Yao Cao

Yi-Chun Tsai

Wendy Ping Wen Wang

Yu-Siang Chen

Chia-Heng Lin

Po Ya Chuang

Po-cheng Chiu

Wai Man Lee

Tzu-Ching Kuo

Chao-Min Chang

Sheng-Wei Lee

Meng Li Wong

Shen-Jai S J Liao

Richard Y F Tsai

Curtis C H Wei

Pei-Hua Su

Curtis Ch Wei

Raymund June-Ray Lin

Yi-Hsin Cheng

Ming Tung Lau

A method, computer system, and a computer program product for smart SDN is provided. The present invention may include recording and clustering a pod's behavior to generate a behavior transition model for the pod. The present invention may include watching a behavior of the pod and comparing the behavior to the generated behavior transition model. The present invention may include triggering a network policy change based on determining that the behavior of the pod is a misbehavior.

Smart SDN for intrusion prevention

A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Automated identification of malware families based on shared evidences

An approach to workflow management in response to a detected security incident in a computer system. The approach may include an inference driven response based on prior artifacts. The inference driven response may predict the condition of the system and the outcomes of actions in response to the security incident. The predictions made by the inference drive response may be based on a machine learning model. The inference driven response may pause or prevent scheduled actions of the system based on the predictions. The inference driven response may continue to monitor the system and dynamically update its predictions for the condition of the system. In response to the updated predictions, the inference driven response may cancel or execute the previously scheduled actions of the system.

Reasoning based workflow management

A computer-implemented method for automatically adjusting a Uniform Resource Locator (URL) seed list. The method includes crawling for documents based on a seed URL list. The method generates relations data from the documents using a Natural Language Processing (NLP) model. The method analyzes the relations data using an auto-seed model. The method modifies the seed URL list.

Auto seed: an automatic crawler seeds adaptation mechanism

In an approach location allocation planning, one or more computing units determine at least one location matching model for a first current participating entity of a plurality of current participating entities of a current event, wherein an output of the location matching model indicates a matching degree between the first current participating entity and a current event location. The one or more computing units create at least one initial location allocation plan for the plurality of current participating entities of the event based, at least in part, on the at least one location matching model. The one or more computing units receive feedback from at least one of the plurality of current participating entities. Responsive to the feedback indicating acceptance of the initial location allocation plan, the one or more computing units determine a final location allocation plan based on the initial location allocation plan.

Location allocation planning

One or more processors track internet usage of a user. The tracking includes tracking a first user input into one or more websites using a keylogging subprogram. One or more processors analyze the first user input. Analyzing the first user input includes using machine learning to gain knowledge of one or more interests of the first user based on the first user input. One or more processors determine a proximity of the first user to at least one point of interest within a first threshold distance of the first user while the first user is mobile, match at least one interest of the one or more interests of the first user with one or more interests associated with the at least one point of interest, and provide a notification that the first user is within the first threshold distance of the at least one point of interest.

Notification of proximal points of interest

A first natural language document is received. The document includes unstructured data and a first table structure that includes a plurality of first table entries. The first table structure is identified based on the document. The first table structure is extracted from the document in response to the identifying. A first machine learning output is generated based on a first machine learning model and from the document. A second machine learning output is generated based on a second machine learning model and from the first table structure. The first output of the document and the second output of the first table structure are combined.

Machine learning on mixed data documents

Embodiments of the present invention are directed to a computer-implemented method for identifying advertisements in a video. The method includes obtaining a plurality of copies of the video and processing each of the plurality of copies of the video, wherein the processing identifies a plurality of iframes in each of the plurality of copies of the video. The method also includes comparing the plurality of iframes of each of the plurality of copies of the video. The method further includes identifying one or more common portions of each of the plurality of copies of the video one or more advertisement in the video, based on the comparison.

Identifying advertisements embedded in videos

A method, computer program product, and computer system for receiving, by a computing device, one or more user preferences for a video clip. The one or more user preferences may be matched with one or more branches of the video clip, wherein each of the one or more branches may include one or more segments of the video clip. The one or more segments of the video clip may be selected from the one or more branches based upon, at least in part, matching the one or more user preferences with the one or more branches of the video clip. The video clip may be composed based upon, at least in part, the one or more user preferences.

System and method for adaptive video

Provided are systems, methods, and media for multiphase graph partitioning for malware entity detection. An example method includes receiving an input string associated with the malware entity. A determination is made as to whether the input string includes a symbolic word, a non-symbolic word, a symbolic phrase, or a non-symbolic phrase. A branching graph is formed based on a combination of the input string and a plurality of stored strings that are each associated with the malware entity to determine whether the input string is a valid detection name of the malware entity, in which the branching graph is formed by at least performing a first graph partitioning stage and a second graph partitioning stage. The input string is then labeled based on the formed branching graph and then outputted to a malware detection engine.

Multiple phase graph partitioning for malware entity detection

In various embodiments, a computer-implemented method includes identifying data files in external storage, where the data files correspond to a computer software application (application) on a mobile device. The method may also include sorting the one or more data files into different access levels. The method may also include predicting the sorted one or more data files that will be accessed on the mobile device using a prediction engine. The method may also include locating the predicted one or more data files in the external storage using a migration map. The method may also include determining whether the predicted one or more data files were previously migrated to the external storage from the mobile device. The method may also include migrating the predicted one or more data files from the external storage to the mobile device.

Data migration for applications on a mobile device

Methods, systems and computer program products for flagging abnormal videos are provided. Aspects include training an image recognition model based on a plurality of images that depict one or more of a plurality of subjects. Aspects also include generating a normal subject relationship graph representing normal relationships between the plurality of subjects by applying the image recognition model to a plurality of training videos and a test subject relationship graph representing test relationships between subjects depicted in a test video by applying the image recognition model to the test video. Each normal relationship is associated with a strength value. Responsive to determining that a difference between a strength value associated with a first normal relationship and a strength value associated with a corresponding first test relationship exceeds a predetermined threshold, aspects include flagging the test video as being abnormal.

Abnormal video filtering

A method, computer system, and a computer program product for crawling and extracting main content from a web page is provided. The present invention may include retrieving a HTML document associated with a web page. The present invention may then include identifying at least one entry point located in the retrieved HTML document by utilizing a self-adaptive entry point locator. The present invention may also include extracting a main content article associated with the retrieved HTML document based on the identified at least one entry point. The present invention may further include presenting the extracted main content associated with the retrieved HTML document to the user.

Self-adaptive web crawling and text extraction

A method, computer program product, and computing system device for receiving, on a computing device, a plurality of webpages. At least one webpage may be filtered from the plurality of webpages into at least one set of webpages using a decision tree algorithm. At least one remaining webpage may be filtered from the plurality of webpages into the at least one set of webpages using a supported vector machine (SVM) algorithm.

Growing community of inventors

Taipei, Taiwan

Ying-Chen Yu