Abstract: A method of evaluating alerts generated by security agents installed in endpoints includes: receiving a locality-sensitive hash (LSH) value associated with an alert generated by a security agent installed in one of the endpoints; performing a search for centroids that are within a threshold distance from the received LSH value, wherein the centroids are each an LSH value that is representative of one of a plurality of groups of alerts; and assigning a security risk indicator to the alert associated with the received LSH value based on results of the search and transmitting the security risk indicator to a security analytics platform of the endpoints.

Abstract: A method of scoring alerts generated by a plurality of endpoints includes the steps of: in response to a new alert generated by a first endpoint of the plurality of endpoints, generating an anomaly score of the new alert; identifying a rule that triggered the new alert and determining a threat score associated with the rule; and generating a security risk score for the new alert based on the anomaly score and the threat score and transmitting the security risk score to a security analytics platform of the endpoints.

Abstract: Systems and methods are described for employing event context to improve threat detection. Systems and methods of embodiments of the disclosure measure both process deviation and path deviation to determine whether processes are benign or represent threats. Both a process deviation model and a path deviation model are deployed. The process deviation model determines the similarity of a process to past processes, and the path deviation model estimates whether processes have been called out of turn. In this manner, systems and methods of embodiments of the disclosure are able to detect both whether a process is in itself unusual, and whether it is called at an unusual time. This added context contributes to improved threat detection.

Abstract: A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate generation of microservices from a monolithic application based on runtime traces are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a model component that learns cluster assignments of classes in a monolithic application based on runtime traces of executed test cases. The computer executable components can further comprise a cluster component that employs the model component to generate clusters of the classes based on the cluster assignments to identify one or more microservices of the monolithic application.

Abstract: Systems and techniques that facilitate background monitoring of eye health are provided. In various embodiments, a system can comprise a sensor component of a device. In various aspects, the sensor component can detect one or more physical characteristics associated with an entity. In various embodiments, the system can further comprise a diagnostic component of the device. In various instances, the diagnostic component can estimate in a background of the device a health condition of an eye of the entity based on the one or more physical characteristics. In various cases, estimating the health condition in the background of the device can facilitate real-time monitoring of the eye health of the entity without interrupting the entity's normal use of the device.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate generation of microservices from a monolithic application based on runtime traces are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a model component that learns cluster assignments of classes in a monolithic application based on runtime traces of executed test cases. The computer executable components can further comprise a cluster component that employs the model component to generate clusters of the classes based on the cluster assignments to identify one or more microservices of the monolithic application.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate generation of microservices from a monolithic application based on runtime traces are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a model component that learns cluster assignments of classes in a monolithic application based on runtime traces of executed test cases. The computer executable components can further comprise a cluster component that employs the model component to generate clusters of the classes based on the cluster assignments to identify one or more microservices of the monolithic application.

Abstract: In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Abstract: In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Abstract: One or more systems, computer-implemented methods and/or computer program products to facilitate a process to transform original operational data into updated operational data. A system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a transformation component that can transform original operational data of a first architecture into updated operational data employable at a second architectures, wherein the second architectures is an updated architectures relative to the first architecture. In one or more embodiments, the transformation component further can employ machine learning to match one or more data elements of the original operational data to one or more aspects of the second architecture.

Abstract: An approach for generating actionable explanations of change request classifications may be presented. A model may generate features associated with a change request may be disclosed. The model may be trained with historical change requests that have been labeled risky or not risky. The change request may be classified as risky or not risky. Candidate historical change requests with the same classification as the change request and occupying similar feature space as the change request may be identified from a historical change request repository. One or more features which had the most significant impact on the classification may be identified. A candidate historical change request with at least one significant feature impacting classification may be identified.

Abstract: A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Abstract: Methods, computer program products, and/or systems are provided that perform the following operations: in an information technology (IT) management system, grouping one or more ongoing service failure events into a service failure record; identifying a representative event for the service failure record; identifying one or more conversations that relate to the one or more ongoing service events; computing, using a similarity algorithm, feature similarity scores for respective conversations of the one or more conversations based, at least in part, on the features associated with the representative event and features associated with the respective conversations; linking a subset of the one or more conversations to the one or more ongoing service events in the service failure record based, at least in part, on the computed feature similarity scores; and providing the service failure record to a collaboration platform utilized in addressing the one or more ongoing service events.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate proactive operational risk assessment of a proposed change in a computing environment are provided. According to an embodiment, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise an extraction component that identifies change events in historic operational data that induced one or more incidents in a computing environment. The computer executable components further comprise an assessment component that employs a model to assign a change risk assessment score to a defined change in the computing environment based on the change events.

Abstract: A method, system, and computer program product for decomposing monolithic applications to form microservices are provided. The method identifies a set of classes within a monolithic application. A set of horizontal clusters are generated by performing horizontal clustering to the set of classes to decompose the classes based on a first functionality type. The method generates a set of vertical clusters by performing vertical clustering to the set of classes to decompose the classes based on a second functionality type. A subset of classes occurring in a common horizontal cluster and vertical cluster are identified as a functional unit. The method merges one or more functional units to form a microservice.

Abstract: Technology for applying artificial intelligence to decide when to, and/or when not to, send a consumer of a computer system a communication recommending that the computer system be revised to include a more recent version of at least one of the following: a hardware component (for example, microprocessor(s)) and/or a software component (for example, an updated version of an app). The computer system, that is subject to modernization, may be owned outright by the consumer, or it may be purchased as a service (for example, infrastructure as a service, software as a service, package of cloud services). Some embodiments focus on modernization recommendations specifically tailored to cloud orchestration software that deploys containers.

Abstract: A method, system, and computer program product for decomposing monolithic applications to form microservices are provided. The method identifies a set of classes within a monolithic application. A set of horizontal clusters are generated by performing horizontal clustering to the set of classes to decompose the classes based on a first functionality type. The method generates a set of vertical clusters by performing vertical clustering to the set of classes to decompose the classes based on a second functionality type. A subset of classes occurring in a common horizontal cluster and vertical cluster are identified as a functional unit. The method merges one or more functional units to form a microservice.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate generation of microservices from a monolithic application based on runtime traces are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a model component that learns cluster assignments of classes in a monolithic application based on runtime traces of executed test cases. The computer executable components can further comprise a cluster component that employs the model component to generate clusters of the classes based on the cluster assignments to identify one or more microservices of the monolithic application.

Abstract: Facilitation of dynamic eye condition self-diagnosis is provided. A system can include a memory and a processor that executes computer executable components. The computer executable components can include: a status component that determines attributes of a user; a visualization component that generates a set of visualizations including at least one of: moving text, moving images or video; a test component that generates a set of tests using a subset of the set of visualizations; an assessment component that assesses an ability of the user to identify the subset of the set of visualizations displayed by the set of tests; and a vision scoring component that scores a vision of the user to generate a vision score, wherein the vision score is based upon an assessment of the ability of the user to identify the displayed subset of the set of visualizations and the attributes of the user.