Abstract: Methods and systems for performing a knowledge graph task include aligning multiple knowledge graphs and performing a knowledge graph task using the aligned multiple knowledge graphs. Aligning the multiple knowledge graphs includes updating entity representations based on representations of neighboring entities within each knowledge graph, updating entity representations based on representations of entities from different knowledge graphs, and learning machine learning model parameters to align the multiple knowledge graphs, based on the updated entity representations.

Abstract: An image detection method for determining positions of a user. According to the image detection method, a plurality of images of the user are obtained, whether the user moves is determined according to the images, a plurality of feature parameters of the plurality of images are obtained, and a body distribution analysis and a face occlusion analysis are performed to determine the position of the user.

Abstract: Methods and systems for detecting abnormal application behavior include determining a vector representation of a first syscall graph that is generated by a first application, the vector representation including a representation of a distribution of subgraphs of the first syscall graph. The vector representation of the first syscall graph is compared to one or more second syscall graphs that are generated by respective second applications to determine respective similarity scores. It is determined that the first application is behaving abnormally based on the similarity scores, and a security action is performed responsive to the determination that the first application is behaving abnormally.

Abstract: Methods and systems for allocating network resources responsive to network traffic include modeling spatial correlations between fine spatial granularity traffic and coarse spatial granularity traffic for different sites and regions to determine spatial feature vectors for one or more sites in a network. Temporal correlations at a fine spatial granularity are modeled across multiple temporal scales, based on the spatial feature vectors. Temporal correlations at a coarse spatial granularity are modeled across multiple temporal scales, based on the spatial feature vectors. A traffic flow prediction is determined for the one or more sites in the network, based on the temporal correlations at the fine spatial granularity and the temporal correlations at the coarse spatial granularity. Network resources are provisioned at the one or more sites in accordance with the traffic flow prediction.

Abstract: A method for implementing a recommendation system using an asymmetrically hierarchical network includes, for a user and an item corresponding to a user-item pair, aggregating, using asymmetrically designed sentence aggregators, respective ones of a set of item sentence embeddings and a set of user sentence embeddings to generate a set of item review embeddings based on first item attention weights and a set of user review embeddings based on first user attention weights, respectively, aggregating, using asymmetrically designed review aggregators, respective ones of the set of item review embeddings and the set of user review embeddings to generate an item embedding based on a second item attention weights and a user embedding based on second user attention weights, respectively, and predicting a rating of the user-item pair based on the item embedding and the user embedding.

Abstract: Methods and systems for detecting and responding to anomalous nodes in a network include inferring temporal factors, using a computer-implemented neural network, that represent changes in a network graph across time steps, with a temporal factor for each time step depending on a temporal factor for a previous time step. An invariant factor is inferred that represents information about the network graph that does not change across the time steps. The temporal factors and the invariant factor are combined into a combined temporal-invariant representation. It is determined that an unlabeled node is anomalous, based on the combined temporal-invariant representation. A security action is performed responsive to the determination that unlabeled node is anomalous.

Abstract: A heterogeneous log pattern editing recommendation system and computer-implemented method are provided. The system has a processor configured to identify, from heterogeneous logs, patterns including variable fields and constant fields. The processor is also configured to extract a category feature, a cardinality feature, and a before-after n-gram feature by tokenizing the variable fields in the identified patterns. The processor is additionally configured to generate target similarity scores between target fields to be potentially edited and other fields from among the variable fields in the heterogeneous logs using pattern editing operations based on the extracted category feature, the extracted cardinality feature, and the extracted before-after n-gram feature. The processor is further configured to recommend, to a user, log pattern edits for at least one of the target fields based on the target similarity scores between the target fields in the heterogeneous logs.

Abstract: A computer-implemented method for automatically analyzing log contents received via a network and detecting content-level anomalies is presented. The computer-implemented method includes building a statistical model based on contents of a set of training logs and detecting, based on the set of training logs, content-level anomalies for a set of testing logs. The method further includes maintaining an index and metadata, generating attributes for fields, editing model capability to incorporate user domain knowledge, detecting anomalies using field attributes, and improving anomaly quality by using user feedback.

Abstract: A method for employing a temporal context-aware question routing model (TCQR) in multiple granularities of temporal dynamics in community-based question answering (CQA) systems is presented. The method includes encoding answerers into temporal context-aware representations based on semantic and temporal information of questions, measuring answerers expertise in one or more of the questions as a coherence between the temporal context-aware representations of the answerers and encodings of the questions, modeling the temporal dynamics of answering behaviors of the answerers in different levels of time granularities by using multi-shift and multi-resolution extensions, and outputting answers of select answerers to a visualization device.

Abstract: A method for employing a differentiable ranking based graph sparsification (DRGS) network to use supervision signals from downstream tasks to guide graph sparsification is presented. The method includes, in a training phase, generating node representations by neighborhood aggregation operators, generating sparsified subgraphs by top-k neighbor sampling from a learned neighborhood ranking distribution, feeding the sparsified subgraphs to a task, generating a prediction, and collecting a prediction error to update parameters in the generating and feeding steps to minimize an error, and, in a testing phase, generating node representations by neighborhood aggregation operators related to testing data, generating sparsified subgraphs by top-k neighbor sampling from a learned neighborhood ranking distribution related to the testing data, feeding the sparsified subgraphs related to the testing data to a task, and outputting prediction results to a visualization device.

Abstract: Systems and methods for optimizing query execution to improve query processing by a computer are provided. A query is analyzed and translated into a logical plan. A runtime query optimizer is applied to the logical plan to identify a physical plan including operators for execution. The logical plan is translated into the physical plan. Execution of the query is scheduled according to the physical plan.

Abstract: Methods and systems for mitigating a spoofing-based attack include calculating a travel distance between a source Internet Protocol (IP) address and a target IP address from a received packet based on time-to-live information from the received packet. An expected travel distance between the source IP address and the target IP address is estimated based on a sparse set of known source/target distances. It is determined that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security action is performed responsive to the determination that the received packet has a spoofed source IP address.

Abstract: Systems and methods for system event searching based on heterogeneous logs are provided. A system can include a processor device operatively coupled to a memory device wherein the processor device is configured to mine a variety of log patterns from various of heterogeneous logs to obtain known-event log patterns and unknown-event log patterns, as well as to build a weighted vector representation of the log patterns. The processor device is also configured to evaluate a similarity between the vector representation of the unknown-event and known-event log patterns, identify a known event that is most similar to an unknown event to troubleshoot system faults based on past actions for similar events to improve an operation of a computer system.

Abstract: Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by the target network endpoint system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the target network endpoint system responsive to the determination that the received packet has a spoofed source IP address.

Abstract: A security system using automatic and scalable log pattern learning in security log analysis is provided. The security system includes one or more management services configured to generate security logs, and a security log analysis service operatively coupled to the one or more management services. The security log analysis service is configured to collect the security logs generated by the one or more management services, implement an incremental learning process to generate a set of log patterns from the collected security logs, parse the collected security logs using the set of log patterns, and analyze the parsed security logs for one or more security applications.

Abstract: A method for employing a supervised graph sparsification (SGS) network to use feedback from subsequent graph learning tasks to guide graph sparsification is presented. The method includes, in a training phase, generating sparsified subgraphs by edge sampling from input training graphs following a learned distribution, feeding the sparsified subgraphs to a prediction/classification component, collecting a predication/classification error, and updating parameters of the learned distribution based on a gradient derived from the predication/classification error. The method further includes, in a testing phase, generating sparsified subgraphs by edge sampling from input testing graphs following the learned distribution, feeding the sparsified subgraphs to the prediction/classification component, and outputting prediction/classification results to a visualization device.

Abstract: Systems and methods for predicting system device failure are provided. The method includes performing graph-based predictive maintenance (GBPM) to determine a trained ensemble classification model for detecting maintenance ready components that includes extracted node features and graph features. The method includes constructing, based on testing data and the trained ensemble classification model, an attributed temporal graph and the extracted node features and graph features. The method further includes concatenating the extracted node features and graph features. The method also includes determining, based on the trained ensemble classification model, a list of prediction results of components that are to be scheduled for component maintenance.

Abstract: Systems and methods for implementing sequence data based temporal behavior analysis (SDTBA) to extract features for characterizing temporal behavior of network traffic are provided. The method includes extracting communication and profile data associated with one or more devices to determine sequences of data associated with the devices. The method includes generating temporal features to model anomalous network traffic. The method also includes inputting, into an anomaly detection process for anomalous network traffic, the temporal features and the sequences of data associated with the devices and formulating a list of prediction results of anomalous network traffic associated with the devices.

Abstract: Systems and methods for predicting system device failure are provided. The method includes representing device failure related data associated with the devices from a predetermined domain by temporal graphs for each of the devices. The method also includes extracting vector representations based on temporal graph features from the temporal graphs that capture both temporal and structural correlation in the device failure related data. The method further includes predicting, based on the vector representations and device failure related metrics in the predetermined domain, one or more of the devices that is expected to fail within a predetermined time.

Abstract: Systems and methods for implementing dynamic graph analysis (DGA) to detect anomalous network traffic are provided. The method includes processing communications and profile data associated with multiple devices to determine dynamic graphs. The method includes generating features to model temporal behaviors of network traffic generated by the multiple devices based on the dynamic graphs. The method also includes formulating a list of prediction results for sources of the anomalous network traffic from the multiple devices based on the temporal behaviors.