Abstract: A computer-implemented method for enabling transaction-risk evaluation by resource-limited devices. The method includes receiving from a financial network transaction data, defining transactions in the network, and generating, based on the transaction data, a transaction graph comprising nodes, representing parties to transactions, interconnected by edges representing transactions between parties represented by the nodes. For each of at least some nodes, at least one risk attribute provided in the transaction graph. The method includes receiving from a resource-limited device a request describing a potential transaction, identifying at least one counterparty node, deriving transaction-risk data, dependent on aggregated risk attributes of the counterparty node and a selected set of nodes reachable from that node via edges, and sending to the device a response comprising the transaction-risk data for evaluation of risk of the potential transaction.

Abstract: A computer-implemented method or protecting a machine-learning model against training data attacks is disclosed. The method comprises performing an initial training of a machine-learning system with controlled training data, thereby building a trained initial machine-learning model and identifying high-impact training data from a larger training data set than in the controlled training data, wherein the identified individual training data have an impact on a training cycle of the training of machine-learning model, wherein the impact is larger than a predefined impact threshold value. The method also comprises building an artificial pseudo-malicious training data set from the identified high-impact training data and retraining the machine-learning system comprising the trained initial machine-learning model using the artificial pseudo-malicious training data set.

Abstract: A method includes receiving a first query by a computing device and assigning the first query to a plurality of cognitive engines, wherein each of the plurality of cognitive engines include different characteristics for processing data. The method also includes, responsive to receiving a response from each of the plurality of cognitive engines for the first query, comparing the received responses from the plurality of cognitive engines. The method also included responsive to determining a difference between a first response from a first cognitive engine and a second response from a second cognitive engine is above a predetermined threshold value, performing a response mediation process until the difference is below the predetermined threshold value. The method also includes selecting a first final response from the received responses for the first query and the second query and displaying the first final response to a user.

Abstract: Mechanisms are provided to implement a visual analytics pipeline. The mechanisms generate, from an input database of records, a chronology-aware graph data structure of a plurality of records based features specified in an ontology data structure. The chronology-aware graph data structure has vertices representing one or more of events or records based features corresponding to events, and edges representing chronological relationships between events. The mechanisms execute a chronology-aware graph query on the chronology-aware graph data structure to generate a filtered set of vertices and corresponding features corresponding to criteria of the chronology-aware graph query.

Abstract: In several aspects for querying a data source represented by data object embeddings in a vector space, a processor inputs, to a trained embedding generation model, a received query and at least one token for receiving from the trained embedding generation model a set of embeddings of the vector space. The set of embeddings comprises an embedding of the received query and at least one embedding of the at least one token respectively, wherein the embedding of each token is a prediction of an embedding of a supplement of the query. The data object embeddings may be searched for data object embeddings that match the set of embeddings. This may result in search result embeddings of the set of embeddings. Data objects that are represented by the search result embeddings may be determined. At least part of the determined data objects may be provided.

Abstract: A computer implemented method includes transforming a set of received samples from a set of data into a multiplexed graph, by creating a plurality of planes, each plane having the set of nodes and the set of edges. Each set of edges is associated with a given relation type from the set of relation types. Message passing walks are alternated within and across the plurality of planes of the multiplexed graph using a graph neural network (GNN) layer. The GNN layer has a plurality of units where each unit outputs an aggregation of two parallel sub-units. Sub-units include a typed GNN layer that allows different permutations of connectivity patterns between intra-planar and inter-planar nodes. A task-specific supervision is used to train a set of weights of the GNN for the machine learning task.

Abstract: Mechanisms are provided to implement a visual analytics pipeline. The mechanisms generate, from an input database of records, a chronology-aware graph data structure of a plurality of records based features specified in an ontology data structure. The chronology-aware graph data structure has vertices representing one or more of events or records based features corresponding to events, and edges representing chronological relationships between events. The mechanisms execute a chronology-aware graph query on the chronology-aware graph data structure to generate a filtered set of vertices and corresponding features corresponding to criteria of the chronology-aware graph query.

Abstract: Aspects of the present invention disclose a method, computer program product, and system for detecting a malicious process by a selected instance of an anti-malware system. The method includes one or more processors examining a process for indicators of compromise to the process. The method further includes one or more processors determining a categorization of the process based upon a result of the examination. In response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, the method further includes one or more processors executing the process in a secure enclave. The method further includes one or more processors collecting telemetry data from executing the process in the secure enclave. The method further includes one or more processors passing the collected telemetry data to a locally trained neural network system.

Abstract: A computer-implemented method for classification of data by a machine learning system using a logic constraint for reducing a data labeling requirement. The computer-implemented method includes: generating a first embedding space from a first partially labeled training data set, wherein in the first embedding space, content-wise related training data of the first partially labeled training data are clustered together, determining at least two clusters in the first embedding space formed from the first partially labeled training data, and training a machine learning model based, at least in part, on a second partially labeled training data set and the at least two clusters, wherein the at least two clusters are used as training constraints.

Abstract: The present disclosure relates to a method for query expansion. The method comprises: a) receiving a current query having at least one search term; b) inputting the at least one search term of the current query to a set of one or more query expansion modules, wherein the query expansion modules are configured to predict expansion terms of input terms; c) receiving from the set of expansion modules candidate expansion terms of the search term; d) modifying the current query using at least part of the candidate expansion terms, resulting in a modified query having at least one modified search term, The method further comprises repeating steps b) to d) using the modified query as the current query, the repeating being performed until a predefined stopping criterion is fulfilled.

Abstract: Computer-implemented methods are provided for generating machine learning model for multimodal data inference tasks. Such a method includes, for each sample in a training dataset of multimodal data samples, encoding the sample to produce a compressed vector representation of the sample in a k-dimensional latent space, and perturbing features of the sample to identify, for each dimension of the latent space, a set of active features perturbation of each of which produces more than a threshold change in the vector representation in that dimension. The method further comprises generating a sample graph having nodes interconnected by edges, wherein the nodes comprise nodes representing respective said features of the sample and edges interconnecting nodes indicate the active features for each dimension. The sample graph is then used to train a graph neural network model to perform the multimodal data inference task. Multimodal data inference systems employing such models are also provided.

Abstract: A processor may gather raw data comprising a plurality of characteristic data samples of a target user group. The processor may categorize the characteristic data samples into a plurality of user-related classes and triggers. The processor may build an input property graph for each characteristic data sample. The processor may augment the input property graph by a concept of hierarchies. The processor may determine a modification vector from the augmented input property graph. The processor may train an encoder/decoder combination machine-learning system. An embedding vector and a modification vector are used as input for the decoder to build a trained machine-learning generative model.

Abstract: A computer-implemented method for enabling transaction-risk evaluation by resource-limited devices. The method includes receiving from a financial network transaction data, defining transactions in the network, and generating, based on the transaction data, a transaction graph comprising nodes, representing parties to transactions, interconnected by edges representing transactions between parties represented by the nodes. For each of at least some nodes, at least one risk attribute provided in the transaction graph. The method includes receiving from a resource-limited device a request describing a potential transaction, identifying at least one counterparty node, deriving transaction-risk data, dependent on aggregated risk attributes of the counterparty node and a selected set of nodes reachable from that node via edges, and sending to the device a response comprising the transaction-risk data for evaluation of risk of the potential transaction.

Abstract: An approach for predicting a state of a test entity may be provided. The approach may include providing a test graph, corresponding to the test entity, and a conditional generative model, based on a graph neural network. The test graph may have a hybrid structure, which may be a static graph and a dynamic graph. The static graph may include a reference vertex associated with an entity. The reference vertex can be connected to peripheral vertices associated with permanent attributes of the entity. The dynamic graph may be connected to the reference vertex and include chronological vertices associated with transient attributes. The chronological vertices are chronologically ordered via oriented chronological edges. The approach may predict a next chronological state of the test graph based on applying the test graph to the conditional generative model.

Abstract: Computer-implemented methods and systems are provided for digitally signing predetermined arrays of digital data. Such a method may provide a secret neural network model trained to classify arrays of digital data in dependence on data content of the arrays. The array of the arrays may be signed by supplying the array to the secret neural network model to obtain an initial classification result; and effecting a modification of data in the array to change the initial classification result to a predetermined, secret classification result, the modification being effected via a backpropagation process in the secret neural network model to progressively modify the array in response to backpropagated errors dependent on a difference between a current classification result for the array and the secret classification result.

Abstract: An approach for locating suspect patterns of transactions in a financial network may be provided. The approach may include generating a transaction graph for a financial network by processing transaction data defining transfers between accounts in that network. The approach may include modifying the transaction graph to include synthetic suspect transaction patterns at multiple locations in the graph and extracting subgraphs from the transaction graph. The approach may include training a graph neural network model to classify subgraphs containing a synthetic suspect transaction pattern as suspect. The approach may also include locating suspect transaction patterns in a new financial network by generating a new transaction graph for that network and classifying a subgraph of the new financial network as suspect.

Abstract: A computer-implemented method for generating a group of representative model cases for a trained machine learning model may be provided. The method comprising determining an input space, determining an initial plurality of model cases, and expanding the initial plurality of model cases by stepwise modifying field values of the records representing the initial plurality of model cases resulting in an exploration set of model cases. Additionally, the method comprises obtaining a model score value for each record of the exploration set of model cases, continuing the expansion of the exploration set of model cases thereby generating a refined model case set, and selecting the records in the refined model case set based on relative record distance values and related model score values between pairs of records, thereby generating the group of representative model cases.

Abstract: Mechanisms are provided to implement a visual analytics pipeline. The mechanisms generate, from an input database of records, a chronology-aware graph data structure of a plurality of records based features specified in an ontology data structure. The chronology-aware graph data structure has vertices representing one or more of events or records based features corresponding to events, and edges representing chronological relationships between events. The mechanisms execute a chronology-aware graph query on the chronology-aware graph data structure to generate a filtered set of vertices and corresponding features corresponding to criteria of the chronology-aware graph query.

Abstract: Aspects of the present invention disclose a method for verifying labels of records of a dataset. The records comprise sample data and a related label out of a plurality of labels. The method includes one or more processors dividing the dataset into a training dataset comprising records relating to a selected label and an inference dataset comprising records with sample data relating to the selected label and all other labels out of the plurality of labels. The method further includes dividing the training dataset into a plurality of learner training datasets that comprise at least one sample relating to the selected label. The method further includes training a plurality of label-specific few-shot learners with one of the learner training datasets. The method further includes performing inference by the plurality of trained label-specific few-shot learners on the inference dataset to generate a plurality of sets of predicted label output values.

Abstract: A method for providing protection of a computing resource constrained device against cyberattacks may include collecting threat intelligence data in form of indicators of compromise (IoC). The indicators may include cyberattack chain related data. The method may also include determining a relevance of the cyberattack chain for the device, measuring a utilization of security measures in terms of their detection of the respective IoCs and their respective responses to the IoCs, measuring a resource consumption of the security measures, and determining a benefit value for at least one the security measure expressed by its utilization and a relevance value of the IoCs detected with it.