Abstract: A method for optimizing deep learning models includes: initializing a plurality of pools, each including a plurality of candidate solutions; concurrently performing a plurality of tuning algorithms respectively within the plurality of pools during a single tuning run, thereby obtaining a plurality of selected candidate solutions; and generating an optimized model configuration based on the plurality of selected candidate solutions.

Abstract: A neural network optimization method includes: executing a population-based algorithm to tune and evaluate a policy group, in order to generate one or more evaluation results, wherein the policy group comprises one or more policies, and each of the one or more policies is related to a neural network; executing a learning-based algorithm to tune the one or more policies according to the one or more evaluation results, to generate one or more tuned policies; performing an inference operation according to a target neural network and the one or more tuned policies, to generate multiple configuration candidates; and performing a selection operation upon the multiple configuration candidates to generate an optimal configuration, for outputting to a compiler and generating an optimized neural network, wherein the optimized neural network is an optimized version of the target neural network.

Abstract: Techniques are described with regard to addressing structured false positives in the context of detecting asset anomalies in a computing environment. An associated computer-implemented method includes applying an anomaly detection machine learning model to each of a plurality of assets in order to determine a plurality of anomaly assets among the plurality of assets. The plurality of anomaly assets are determined based upon a model anomaly risk score calculated for each of the plurality of assets consequent to asset event data analysis. The method further includes calculating a structured false positive score for each of the plurality of anomaly assets during a current structured false positive time window. The method further includes retraining the anomaly detection machine learning model responsive to determining that a threshold value of anomaly assets among the plurality of anomaly assets have a structured false positive score exceeding a structured false positive threshold value.

Abstract: Described are techniques for network anomaly detection. The techniques include generating, from network traffic, a plurality of network interactions, where respective network interactions comprise a communication source and a communication destination. The techniques further include generating, for the respective network interactions, a recommendation score using a trained Collaborative Filtering (CF) model. The techniques further include calculating, for the respective network interactions, an outlier score based on the recommendation score. The techniques further include generating a notification identifying an anomaly in the network traffic based on at least one outlier score satisfying a threshold.

Abstract: A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Abstract: A method of performing automatic tuning on a deep learning model includes: utilizing an instruction-based learned cost model to estimate a first type of operational performance metrics based on a tuned configuration of layer fusion and tensor tiling; utilizing statistical data gathered during a compilation process of the deep learning model to determine a second type of operational performance metrics based on the tuned configuration of layer fusion and tensor tiling; performing an auto-tuning process to obtain a plurality of optimal configurations based on the first type of operational performance metrics and the second type of operational performance metrics; and configure the deep learning model according to one of the plurality of optimal configurations.

Abstract: A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.

Abstract: An embodiment of the present invention is directed toward machine learning to produce results encompassing a new output. A machine learning model is trained to determine a candidate output from among a plurality of candidate outputs. First embeddings associated with the plurality of candidate outputs are generated from a first set of training data by an intermediate layer of the trained machine learning model. Second embeddings associated with a new candidate output are generated from a second set of training data by the intermediate layer of the trained machine learning model. A third embedding is determined for input data by the intermediate layer of the trained machine learning model. A resulting candidate output for the input data is predicted from a group of the plurality of candidate outputs and the new candidate output based on distances for the third embedding to the first and second embeddings.

Abstract: A method for receiving a full training data set including a plurality of individual training data set, dividing the plurality of individual training sets into N classes, where N is an integer greater than three, dividing the N classes into M full data classes and N-M partial data classes, performing training to obtain a trained fixed size machine learning (ML) classification model and a trained in-class confidence model, outputting a first set of prediction value(s) based on the performance of training, distributing each class of the N classes of individual training data sets to a different node of a distributed machine learning system; and outputting, from the nodes of the distributed machine learning system, a second set of prediction value(s) for each class of the N classes.

Abstract: A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Abstract: A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.