Abstract: Systems and methods for implementing sequence data based temporal behavior analysis (SDTBA) to extract features for characterizing temporal behavior of network traffic are provided. The method includes extracting communication and profile data associated with one or more devices to determine sequences of data associated with the devices. The method includes generating temporal features to model anomalous network traffic. The method also includes inputting, into an anomaly detection process for anomalous network traffic, the temporal features and the sequences of data associated with the devices and formulating a list of prediction results of anomalous network traffic associated with the devices.

Abstract: A computer-implemented method is provided for cross-lingual transfer. The method includes randomly masking a source corpus and a target corpus to obtain a masked source corpus and a masked target corpus. The method further includes tokenizing, by pretrained Natural Language Processing (NLP) models, the masked source corpus and the masked target corpus to obtain source tokens and target tokens. The method also includes transforming the source tokens and the target tokens into a source dependency parsing tree and a target dependency parsing tree. The method additionally includes inputting the source dependency parsing tree and the target dependency parsing tree into a graph encoder pretrained on a translation language modeling task to extract common language information for transfer. The method further includes fine-tuning the graph encoder and a down-stream network for a specific NLP down-stream task.

Abstract: A method for managing data of dialysis patients by employing a Deep Dynamic Gaussian Mixture (DDGM) model to forecast medical time series data is presented. The method includes filling missing values in an input multivariate time series by model parameters, via a pre-imputation component, by using a temporal intensity function based on Gaussian kernels and multi-dimensional correlation based on correlation parameters to be learned and storing, via a forecasting component, parameters that represent cluster centroids used by the DDGM to cluster time series for capturing correlations between different time series samples.

Abstract: An image detection method for selecting a representative image of a user is provided. In the image detection method, a plurality of images of the user are obtained, and a plurality of feature parameters of the plurality of images are obtained. A face occlusion analysis is performed on the plurality of images according to the plurality of feature parameters to determine whether the plurality of images clearly show the user's face. A plurality of feature vectors are determined, and a body distribution analysis is performed on the plurality of images according to the plurality of feature vectors to determine a body position and a position type of the user. An image related to the position type is selected according to results of the face occlusion analysis and the body distribution analysis.

Abstract: A method trains a recursive reasoning unit (RRU). The method receives a graph for a set of words and a matrix for a different set of words. The graph maps each word in the set of words to a node with node label and indicates a relation between adjacent nodes by an edge with edge label. The matrix indicates word co-occurrence frequency of the different set of words. The method discovers, by the RRU, reasoning paths from the graph for word pairs by mapping word pairs from the set of words into a source word and a destination word and finding the reasoning paths therebetween. The method predicts word co-occurrence frequency using the reasoning paths. The method updates, responsive to the word co-occurrence frequency, model parameters of the RRU until a difference between a predicted and true word occurrence are less than a threshold amount to provide a trained RRU.

Abstract: A method performs actions based on business need matching. A set of business need documents are filtered for relevance with respect to a query business need document to remove irrelevant documents based on business need relevance criteria. Hidden business intentions in remaining business need documents are extracted from the set after the filtering. For the query document with respect to the remaining business need documents, the following are computed: a business intention-based matching score, a business entity-based matching score, and an action modeling based matching score. Using an ensemble method, the scores are integrated into a final score, where higher scoring ones of the remaining business need documents more match a business need of the query business need document. Using an automated manufacturing system, a hardware item is co-manufactured responsive to a joint manufacturing venture derived from the final score.

Abstract: A method for training a predictive model includes training a dual-channel neural network model, which includes a static channel to process static information and a dynamic channel to process temporal information, to generate a probability score that characterizes a likelihood of a health event occurring during a dialysis procedure, based on static profile information and temporal measurement information. An augmented model is trained to generate an importance score associated with the probability score, based on the static profile information and the temporal measurement information.

Abstract: Systems and methods for predicting system device failure are provided. The method includes performing graph-based predictive maintenance (GBPM) to determine a trained ensemble classification model for detecting maintenance ready components that includes extracted node features and graph features. The method includes constructing, based on testing data and the trained ensemble classification model, an attributed temporal graph and the extracted node features and graph features. The method further includes concatenating the extracted node features and graph features. The method also includes determining, based on the trained ensemble classification model, a list of prediction results of components that are to be scheduled for component maintenance.

Abstract: An image sleep analysis method and system thereof are disclosed. During sleep duration, a plurality of visible-light images of a body are obtained. Positions of image differences are determined by comparing the visible-light images. A plurality of features of the visible-light images are identified and positions of the features are determined. According to the positions of the image differences and features, the motion intensities of the features are determined. Therefore, a variation of the motion intensities is analyzed and recorded to provide accurate sleep quality.

Abstract: A method for detecting spoofing attacks from network traffic log data is presented. The method includes training a spoofing attack detector with the network traffic log data received from one or more mobile networks by extracting features that are relevant to spoofing attacks for training data, building a first set of vector representations for the network traffic log data, training an anomaly detection model by employing DAGMM, and obtaining learned parameters of DAGMM. The method includes testing the spoofing attack detector with the network traffic log data received from the one or more mobile networks by extracting features that are relevant to spoofing attacks for testing data, building a second set of vector representations for the network traffic log data, obtaining latent representations of the testing data, computing a z-score of the testing data, and creating a spoofing attack alert report listing traffic logs generating z-scores exceeding a predetermined threshold.

Abstract: Systems and methods for implementing heterogeneous feature integration for device behavior analysis (HFIDBA) are provided. The method includes representing each of multiple devices as a sequence of vectors for communications and as a separate vector for a device profile. The method also includes extracting static features, temporal features, and deep embedded features from the sequence of vectors to represent behavior of each device. The method further includes determining, by a processor device, a status of a device based on vector representations of each of the multiple devices.

Abstract: A computer-implemented method executed by at least one processor for software bug localization is presented. The method includes constructing a bug localization graph to capture relationships between bug tickets and relevant source code files from historical change-sets and an underlying source code repository, leveraging natural processing language tools to evaluate semantic similarity between a new bug ticket and a historical ticket, in response to the evaluated semantic similarity, for the new bug ticket, adding links between the new bug ticket a set of similar historical tickets, incorporating the new bug ticket in the bug localization graph, and developing a mathematical graph expression to determine a closeness relationship between the relevant source code files and the new bug ticket.

Abstract: A method for employing a unified semi-supervised deep learning (DL) framework for turbulence forecasting is presented. The method includes extracting historical and forecasted weather features of a spatial region, calculating turbulence indexes to fill feature cubes, each feature cube representing a grid-based 3D region, and building an encoder-decoder framework based on convolutional long short-term memory (ConvLSTM) to model spatio-temporal correlations or patterns causing turbulence. The method further includes employing a dual label guessing component to dynamically integrate complementary signals from a turbulence forecasting network and a turbulence detection network to generate pseudo-labels, reweighing the generated pseudo-labels by a heuristic label quality detector based on KL-Divergence, applying a hybrid loss function to predict turbulence conditions, and generating a turbulence dataset including the predicted turbulence conditions.

Abstract: A method interprets a convolutional sequence model. The method converts an input data sequence having input segments into output features. The method clusters the input segments into clusters using respective resolution-controllable class prototypes allocated to each of classes. Each respective class prototype includes a respective output feature subset characterizing a respective associated class. The method calculates, using the clusters, similarity scores that indicate a similarity of an output feature to a respective class prototypes responsive to distances between the output feature and the respective class prototypes. The method concatenates the similarity scores to obtain a similarity vector. The method performs a prediction and prediction support operation that provides a value of prediction and an interpretation for the value responsive to the input segments and similarity vector.

Abstract: A method for implementing graph-based reinforced text representation learning (GRTR) is presented. The method includes, in a training phase, generating a dependency tree for training text data, training a GRTR agent by learning to navigate in the dependency tree and selectively collecting semantic information, learning GRTR agents, and storing, in a GRTR-specific memory, parameters of the learned GRTR agents. The method further includes, in a testing phase, generating a dependency tree for testing the text data, retrieving and evaluating the learned GRTR agents of the training phase to evaluate testing samples, making task-specific decisions for the testing samples, and reporting the task-specific decisions to a computing device operated by a user.

Abstract: An image detection method is provided. In the image detection method, images of a user are obtained, feature parameters are marked in the images, and detection results of the feature parameters in each of the images are evaluated. A body distribution analysis is performed on the images according to the detection result of at least one first feature parameter among the feature parameters to determine first position information of the user. A face occlusion analysis is performed on the images according to the detection result of at least one second feature parameter among the feature parameters and the first position information to determine second position information of the user. The at least one second feature parameter is different from the at least one first feature parameter. The second position information represents a position of the user.

Abstract: Systems and methods for automatically generating a set of meta-parameters used to train invariant-based anomaly detectors are provided. Data is transformed into a first set of time series data and a second set of time series data. A fitness threshold search is performed on the first set of time series data to automatically generate a fitness threshold, and a time resolution search is performed on the set of second time series data to automatically generate a time resolution. A set of meta-parameters including the fitness threshold and the time resolution are sent to one or more user devices across a network to govern the training of an invariant-based anomaly detector.

Abstract: Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by a network gateway system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the network gateway system responsive to the determination that the received packet has a spoofed source IP address.

Abstract: Systems and methods for preventing cyberattacks using a Density Estimation Network (DEN) for unsupervised anomaly detection, including constructing the DEN using acquired network traffic data by performing end-to-end training. The training includes generating low-dimensional vector representations of the network traffic data by performing dimensionality reduction of the network traffic data, predicting mixture membership distribution parameters for each of the low-dimensional representations by performing density estimation using a Gaussian Mixture Model (GMM) framework, and formulating an objective function to estimate an energy and determine a density level of the low-dimensional representations for anomaly detection, with an anomaly being identified when the energy exceeds a pre-defined threshold. Cyberattacks are prevented by blocking transmission of network flows with identified anomalies by directly filtering out the flows using a network traffic monitor.

Abstract: Methods and systems for performing a knowledge graph task include aligning multiple knowledge graphs and performing a knowledge graph task using the aligned multiple knowledge graphs. Aligning the multiple knowledge graphs includes updating entity representations based on representations of neighboring entities within each knowledge graph, updating entity representations based on representations of entities from different knowledge graphs, and learning machine learning model parameters to align the multiple knowledge graphs, based on the updated entity representations.