Abstract: Data protection including malware response operations are disclosed. When a production system is attacked, the malware is allowed to run in a forensic environment in order to learn its operational characteristics. The forensic environment includes a working scenario that may be prepared in advance with false data that allows the malware to communicate with a malware host system. Once the operational characteristics are learned, a return malware can be placed in the data. The return malware is transmitted to a malware host system by the malware itself and executed.

Abstract: Automated research experimentation on malware is disclosed. When malware is detected, an infected backup is generated. The infected backup is deployed to multiple working environments as recovered production systems, starting from the same state. Different scenarios are performed on the recovered production systems to learn the operational characteristics of the malware operating in the recovered production systems. The insights may be used to protect against the malware and/or other malware.

Abstract: One method includes listening, by a storage vault, to a port that is specific to a particular data structure in the storage vault, determining that an air gap between the storage vault and an entity external to the storage vault, is closed, such that communication between the storage vault and the external entity, by way of the port, is enabled, signaling, by the storage vault to the external entity, that the air gap is closed, and receiving, at the storage vault by way of the port, data from the external entity.

Abstract: Methods and systems for identifying areas of interest in an image and management of images are disclosed. To manage identification of areas of interest in an image, subject matter expert driven processes may be used to identify the areas of interest. The identified areas of interest may be used to maintain a database usable to guide subsequent use of the images. The database may associate image segments of the images with various landmarks and/or area of interest. The associations may be used to limit the quantity of image segments read from storage during subsequent use of the images.

Abstract: Methods and systems for managing storage of data are provided. To manage storage of data, images may be stored along with data usable to facilitate subsequent interpretation of the images. The data may provide information to a subsequent interpreter regarding how a previous outcome was made using the image. The data may allow the subsequent interpreter to understand how the previous interpreter viewed portions of the image, the order in which the portion of the images were viewed by the previous interpreter, etc. The subsequent interpreter may be provided with context regarding landmarks or other features of the image added by the previous interpreter and identified by the previous interpreter as being relevant to the outcome.

Abstract: Methods and systems for obtaining synthesized images are disclosed. To obtain synthesized images, an imaging system may obtain areas of interest associated with an image. The areas of interest may be keyed to various processes and/or services. A downstream consumer of the services may retrieve the areas of interest to perform further analysis. In order to more easily interpret the areas of interest, the areas of interest may be displayed to the downstream consumer as part of a synthesized image. The synthesized image may include the areas of interest and a synthesized environment. The synthesized environment may be intended to emulate an environment in which the downstream consumer may expect to find the areas of interest. By doing so, the downstream consumer may be able to understand and contextualize the areas of interest more easily than if viewing the areas of interest alone.

Abstract: Methods and systems for identifying areas of interest in an image are disclosed. To manage identification of areas of interest in an image, a combination of automated and subject matter expert driven processes may be used to identify the areas of interest. Some areas of interest may be highly relevant for a user of an image and may be classified as primary areas of interest. The image and subsequent use of the image may be enhanced through the areas of interest by improving storage and downstream usability of the image.

Abstract: Methods and systems for operating biosystem on a chip are disclosed. To operate biosystem on a chip based systems, causal mechanisms may be identified based on previous operations performed by the biosystem chip based systems. The causal mechanisms may be used to develop new operation plans, refine existing operation plans, and/or develop new biosystem on a chip architecture. The causal mechanism may be derived from a causal graph that includes nodes representing unknown causal mechanisms. Data regarding previous operations in combination with the causal graph may be used to learn the unknown causal mechanisms.

Abstract: Methods and systems for identifying areas of interest in an image are disclosed. To manage identification of areas of interest in an image, a trained inference model may generate inferences based on the pixels of the image. The inferences may include areas of interest that contributed to the generation of the inferences. Some areas of interest may be highly relevant to the inferences and may be classified as primary areas of interest. Auxiliary areas of interest may also be identified using a trained inference model. Auxiliary areas of interest may be obtained by calculating gradients for each pixel that contributed to the identification of the primary areas of interest. By rank ordering the pixels, pixels with the highest contribution to the identification of the primary areas of interest may be identified. Proximate groupings of these pixels may be classified as auxiliary areas of interest in the image.

Abstract: Methods and systems for storing and managing biosystem on a chip data disclosed. To store the data, operation data from the biosystem on a chip may be stored in a database. To manage use of the stored data, a graph representation of the biosystem on a chip. The nodes of the graph representation may correspond to the architectural features of the biosystem on a chip. The edges between the nodes may be based on whether the corresponding architectural features are in communication with one another. Each of the nodes may be associated with pointers that point to portions of the operation data in the database that is relevant to the architecture feature associated with the respective node.

Abstract: Methods and systems for identifying areas of interest in an image and management of images are disclosed. To manage identification of areas of interest in an image, subject matter expert driven processes may be used to identify the areas of interest. The identified areas of interest may be used to maintain a database usable to guide subsequent use of the images. The database may associate image segments of the images with various landmarks and/or area of interest. The associations may be used to limit the quantity of image segments read from storage during subsequent use of the images.

Abstract: Methods and systems for identifying areas of interest in an image and management of images are disclosed. To manage identification of areas of interest in an image, subject matter expert driven processes may be used to identify the areas of interest. The identified areas of interest may be used to establish plans to guide subsequent use of the image. The identified areas of interest may also be used to establish plans to cache portions of the image to speed subsequent use of the image.

Abstract: Methods and systems for operating biosystem on a chip are disclosed. To operate biosystem on a chip based systems, likely faults in the operation of the system may be predicted. Algorithms usable to mitigate the predicted likely faults may be identified, and ranked based on a level of impact that access to data reelecting the operation of the system may have on the utility of the algorithms. Higher ranked algorithms may be deployed for execution during operation of the system to lower latency locations while lower ranked algorithms may be deployed for execution to higher latency locations. The lower latency locations may include computing resources that are local to the biosystem on a chip, but that may be limited in quantity.

Abstract: Methods and systems for managing storage of data are disclosed. To manage storage of data, images may be stored across a number of storages that provide varying levels of storage performance and have correspondingly varying costs for storing data. To store the images across the storages, the images may be segmented into image segments and a likelihood of each of the image segments being used in the future may be identified. The image segments that are more likely to be used in the future may be stored in higher performance storages while the image segments that are less likely to be used in the future may be stored in lower performance storages. To identify the likelihood of each of the image segments being used in the future, the image segments may be classified based on their membership in one or more areas of interest within the images.

Abstract: Techniques are provided for automated query modification using graphical query representations. One method comprises obtaining a query referencing multiple fields in one or more information elements; generating a graph of the query by: establishing nodes for referenced fields; connecting the established nodes corresponding to referenced fields from a same information element using one or more edges; adding edges, for operations in the query that establish a connection between information elements based at least in part on a related field in the information elements, to connect the nodes corresponding to the related fields; and setting a status of nodes corresponding to fields that are selected in the query to a selected status; and initiating an automatic generation of a modification of a portion of the query based at least in part on the graph. The modification may comprise a correction, completion and/or enrichment of the query.

Abstract: Techniques are provided for reinforcement learning-based evaluation of software product usage. One method comprises obtaining key performance indicators indicating software product usage by a user; determining, for a predefined time window: (i) a mean and/or a median of the obtained KPIs; (ii) an amount of time that the software product was active; and (iii) an amount of interactions by the user with a user interface; evaluating possible login states of the software product using at least one reinforcement learning agent, wherein the evaluating comprises (a) observing the plurality of possible login states, including a current state comprising a current login state of the software product, and (b) obtaining an expected utility score for changing from the current login state to a different login state of the software product; and determining whether to change from the current login state to a different login state of the software product based on the expected utility score.

Abstract: An information handling system may receive a plurality of rules and a file for malware testing. The information handling system may apply two or more of the plurality of rules to the received file to determine a plurality of outcomes of application of the rules to the file. The information handling system may determine whether to classify the received file as malware or not malware by applying a machine learning model to the plurality of outcomes.

Abstract: Techniques are provided for estimating a delivery time for a product in a supply chain. One method comprises obtaining an order for at least one product; calculating a similarity-based feature and/or a proximity-based feature for the order; and applying the calculated similarity-based feature and/or the calculated proximity-based feature for the order to a machine learning engine that generates an estimated delivery time for the order, wherein the machine learning engine is trained using characteristics from historical orders. The similarity-based feature for the order can be calculated using a delivery time value of historical orders in a given order cluster where the order was assigned based on a predefined distance metric between the order and features of each order cluster. The proximity-based feature for the order can be calculated using a delivery time value of the historical orders that satisfy one or more predefined recency criteria.

Abstract: Techniques are provided for software code refactoring prioritization using software code defect aggregation in a graphical code representation. One method comprises obtaining an indication of an error in software code; obtaining a graphical representation of the software code, wherein each node in the graphical representation corresponds to a function and wherein nodes are connected based on a hierarchical relationship; assigning a weight to a first node that corresponds to a function associated with the error; assigning a decayed weight to an additional node, selected based on the hierarchical relationship with the first node, wherein the decayed weight is determined by applying a decay function to the weight assigned to the first node; prioritizing nodes in the graphical representation for a code refactoring of the software code based on the weights assigned to each node; and initiating an automated action based on a result of the prioritizing.

Abstract: A system can train an artificial intelligence risk model to produce a trained model, wherein labeled training data for the training comprises respective features of users and products, and corresponding labels of respective support costs, wherein the trained model comprises a causal tree model that is configured to differentiate between first features that are immutable to an entity that utilizes the trained model and second features that are mutable to the entity. The system can, in response to applying a input to the trained model, wherein the input comprises a feature of a user and a product, produce an output that indicates a predicted support cost that corresponds to the input.