Abstract: Explanatory dropout systems and methods for improving a computer implemented machine learning model are provided using on-manifold/on-distribution evaluation of dropout of key features to explain model outputs. The machine learning model is trained using a plurality of input examples, including input records with explicit dropout operators applied effectuating the removal of influence of features associated with an explanation reason class. One or more dropout operators may be stochastically applied to one or more input examples. The procedure includes on-manifold/on-distribution evaluation of the machine learning model under conditions of absence or presence of the one or more dropout operators for reliable calculation of numerical statistics associated with reason classes to yield model explanations. The training and evaluation procedures present advantages over traditional off-manifold or off-distribution perturbative explanation procedures.

Abstract: Techniques are disclosed for an integrated circuit including a ferroelectric gate stack including a ferroelectric layer, an interfacial oxide layer, and a gate electrode. The ferroelectric layer can be voltage activated to switch between two ferroelectric states. Employing such a ferroelectric layer provides a reduction in leakage current in an off-state and provides an increase in charge in an on-state. The interfacial oxide layer can be formed between the ferroelectric layer and the gate electrode. Alternatively, the ferroelectric layer can be formed between the interfacial oxide layer and the gate electrode.

Abstract: Computer-implemented method and systems to improve training and performance of artificial intelligence (AI) systems having one or more machine learning models stored in one or more data storage mediums connected in at least one computing network is provided. The method comprises receiving student machine scores, generated by a student machine learning model stored in a data storage medium, the student machine learning model having a primary loss function; receiving teacher scores provided by one or more analytic resources, the teacher scores being provided based on known results and behavior of pre-existing machine learning models used for accomplishing a first series of classification objectives; transforming the teacher scores into transformed teacher scores.

Abstract: A predictive estimator, trained on a data corpus, is used to generate a probability estimate based a sequence of data related to an entity. The predictive estimator computes an instantaneous surprise score which is a quantification of a short-term deviation of a datum from the probability estimate. To compute the instantaneous surprise score, the predictive estimator is initialized with default values of the predictive estimator. Then, for each of data input of the datum to the predictive estimator, the instantaneous surprise score is calculated, corresponding to the deviation of the data input from the probability estimate. This generates an estimate of the probability of observing the datum given past data on the entity and the predictive estimator. The predictive estimator is updated with the datum and the time step advanced.

Abstract: A predictive estimator, trained on a data corpus, is used to generate a probability estimate based a sequence of data related to an entity. The predictive estimator computes an instantaneous surprise score which is a quantification of a short-term deviation of a datum from the probability estimate. To compute the instantaneous surprise score, the predictive estimator is initialized with default values of the predictive estimator. Then, for each of data input of the datum to the predictive estimator, the instantaneous surprise score is calculated, corresponding to the deviation of the data input from the probability estimate. This generates an estimate of the probability of observing the datum given past data on the entity and the predictive estimator. The predictive estimator is updated with the datum and the time step advanced.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.