Abstract: Embodiments related to using a foundational model for network packet traces. A technique includes receiving network traffic of a network and extracting features from the network traffic, the features having a function related to communications in the network. The technique includes generating tokens from the features, each of the features corresponding to a respective one of the tokens, training a machine learning model by inputting the tokens, the machine learning model being trained to output contextual embeddings for the tokens, and using the contextual embeddings to determine an anomaly in the network traffic.

Abstract: An embodiment includes detecting a set of anomalies recorded during a first predefined window of time in log entries for a computer environment. The embodiment also includes generating cluster data representative of a cluster of anomalies from among the set of anomalies, where the cluster is formed using a lattice clustering algorithm that spatially distinguishes the cluster of anomalies from other anomalies in the set of anomalies. The embodiment also includes composing an explanation using log templates generated from log entries associated with the cluster of anomalies.

Abstract: A method for determining a correlation of one or more events occurring in a plurality of nodes of a network includes accessing, by a computing device, address information associated with each of the plurality of nodes on the network. The computing device can further access one or more event IDs associated with one or more events occurring on the plurality of nodes. The computing device can further create an association the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information.

Abstract: A computer implemented method performs data skipping in a hierarchically organized computing system. A group of processor units determines leaf node data sketches for data in leaf nodes in the hierarchically organized computing system. The leaf node data sketches summarize attributes of data in the leaf nodes. The group of processor units aggregates the leaf node data sketches at intermediate nodes in the hierarchically organized computing system to form aggregated data sketches at the intermediate nodes and retains data sketches received at the intermediate nodes from a group of child nodes to form retained data sketches. The retained data sketches are one of leaf node data sketches and the aggregated data sketches. The group of processor units searches the data using the retained data sketches and the data skipping within the hierarchically organized computing system in response to queries made to the intermediate nodes in the hierarchically organized computing system.

Abstract: A computer implemented method performs data skipping in a hierarchically organized computing system. A group of processor units determines leaf node data sketches for data in leaf nodes in the hierarchically organized computing system. The leaf node data sketches summarize attributes of data in the leaf nodes. The group of processor units aggregates the leaf node data sketches at intermediate nodes in the hierarchically organized computing system to form aggregated data sketches at the intermediate nodes and retains data sketches received at the intermediate nodes from a group of child nodes to form retained data sketches. The retained data sketches are one of leaf node data sketches and the aggregated data sketches. The group of processor units searches the data using the retained data sketches and the data skipping within the hierarchically organized computing system in response to queries made to the intermediate nodes in the hierarchically organized computing system.

Abstract: Systems, methods and/or computer program products for controlling and visualizing topic modeling results using a topic modeling interface. The interface allows user directed exploration, understanding and control of topic modeling algorithms, while offering both semantic summaries and/or structure attribute explanations about results. Explanations and differentiations between results are presented using metrics such as cohesiveness and visual displays depicting hierarchical organization. Through user-manipulation of features of the interface, iterative changes are implemented through user-feedback, adjusting parameters, broadening or narrowing topic results, and/or reorganizing topics by splitting or merging topics. As users trigger visual changes to results being displayed, users can compare and contrast output from the topic modeling algorithm.

Abstract: A computer-implemented method and a computer system establish network slices within a physical network having a plurality of network elements. The method includes receiving a request to instantiate a network slice at a network element. The method also includes determining a performance metric of the network element. The method further includes delaying instantiation of the requested network slice within the network element in response to determining that the performance metric of the network element is below a threshold. The method also includes instantiating the requested network slice within the network element in response to determining that the performance metric of the network element is at or above the threshold. Finally, the method includes deactivating the requested network slice in response to determining that the performance metric of the network element is below the threshold at a time subsequent to instantiating the requested network slice.

Abstract: A computer-implemented method, a computer program product, and a computer system for supervised anomaly detection in federated learning. A server in a federated learning system generates a training dataset including malicious data samples and benign data samples. The server trains update-generating models on the malicious data samples and the benign data samples in the training dataset. The server generates benign model updates and malicious model updates, through training the update-generating models. The server trains an anomaly detector on the malicious model updates and the benign model updates. The server deploys the anomaly detector to the federated learning system, for supervised anomaly detection in the federated learning system.

Abstract: A computer-implemented method, a computer system and a computer program product provide differentiated services to spectrum zones based on user activity. The method includes obtaining a current spectrum zone configuration for a physical environment from a server. The method also includes capturing activity data from the physical environment. The method further includes identifying an event of interest in the activity data, wherein the event of interest comprises network requirements. The method also includes determining that the network requirements of the event of interest are not satisfied by the current spectrum zone configuration for the physical environment. Lastly, the method includes modifying the current spectrum zone configuration based on the network requirements.

Abstract: A method, computer system, and a computer program product managing data usage integrity is provided. In one embodiment, the method comprises receiving data connected with data usage of at least one user in a computer environment. The pricing information is then for the user relating to the data usage. The computer embodiment is segmented into a plurality of segment areas and a payment price is calculated for each segment area. An anomaly is detected by comparing the data usage and the associated pricing for each of segmented areas according to a preselected value. If an anomaly is selected, an end-to-end simulation check is performed for the computer environment to ascertain whether the payment price for the segment may be inconsistent with a resource usage affecting an end-to-end flow for the computer environment.

Abstract: A computer-implemented method, a computer system and a computer program product route meeting sessions through a venue based on device availability. The method includes identifying a plurality of sessions in a venue network, where each session in the plurality of sessions comprises session data that is associated with a network slice. The network slice includes connection requirements. The method also includes receiving a connection request from a user, where the connection request includes a session in the plurality of sessions. The method further includes determining an available device to receive the session data, where the available device satisfies the connection requirements of the network slice. Lastly, the method includes associating the available device with the network slice, where the session data is transmitted to the available device.

Abstract: A first classification is received from a neural network regarding a training dataset sent to the neural network. A modified training dataset with a perturbation of the training dataset is identified, where this modified training dataset causes the neural network to return a second classification. The perturbation is analyzed to identify a negative rule of the neural network.

Abstract: Embodiments are disclosed for a method for a wearable secure data device. The method includes setting an operational mode for the wearable secure data device that stores a plurality of secure data items. The method also includes receiving a request for at least one of the secure data items from a client device that is communicating with a third-party device. Additionally, the method includes determining if the operational mode is associated with allowing access to the secure data items. Further, the method includes providing a response based on the determination.

Abstract: Disclosed are methods method, systems, and computer program products for automatic management of a data processing system (DPS). One embodiment of the method may comprise receiving, at a computer processor, operations data associated with a DPS; and generating, by a Question-Answer (QA) system executing on the computer processor, a Question sentence from the operations data. The method may further comprise sampling a window of the operations data, extracting a plurality of key performance indicators (KPI) from the operations data in the sampled window, and providing the plurality of KPI to the QA system.

Abstract: An output time-series of a cell of a neural network is captured. A subset of a set of data points of the output time-series is consolidated into a singular data point. The singular data point is fitted in a data representation to form a quantified aggregated data point. The quantified aggregated data point is included in an intermediate time-series. Using the intermediate time-series as an input at an intermediate layer of the neural network, an anonymized output time-series is produced from the neural network.

Abstract: Aspects of the invention include receiving, by a processor, airspace data associated with a predefined airspace, obtaining roadway data associated with the predefined airspace, determining a set of air travel channels within the predefined airspace based on the roadway data, defining a set of travel lanes within the set of air travel channels, wherein each travel lane in the set of travel lanes comprises an altitude range, receiving unmanned aircraft (UA) data associated with a set of UAs within the predefined airspace, wherein the UA data comprises one or more flight paths for each UA in the set of UAs, and assigning each UA in the set of UAs to a travel lane in the set of travel lanes based on the one or more flight paths.

Abstract: Systems, methods and/or computer program products for controlling and visualizing topic modeling results using a topic modeling interface. The interface allows user directed exploration, understanding and control of topic modeling algorithms, while offering both semantic summaries and/or structure attribute explanations about results. Explanations and differentiations between results are presented using metrics such as cohesiveness and visual displays depicting hierarchical organization. Through user-manipulation of features of the interface, iterative changes are implemented through user-feedback, adjusting parameters, broadening or narrowing topic results, and/or reorganizing topics by splitting or merging topics. As users trigger visual changes to results being displayed, users can compare and contrast output from the topic modeling algorithm.

Abstract: An approach for end-to-end anomaly detection and anomalous patterns identification is disclosed. The approach leverages the use of a GMM-LASSO (a selection operator-type, Lasso-type, generalized method of moments (GMM) estimator) algorithm and proposes a feedback loop where the window (i.e., anomalous window) is detected and then it is used to detect the anomalous patterns. For example, the approach can classify one or more sequential data; generates one or more vectors based on the one or more sequential data; clusters the one or more vectors into one or more clusters; determines a membership of the one or more vectors associated with the one or more clusters; updates the one or more clusters; and optimizes the one or more clusters with respect to a predefined threshold.

Abstract: Aspects of the present disclosure relate to identifying friction points in customer data. In some embodiments, identifying friction points can include receiving a set of input sequence data and predicted class labels for the set of input sequence data; selecting input sequences, from the set of input sequence data, that have class labels matching a ground truth class label; reducing the selected sequences to anchor points; and grouping the reduced selected sequences into critical data set signatures using discriminatory subsequence mining.

Abstract: A computer-implemented method, a computer program product, and a computer system for resource-limited federated learning using dynamic masking. A server in federated machine learning evaluates resources of respective agents in the federated machine learning to determine capacities of model training by the respective agents. The server masks weights of a full machine learning model to construct a masked machine learning model, based on the capacities. The server distributes the masked machine learning model to the respective agents which train the masked machine learning model. The server receives from the respective agents updated weights obtained through training the masked machine learning model. The server updates the full machine learning model, based on the updated weights.