Abstract: A method for providing protection of a computing resource constrained device against cyberattacks may include collecting threat intelligence data in form of indicators of compromise (IoC). The indicators may include cyberattack chain related data. The method may also include determining a relevance of the cyberattack chain for the device, measuring a utilization of security measures in terms of their detection of the respective IoCs and their respective responses to the IoCs, measuring a resource consumption of the security measures, and determining a benefit value for at least one the security measure expressed by its utilization and a relevance value of the IoCs detected with it.

Abstract: Computer-implemented methods and systems are provided for digitally signing predetermined arrays of digital data. Such a method may provide a secret neural network model trained to classify arrays of digital data in dependence on data content of the arrays. The array of the arrays may be signed by supplying the array to the secret neural network model to obtain an initial classification result; and effecting a modification of data in the array to change the initial classification result to a predetermined, secret classification result, the modification being effected via a backpropagation process in the secret neural network model to progressively modify the array in response to backpropagated errors dependent on a difference between a current classification result for the array and the secret classification result.

Abstract: The exemplary embodiments disclose a method, a computer system, and a computer program product for detecting malware. The exemplary embodiments may include aggregating known malware patterns by storing malware patterns and related malware categories of the malware patterns. The exemplary embodiments may additionally include training a first machine-learning system, comprising a generator portion and a discriminator portion, by using the known malware patterns and the related malware categories as training data. The exemplary embodiments may also include generating additional synthetic code patterns by feeding random code samples to the trained first machine-learning system. The exemplary embodiments may further include training a second machine-learning system by using benevolent code patterns and the generated additional synthetic code patterns as training data.

Abstract: A method for linking a first knowledge graph (KG) and a second KG in the presence of a third KG is provided. Content of nodes of the first KG is compared to nodes of the second KG. If a first KG node has a content relationship to a related second KG node, an edge identified by a tuple identifying the first KG and the first KG node and a tuple identifying the second KG and the second KG node is stored in a meta-layer KG. The method comprises comparing content of the nodes from the third KG with the content of nodes from the first and second KG, and in case relationships are identified, more complex tuples establishing this relationship in the meta-layer are stored. Finally, the method also comprises storing at least all nodes and edges of the meta-layer knowledge graph.

Abstract: A method for event predictions is provided. The method includes receiving input data. The method further includes identifying an object in the input data with the identified object associated with a first node in a knowledge graph. The method further includes determining a second node of a first object event with the second node related to the first node in the knowledge graph. The method further includes contextualizing the identified input object with the first object event.

Abstract: A method for providing protection of a computing resource constrained device against cyberattacks may include collecting threat intelligence data in form of indicators of compromise (IoC). The indicators may include cyberattack chain related data. The method may also include determining a relevance of the cyberattack chain for the device, measuring a utilization of security measures in terms of their detection of the respective IoCs and their respective responses to the IoCs, measuring a resource consumption of the security measures, and determining a benefit value for at least one the security measure expressed by its utilization and a relevance value of the IoCs detected with it.

Abstract: Aspects of the present invention disclose a method, computer program product, and system for detecting a malicious process by a selected instance of an anti-malware system. The method includes one or more processors examining a process for indicators of compromise to the process. The method further includes one or more processors determining a categorization of the process based upon a result of the examination. In response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, the method further includes one or more processors executing the process in a secure enclave. The method further includes one or more processors collecting telemetry data from executing the process in the secure enclave. The method further includes one or more processors passing the collected telemetry data to a locally trained neural network system.

Abstract: An approach for determining a concatenated confidence value of a first class using an artificial-intelligence module (AI-module) for performing a classification based on the concatenated confidence value of the first class. The AI-module comprises a knowledge graph module, a machine learning module, and a weighting module. A processor determines a first confidence value of the first class as a first function of an input dataset using the machine learning module. A processor determines a second confidence value of the first class as a second function of the input dataset using the knowledge graph module. A processor determines the concatenated confidence value of the first class as a third function of the first confidence value of the first class, the second confidence value of the first class, and a value of a weighting parameter of the weighting module.

Abstract: A computer-implemented method for classification of data by a machine learning system using a logic constraint for reducing a data labeling requirement. The computer-implemented method includes: generating a first embedding space from a first partially labeled training data set, wherein in the first embedding space, content-wise related training data of the first partially labeled training data are clustered together, determining at least two clusters in the first embedding space formed from the first partially labeled training data, and training a machine learning model based, at least in part, on a second partially labeled training data set and the at least two clusters, wherein the at least two clusters are used as training constraints.

Abstract: A system for enhancing a classifier prediction in respect to underrepresented classes may be provided. A classifier system trained with training data to build a model is used for classifying unknown input data, and an evaluator engine adapted for a determination of an underrepresented class. Additionally, the system comprises an extractor engine adapted for an extraction of relating data from an additional source, and a similarity engine adapted for a selection of data sets out of the relating data wherein the similarity engine is also adapted for comparing features of the relating data and a representative data set for the underrepresented class. Finally, the system comprises a recursion unit adapted for triggering the evaluator engine, the extractor engine and the similarity engine treating selected data set as input data until the evaluator engine classifies the selected data set with a confidence level which is above a confidence threshold level.

Abstract: The exemplary embodiments disclose a system and method, a computer program product, and a computer system for assigning medical codes. The exemplary embodiments may include receiving a medical record comprising a diagnosis code, querying a knowledge graph using the diagnosis code, the knowledge graph comprising as nodes: case identifiers, diagnosis codes and related procedure codes, and secondary diagnosis codes and related secondary procedure codes, wherein edges between the nodes are indicative of a type of relationship between related nodes derived from real past medical records, and receiving, based on the query, a ranked list of the diagnosis codes, related procedure codes, and secondary diagnosis codes and the related secondary procedure codes based on relative occurrences of the past medical records.

Abstract: The exemplary embodiments disclose a system and method, a computer program product, and a computer system for assigning medical codes. The exemplary embodiments may include receiving a medical record in machine-readable text-form, wherein the medical record comprises at least one treatment, converting a portion of the medical record into a determined first medical code of a first length, querying a knowledge graph comprising medical records and a coding catalog for a second medical code of higher order than the first medical code, wherein the second medical code relates to the first medical code, and searching evidence in the medical record for the second medical code by comparing at least a portion of clear text relating to the second medical code with the medical record.

Abstract: The present disclosure relates to a method for query expansion. The method comprises: a) receiving a current query having at least one search term; b) inputting the at least one search term of the current query to a set of one or more query expansion modules, wherein the query expansion modules are configured to predict expansion terms of input terms; c) receiving from the set of expansion modules candidate expansion terms of the search term; d) modifying the current query using at least part of the candidate expansion terms, resulting in a modified query having at least one modified search term, The method further comprises repeating steps b) to d) using the modified query as the current query, the repeating being performed until a predefined stopping criterion is fulfilled.

Abstract: A computer-implemented method, system, and computer program product for dynamic access control to a node in a knowledge graph includes: structuring nodes of a knowledge graph into a plurality of hierarchically organized graph layers; assigning, to one or more users, an access right to a first node of the knowledge graph, the access right to the node selected from a plurality of access rights, where different types of users have different access rights; and assigning, to at least one user from the one or more users, an additional access right to a second node of the knowledge graph.

Abstract: Aspects of the present invention disclose a method for verifying labels of records of a dataset. The records comprise sample data and a related label out of a plurality of labels. The method includes one or more processors dividing the dataset into a training dataset comprising records relating to a selected label and an inference dataset comprising records with sample data relating to the selected label and all other labels out of the plurality of labels. The method further includes dividing the training dataset into a plurality of learner training datasets that comprise at least one sample relating to the selected label. The method further includes training a plurality of label-specific few-shot learners with one of the learner training datasets. The method further includes performing inference by the plurality of trained label-specific few-shot learners on the inference dataset to generate a plurality of sets of predicted label output values.

Abstract: A computer-implemented method for generating a group of representative model cases for a trained machine learning model may be provided. The method comprising determining an input space, determining an initial plurality of model cases, and expanding the initial plurality of model cases by stepwise modifying field values of the records representing the initial plurality of model cases resulting in an exploration set of model cases. Additionally, the method comprises obtaining a model score value for each record of the exploration set of model cases, continuing the expansion of the exploration set of model cases thereby generating a refined model case set, and selecting the records in the refined model case set based on relative record distance values and related model score values between pairs of records, thereby generating the group of representative model cases.

Abstract: A method for event predictions is provided. The method includes receiving input data. The method further includes identifying an object in the input data with the identified object associated with a first node in a knowledge graph. The method further includes determining a second node of a first object event with the second node related to the first node in the knowledge graph. The method further includes contextualizing the identified input object with the first object event.

Abstract: A method, computer system, and computer program product for eliminating a redundant node from a knowledge graph is provided. A structural analysis of a knowledge graph is performed by determining that two nodes have a similar structure. An empirical analysis is performed by determining a search result correlation of potentially redundant nodes, said search result correlation comprising a correlation of search result nodes generated from different search queries to said knowledge graph or a correlation of search results due to selected search result nodes in subtrees of said potentially redundant nodes. Results of said structural analysis and said empirical analysis are combined to generate a redundancy confidence level value for two said nodes. One of said two nodes is determined as redundant. One of said two redundant nodes is removed from the knowledge graph.

Abstract: A system for enhancing a classifier prediction in respect to underrepresented classes may be provided. A classifier system trained with training data to build a model is used for classifying unknown input data, and an evaluator engine adapted for a determination of an underrepresented class. Additionally, the system comprises an extractor engine adapted for an extraction of relating data from an additional source, and a similarity engine adapted for a selection of data sets out of the relating data wherein the similarity engine is also adapted for comparing features of the relating data and a representative data set for the underrepresented class. Finally, the system comprises a recursion unit adapted for triggering the evaluator engine, the extractor engine and the similarity engine treating selected data set as input data until the evaluator engine classifies the selected data set with a confidence level which is above a confidence threshold level.

Abstract: A computer-implemented method for modifying patterns in datasets using a generative adversarial network may be provided. The method comprises providing pairs of data samples. The pairs comprise each a base data sample and a modified data sample. Thereby, the modified pattern is determined by applying random modifications to the base data sample. Additionally, the method comprises training of the generator for building a model of the generator using an adversarial training method and using the pairs of data samples as input, wherein the discriminator receives as input dataset pairs of datasets, the dataset pairs comprising each a prediction output of the generator based on a base data sample and the corresponding modified data sample, thereby optimizing a joint loss function for the generator and the discriminator, and predicting an output dataset for unknown data samples as input for the generator without the discriminator.