Abstract: A processor can be configured to receive data associated with, and/or access to, a computing system's file system structure. The processor can also be configured to determine file patterns, file path patterns and/or graph patterns associated with the computing system. The processor can also be configured to build a graph structure having nodes and edges, the graph structure representing the file patterns, file path patterns and graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files. The processor can also be configured to train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file. The processor can also be configured to train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target.

Abstract: Mechanisms are provided for detecting adversarial attacks on graph data structures. A first graph fingerprint engine generates, for a first graph data structure, a first fingerprint data structure-based on features extracted from the first graph data structure. A second graph data structure is received, and a second graph fingerprint engine generates a second graph fingerprint data structure based on features extracted from the second graph data structure. An adversarial attack detection engine compares the first fingerprint data structure to the second fingerprint data structure to determine whether the first fingerprint data structure matches the second fingerprint data structure. In response to the first fingerprint data structure not matching the second fingerprint data structure, the adversarial attack detection engine outputs an output indicating that the second data structure corresponds to an adversarial attack.

Abstract: According to one embodiment, a computer-implemented method for dynamic, cognitive hybrid positioning within an indoor environment includes: receiving fingerprinting training data corresponding to the indoor environment, trilateration data corresponding to the indoor environment, triangulation data corresponding to the indoor environment, or a combination of the fingerprinting training data, the trilateration data, and/or the triangulation data; estimating a layout of the indoor environment based at least in part on the fingerprinting training data; classifying at least some areas of the estimated layout according to one of a plurality of predetermined area types; and determining an optimum positioning technique to utilize for each area of the estimated layout, wherein the optimum positioning technique is determined based at least in part on the area type.

Abstract: Systems and techniques that facilitate empathetic or emotional query response are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory that can execute the computer executable components stored in memory. The computer executable components can comprise a first machine learning model that generates a first response portion, wherein the first response portion comprises a technical response to the input query, and a second machine learning model that generates a second response portion, wherein the second response portion comprises an empathetic or emotional response to the emotion portion of the input query.

Abstract: Systems and techniques that facilitate empathetic or emotional query response are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory that can execute the computer executable components stored in memory. The computer executable components can comprise a first machine learning model that generates a first response portion, wherein the first response portion comprises a technical response to the input query, and a second machine learning model that generates a second response portion, wherein the second response portion comprises an empathetic or emotional response to the emotion portion of the input query.

Abstract: A system for optimizing deployment of a machine learning workload is provided. A computer device receives information pertaining to a machine learning workload to be processed for a client device. The computer device determines a machine learning model for the workload and a processing location for the workload based, at least in part, on the information. The computer device generates a request to process the workload at the determined processing location utilizing the determined machine learning model.

Abstract: Embodiments of the invention are directed to a computer system that includes a memory electronically coupled to a processor system. The processor system is operable to perform processor system operations that include accessing a graph model representation of a computer network. The graph model is used to implement a resiliency-problem identification analysis that identifies a set of resiliency problems in the graph model. The graph model is used to apply a resiliency-problem solution analysis to a resiliency problem in the set of resiliency problems to generate a set of resiliency-problem solutions. Each resiliency-problem solution in the set of resiliency-problem solutions is ranked.

Abstract: A processor distributes, from a server, a trained supervised machine learning (ML) model and supervised and unsupervised feature information to a plurality of client devices; at each client device, trains the supervised ML model using local data to generate a local supervised ML model, constructs a local unsupervised ML model using the unsupervised feature information, and deploys the local supervised and unsupervised ML models; determining when a detection performance difference between the local supervised and unsupervised ML models reaches a threshold; identifies a proposed change to the supervised or unsupervised feature information; deploys the proposed change on one client device; responsive to determining the proposed change improves the detection performance of that client device, communicates the proposed change to a sampled set of client devices; and responsive to determining the proposed change improves the detection performance of a majority of the sampled set, communicates the proposed change to

Abstract: Techniques for data integration and labeling are provided. Training real-world signal data is collected for a physical environment, where the training real-world signal data comprises at least one of (i) coordinate information or (ii) a direction to move. Simulated signal data is generated for a first portion of the physical environment, and an aggregate data set is generated comprising the training real-world signal data and the simulated signal data. A machine learning (ML) model is trained using the aggregate data set. A first real-world data point is received, where the first real-world data point does not include coordinate information, and the first real-world data point is labeled based at least in part on coordinate information of the aggregate data set.

Abstract: A processor distributes, from a server, a trained supervised machine learning (ML) model and supervised and unsupervised feature information to a plurality of client devices; at each client device, trains the supervised ML model using local data to generate a local supervised ML model, constructs a local unsupervised ML model using the unsupervised feature information, and deploys the local supervised and unsupervised ML models; determining when a detection performance difference between the local supervised and unsupervised ML models reaches a threshold; identifies a proposed change to the supervised or unsupervised feature information; deploys the proposed change on one client device; responsive to determining the proposed change improves the detection performance of that client device, communicates the proposed change to a sampled set of client devices; and responsive to determining the proposed change improves the detection performance of a majority of the sampled set, communicates the proposed change to

Abstract: A computer-implemented method according to one embodiment includes receiving historical two-dimensional (2D) multivariate time series data; transforming the historical 2D multivariate time series data into a three-dimensional (3D) temporal tensor; training one or more deep volumetric 3D convolutional neural networks (CNNs), utilizing the 3D temporal tensor; and predicting future values for additional multivariate time series data, utilizing the one or more trained deep volumetric 3D CNNs.

Abstract: A method, computer system, and a computer program for quick disaster recovery of cloud-native environments is provided. The present invention may include replicating at a secondary server site software executing in a cloud-native environment on a primary server site. The present invention may also include detecting a failure associated with the software executing in the cloud-native environment. The present invention may then include whether the detected failure is causing down time for the software executing in the cloud environment. The present invention may further include deploying the replicated software on the secondary server site in response to determining that the detected failure is causing down time.

Abstract: A method, computer system, and a computer program for quick disaster recovery of cloud-native environments is provided. The present invention may include replicating at a secondary server site software executing in a cloud-native environment on a primary server site. The present invention may also include detecting a failure associated with the software executing in the cloud-native environment. The present invention may then include whether the detected failure is causing down time for the software executing in the cloud environment. The present invention may further include deploying the replicated software on the secondary server site in response to determining that the detected failure is causing down time.

Abstract: A system, computer program product, and method are provided to graph neural network (GNN) ensemble learning. Training data is represented in a graph format, from which two or more subgraphs are sampled. Two or more GNNs are training from feature space sampled from the subgraphs. The GNN ensemble is built from the trained GNNs, and subject to testing data. Application of the testing data to the GNN ensemble generates output in the form of an ensemble value, with the output configured to interface with and selectively control an operatively coupled physical hardware device or software.

Abstract: Systems and methods are described for a data breach detection based on snapshot analytics. The described systems and methods identify a plurality of snapshots of a data structure, identify a plurality of leaf nodes of the data structure for each of the snapshots, generate a vector of data attributes for each of the leaf nodes, assign a weight to each of the vectors to produce a set of weighted vectors for each of the snapshots, compute a distance metric between each pair of the snapshots based on the corresponding sets of weighted vectors, and detect an abnormal snapshot among the plurality of snapshots based on the distance metrics.

Abstract: A system for optimizing deployment of a machine learning workload is provided. A computer device receives information pertaining to a machine learning workload to be processed for a client device. The computer device determines a machine learning model for the workload and a processing location for the workload based, at least in part, on the information. The computer device generates a request to process the workload at the determined processing location utilizing the determined machine learning model.

Abstract: Methods and systems for training a neural network include transmitting a first request for training data. The request includes information about the training data and information about a neural network model. A reduced training dataset is received that includes minimal viable data, responsive to the first request. A reconstructed training dataset is generated from the reduced training dataset. The model is trained using the reconstructed dataset.

Abstract: A method, computer system, and a computer program product for matching one or more users is provided. The present invention may include collecting a user's information. The present invention may include determining that there is an overlap between the user's information and information contained within a knowledge base. The present invention may include ranking one or more matches of the user. The present invention may include displaying the ranked one or more matches to the user. The present invention may include collecting feedback from the user.

Abstract: According to various embodiments, systems, computer program products, and computer implemented methods for cognitive location and navigation services for custom applications are disclosed. More specifically, the cognitive location and navigation services include, but are not limited to cognitive navigational guidance through a tourist attraction. For instance, a method includes receiving a request for cognitive navigational assistance through a tourist attraction; obtaining site-specific information about the tourist attraction from a site-specific server; determining whether a user profile describing user viewing preferences exists; and either: directing the user to navigate through the tourist attraction according to a path based on the existing user profile; or recommending a first exhibit to visit based at least in part on crowding levels at the tourist attraction and recording user behavior observed while viewing the first exhibit. Corresponding systems and computer program products are also disclosed.

Abstract: A plurality of executing microservices associated with respective features of an application are managed using a computer. The microservices are operating within a container orchestrator platform. Calls made to a plurality of microservices related to an application running on a container orchestrator platform are traces by the computer. A status map is generated by the computer of the plurality of microservices related to the application based on the tracing of the calls. The status map is published such that the status map is accessible to the plurality of microservices, and an action by one of the microservices of the plurality of microservices in response to the status map is initiated.