Abstract: A computing machine receives a plurality of observations. The computing machine generates an observation data structure. The computing machine extends, in accordance with the causal structures and hierarchical relationships, the observation data structure to include predicted states or predicted actions that are not from the plurality of observations. The computing machine reduces, in accordance with consistency rules stored in a memory of the computing machine, the extended observation data structure. The computing machine provides an output associated with the reduced observation data structure.

Abstract: A computer generates historical time and velocity data for vehicles based on data from sensor(s) observing the vehicles. The computer determines, based on the historical time and velocity data, a control policy that controls movement of the vehicles. The control policy is represented as a weighted combination of a set of predefined policies. Determining the control policy comprises calculating weights or parameters for a weighted combination of the set of predefined policies that minimizes a residual error term. The residual error term is computed based on a difference between the historical time and velocity data and predicted time and velocity data associated with the weighted combination of the set of predefined policies. The computer determines an action plan based on the determined nonlinear control policy. The computer transmits, to a machine, a control signal causing the machine to perform or simulate at least a part of the determined action plan.

Abstract: A computing machine accesses text from a record. The computing machine identifies, using a natural language processing engine, an entity mapped to a first span of the text. The first span includes a contiguous sequence of one or more words or subwords in the text. The computing machine determines a bias category for the entity. The bias category is selected from a predefined list of bias categories. The determined bias category for the entity depends on a second span of the text. The second span includes a contiguous sequence of one or more words or subwords in the text. The second span is different from the first span.

Abstract: A computing machine accesses text from a record. The computing machine identifies, using a natural language processing engine, an entity mapped to a first span of the text. The first span includes a contiguous sequence of one or more words or subwords in the text. The computing machine determines a bias category for the entity. The bias category is selected from a predefined list of bias categories. The determined bias category for the entity depends on a second span of the text. The second span includes a contiguous sequence of one or more words or subwords in the text. The second span is different from the first span.

Abstract: A computing machine receives an input comprising unstructured text. The computing machine identifies, within the unstructured text, one or more entities using a named entity recognition (NER) engine in a trained machine learning model. The trained machine learning model embeds tokens from the text into a vector space and uses generated embeddings to identify one or more tokens as being associated with the one or more entities. The computing machine determines, using the trained machine learning model that identifies the one or more entities and based on the embedded tokens, an assertion applied, within the text, to at least one entity. The assertion is represented as a vector in a multi-dimensional space. Each dimension corresponds to a part of the assertion. The trained machine learning model is a span-level model that both identifies the one or more entities and determines the assertion based on candidate spans of tokens.

Abstract: A computing machine accesses a directed graph representing one or more sequences of actions. The directed graph comprises nodes and edges between the nodes. Each node is either a beginning node, an intermediate node, or an end node. Each intermediate is downstream from at least one beginning node and upstream from at least one end node. Each beginning node in at least a subset of the beginning nodes has an explainability value vector. The computing machine computes, for each first node from among a plurality of first nodes that are intermediate nodes or end nodes, a provenance value representing dependency of an explainability value vector of the first node on the one or more nodes upstream from the first node. The computing machine computes, for each first node, the explainability value vector. The computing machine provides a graphical output representing at least an explainability value vector of an end node.

Abstract: Provenance analysis systems and methods. Datums representing relationships between entities can be stored in a knowledge store. Datums can be received from agents as agents perform activities. Activity records are be stored in a provenance graph, the activity record and associate received datums with any input datums used in the activity. Provenance subgraphs can 5 be retrieved by traversing the provenance graph for selected datums and presented through a user interface. Provenance subgraphs can be augmented with trust modifiers determined based on attributions, confidences, and refutations provided by a user. Trust modifiers can be propagated downstream to enable the addressing of junctions in variable confidence.

Abstract: A computer detects a crash of a computer program, the crash being caused by a faulting instruction. The computer determines, within concrete stack frame(s) of the computer program, memory position(s) and extent(s) of input. The computer maps, using the memory position(s) and the extent(s), inferred stack frame(s) onto concrete stack frame(s), the inferred stack frame(s) indicating positions of variables used in the computer program. The computer identifies, based on mapping the inferred stack frame(s) onto the concrete stack frame(s), at least one variable from among the variables that is within a stack overflow memory and within a dataflow path to the faulting instruction, wherein the dataflow path to the faulting instruction indicates the variables used in the computer program that are accessed by or contribute to the faulting instruction. The computer determines whether the stack overflow contributed to the crash of the computer program.

Abstract: Methods, systems, and computer program products for identifying a desired target from among a more general class(es) of objects are provided. A method includes receiving one or more sensor feeds including one or more objects that are identified as being from the same class of objects, scanning the one or more objects to determine if a desired target is among the one or more objects based on a target profile, and identifying the desired target if the target profile matches one or more characteristics of a particular object in the one or more objects. One system includes a sensing device in communication with a hardware processor in which the hardware processor is configured for performing the above method. A computer program product includes computer code for performing the above method when a hardware processor executes the computer code.

Abstract: Methods, systems, and computer-readable storage medium including a computer program product for defending against cyber-attacks are provided. One method includes receiving, by a processor, program code and automatically generating a chronomorphic binary for the program code. The method further includes storing the chronomorphic binary in an executable memory space and diversifying the executable memory space for the chronomorphic binary during runtime of the program code. A system includes memory configured for storing a defense module and a processor connected to the memory. The processor, when executing the defense module, is configured for performing the above-referenced method. One computer program product includes computer code for performing the above-referenced method.

Abstract: Methods, systems, and computer program products for identifying a desired target from among a more general class(es) of objects are provided. A method includes receiving one or more sensor feeds including one or more objects that are identified as being from the same class of objects, scanning the one or more objects to determine if a desired target is among the one or more objects based on a target profile, and identifying the desired target if the target profile matches one or more characteristics of a particular object in the one or more objects. One system includes a sensing device in communication with a hardware processor in which the hardware processor is configured for performing the above method. A computer program product includes computer code for performing the above method when a hardware processor executes the computer code.

Abstract: Methods, systems, and computer-readable storage medium including a computer program product for defending against cyber-attacks are provided. One method includes receiving, by a processor, program code and automatically generating a chronomorphic binary for the program code. The method further includes storing the chronomorphic binary in an executable memory space and diversifying the executable memory space for the chronomorphic binary during runtime of the program code. A system includes memory configured for storing a defense module and a processor connected to the memory. The processor, when executing the defense module, is configured for performing the above-referenced method. One computer program product includes computer code for performing the above-referenced method.

Abstract: A system for evaluating communicative acts between communicative pairs to determine a social perception network representation. Each communicative pair includes two entities participating in a communicative act. The system includes a patterns database storing behavior recognition patterns defining particular behaviors that may be used in the communicative acts and a social perception score associated with each of the particular behaviors. The scoring processor determines a first pairwise social perception score for each communicative pair based on the particular behaviors in the communicative acts occurring during a first time frame. The scoring processor determines a different first pairwise social perception score for each of the communicative pairs during a first time frame and determines a different second social perception score for each of the communicative pairs during a second time frame.

Abstract: A system for evaluating communicative acts to determine a social network perception representation based on communicative acts between a plurality of communicative pairs where each communicative pair includes a first group and an individual or a second group participating in corresponding communicative acts. The system includes a patterns database, a scoring processor, and a communications network aggregation processor. The patterns database stores behavior recognition patterns defining particular behaviors and a score associated with each of the particular behaviors. The scoring processor is configured to determine a pairwise social perception score for each of the communicative pairs based on the particular behaviors identified in the communicative acts. The scoring processor is configured to determine a different pairwise social perception score for each of the communicative pairs.

Abstract: Methods, systems, and computer-readable storage medium including a computer program product for defending against cyber-attacks are provided. One method includes receiving, by a processor, program code and automatically generating a chronomorphic binary for the program code. The method further includes storing the chronomorphic binary in an executable memory space and diversifying the executable memory space for the chronomorphic binary during runtime of the program code. A system includes memory configured for storing a defense module and a processor connected to the memory. The processor, when executing the defense module, is configured for performing the above-referenced method. One computer program product includes computer code for performing the above-referenced method.

Abstract: A method of conditioning a trainee to identify an object and monitoring the trainee to determine when the trainee subconsciously identifies the object is provided. The method includes using a processor to select a visceral response-evoking image for evoking the desired trainee response corresponding with the object, attaching a sensor to the trainee for detecting trainee biological responses, and providing instructions to display a stimulus image depicting the object for a first duration that is below conscious awareness of the trainee. The method includes providing instructions to display the visceral response-evoking image after the display of the stimulus image and for a duration below conscious awareness of the trainee to link the desired trainee response to the object in a mind of the trainee, and detecting trainee recognition of one of the one or more objects based on the biological response data linked to the desired trainee response.

Abstract: A method of monitoring a trainee to determine when the trainee subconsciously identifies an object previously associated with a desired trainee response includes attaching at least one biological response sensor to the trainee and receiving biological response data of the trainee from the at least one biological response sensor. The method further includes comparing the biological response data of the trainee to biological responses linked to different ones of a plurality of trainee responses using a processor in communication with the at least one biological response sensor, the plurality of trainee responses including the desired trainee response, and detecting trainee recognition of the object previously associated with the desired trainee response based, in part, on the biological response data being linked to the desired trainee response included with the plurality of trainee responses. The desired trainee response is below the conscious awareness of the trainee.

Abstract: A method of monitoring a trainee to determine when the trainee subconsciously identifies an object previously associated with a desired trainee response includes attaching at least one biological response sensor to the trainee and receiving biological response data of the trainee from the at least one biological response sensor. The method further includes comparing the biological response data of the trainee to biological responses linked to different ones of a plurality of trainee responses using a processor in communication with the at least one biological response sensor, the plurality of trainee responses including the desired trainee response, and detecting trainee recognition of the object previously associated with the desired trainee response based, in part, on the biological response data being linked to the desired trainee response included with the plurality of trainee responses. The desired trainee response is below the conscious awareness of the trainee.

Abstract: A method of conditioning a trainee to identify an object and monitoring the trainee to determine when the trainee subconsciously identifies the object is provided. The method includes using a processor to select a visceral response-evoking image for evoking the desired trainee response corresponding with the object, attaching a sensor to the trainee for detecting trainee biological responses, and providing instructions to display a stimulus image depicting the object for a first duration that is below conscious awareness of the trainee. The method includes providing instructions to display the visceral response-evoking image after the display of the stimulus image and for a duration below conscious awareness of the trainee to link the desired trainee response to the object in a mind of the trainee, and detecting trainee recognition of one of the one or more objects based on the biological response data linked to the desired trainee response.

Abstract: A method performed by an authentication processor for authenticating an unknown user claiming to be a legitimate user. The method includes comparing a legitimate user response metric to an unknown user response metric and one of preventing access to the computer system and decreasing a level of access to the computer system when the unknown user response metric differs from the legitimate user response metric by more than a predefined degree of acceptable variation. The legitimate user response metric represents observed changes in micro-behaviors of the legitimate user in response to viewing a plurality of prime images. The unknown user response metric represents observed changes in micro-behaviors of the unknown user in response to viewing the plurality of prime images.