Abstract: Mechanisms for classifying electronic documents as to representation of natural conversations are provided. The mechanisms train one or more computer models to identify instances of natural conversation features in a plurality of natural conversation features. The trained computer model(s) process a document to identify instances of natural conversation features within the document. The mechanisms generate quantitative measures of conversational representation based on the identified instances of natural conversation features. The mechanisms classify the document based on the quantitative measures of conversational representation into one of a plurality of predefined classes of conversational representation, and outputting the classification for performance of a downstream computing operation based on the classification of the document.

Abstract: According to one embodiment, a method, computer system, and computer program product for generating natural conversation content for training conversational artificial intelligence (AI) systems is provided. The present invention may include receiving conversation content comprising one or more conversation sequences; assigning one or more labels to one or more utterances comprising the conversation sequences using a machine learning-based intent classifier to produce a plurality of labeled conversation content; determining if a confidence score for at least one of the assigned labels is below a predetermined threshold; determining at least one variant operation of a plurality of variant operations to perform on the labeled conversation content using a natural conversation variator; and performing the at least one operation of the plurality of variant operations on the labeled conversation content using the natural conversation variator to generate one or more variations of the labeled conversation content.

Abstract: Mechanisms are provided for detecting adversarial attacks on graph data structures. A first graph fingerprint engine generates, for a first graph data structure, a first fingerprint data structure-based on features extracted from the first graph data structure. A second graph data structure is received, and a second graph fingerprint engine generates a second graph fingerprint data structure based on features extracted from the second graph data structure. An adversarial attack detection engine compares the first fingerprint data structure to the second fingerprint data structure to determine whether the first fingerprint data structure matches the second fingerprint data structure. In response to the first fingerprint data structure not matching the second fingerprint data structure, the adversarial attack detection engine outputs an output indicating that the second data structure corresponds to an adversarial attack.

Abstract: A processor can be configured to receive data associated with, and/or access to, a computing system's file system structure. The processor can also be configured to determine file patterns, file path patterns and/or graph patterns associated with the computing system. The processor can also be configured to build a graph structure having nodes and edges, the graph structure representing the file patterns, file path patterns and graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files. The processor can also be configured to train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file. The processor can also be configured to train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target.

Abstract: Mechanisms are provided for detecting adversarial attacks on graph data structures. A first graph fingerprint engine generates, for a first graph data structure, a first fingerprint data structure-based on features extracted from the first graph data structure. A second graph data structure is received, and a second graph fingerprint engine generates a second graph fingerprint data structure based on features extracted from the second graph data structure. An adversarial attack detection engine compares the first fingerprint data structure to the second fingerprint data structure to determine whether the first fingerprint data structure matches the second fingerprint data structure. In response to the first fingerprint data structure not matching the second fingerprint data structure, the adversarial attack detection engine outputs an output indicating that the second data structure corresponds to an adversarial attack.

Abstract: According to one embodiment, a computer-implemented method for dynamic, cognitive hybrid positioning within an indoor environment includes: receiving fingerprinting training data corresponding to the indoor environment, trilateration data corresponding to the indoor environment, triangulation data corresponding to the indoor environment, or a combination of the fingerprinting training data, the trilateration data, and/or the triangulation data; estimating a layout of the indoor environment based at least in part on the fingerprinting training data; classifying at least some areas of the estimated layout according to one of a plurality of predetermined area types; and determining an optimum positioning technique to utilize for each area of the estimated layout, wherein the optimum positioning technique is determined based at least in part on the area type.

Abstract: Systems and techniques that facilitate empathetic or emotional query response are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory that can execute the computer executable components stored in memory. The computer executable components can comprise a first machine learning model that generates a first response portion, wherein the first response portion comprises a technical response to the input query, and a second machine learning model that generates a second response portion, wherein the second response portion comprises an empathetic or emotional response to the emotion portion of the input query.

Abstract: Systems and techniques that facilitate empathetic or emotional query response are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory that can execute the computer executable components stored in memory. The computer executable components can comprise a first machine learning model that generates a first response portion, wherein the first response portion comprises a technical response to the input query, and a second machine learning model that generates a second response portion, wherein the second response portion comprises an empathetic or emotional response to the emotion portion of the input query.

Abstract: A system for optimizing deployment of a machine learning workload is provided. A computer device receives information pertaining to a machine learning workload to be processed for a client device. The computer device determines a machine learning model for the workload and a processing location for the workload based, at least in part, on the information. The computer device generates a request to process the workload at the determined processing location utilizing the determined machine learning model.

Abstract: Embodiments of the invention are directed to a computer system that includes a memory electronically coupled to a processor system. The processor system is operable to perform processor system operations that include accessing a graph model representation of a computer network. The graph model is used to implement a resiliency-problem identification analysis that identifies a set of resiliency problems in the graph model. The graph model is used to apply a resiliency-problem solution analysis to a resiliency problem in the set of resiliency problems to generate a set of resiliency-problem solutions. Each resiliency-problem solution in the set of resiliency-problem solutions is ranked.

Abstract: A processor distributes, from a server, a trained supervised machine learning (ML) model and supervised and unsupervised feature information to a plurality of client devices; at each client device, trains the supervised ML model using local data to generate a local supervised ML model, constructs a local unsupervised ML model using the unsupervised feature information, and deploys the local supervised and unsupervised ML models; determining when a detection performance difference between the local supervised and unsupervised ML models reaches a threshold; identifies a proposed change to the supervised or unsupervised feature information; deploys the proposed change on one client device; responsive to determining the proposed change improves the detection performance of that client device, communicates the proposed change to a sampled set of client devices; and responsive to determining the proposed change improves the detection performance of a majority of the sampled set, communicates the proposed change to

Abstract: Techniques for data integration and labeling are provided. Training real-world signal data is collected for a physical environment, where the training real-world signal data comprises at least one of (i) coordinate information or (ii) a direction to move. Simulated signal data is generated for a first portion of the physical environment, and an aggregate data set is generated comprising the training real-world signal data and the simulated signal data. A machine learning (ML) model is trained using the aggregate data set. A first real-world data point is received, where the first real-world data point does not include coordinate information, and the first real-world data point is labeled based at least in part on coordinate information of the aggregate data set.

Abstract: A processor distributes, from a server, a trained supervised machine learning (ML) model and supervised and unsupervised feature information to a plurality of client devices; at each client device, trains the supervised ML model using local data to generate a local supervised ML model, constructs a local unsupervised ML model using the unsupervised feature information, and deploys the local supervised and unsupervised ML models; determining when a detection performance difference between the local supervised and unsupervised ML models reaches a threshold; identifies a proposed change to the supervised or unsupervised feature information; deploys the proposed change on one client device; responsive to determining the proposed change improves the detection performance of that client device, communicates the proposed change to a sampled set of client devices; and responsive to determining the proposed change improves the detection performance of a majority of the sampled set, communicates the proposed change to

Abstract: A computer-implemented method according to one embodiment includes receiving historical two-dimensional (2D) multivariate time series data; transforming the historical 2D multivariate time series data into a three-dimensional (3D) temporal tensor; training one or more deep volumetric 3D convolutional neural networks (CNNs), utilizing the 3D temporal tensor; and predicting future values for additional multivariate time series data, utilizing the one or more trained deep volumetric 3D CNNs.

Abstract: A method, computer system, and a computer program for quick disaster recovery of cloud-native environments is provided. The present invention may include replicating at a secondary server site software executing in a cloud-native environment on a primary server site. The present invention may also include detecting a failure associated with the software executing in the cloud-native environment. The present invention may then include whether the detected failure is causing down time for the software executing in the cloud environment. The present invention may further include deploying the replicated software on the secondary server site in response to determining that the detected failure is causing down time.

Abstract: A method, computer system, and a computer program for quick disaster recovery of cloud-native environments is provided. The present invention may include replicating at a secondary server site software executing in a cloud-native environment on a primary server site. The present invention may also include detecting a failure associated with the software executing in the cloud-native environment. The present invention may then include whether the detected failure is causing down time for the software executing in the cloud environment. The present invention may further include deploying the replicated software on the secondary server site in response to determining that the detected failure is causing down time.

Abstract: A system, computer program product, and method are provided to graph neural network (GNN) ensemble learning. Training data is represented in a graph format, from which two or more subgraphs are sampled. Two or more GNNs are training from feature space sampled from the subgraphs. The GNN ensemble is built from the trained GNNs, and subject to testing data. Application of the testing data to the GNN ensemble generates output in the form of an ensemble value, with the output configured to interface with and selectively control an operatively coupled physical hardware device or software.

Abstract: Systems and methods are described for a data breach detection based on snapshot analytics. The described systems and methods identify a plurality of snapshots of a data structure, identify a plurality of leaf nodes of the data structure for each of the snapshots, generate a vector of data attributes for each of the leaf nodes, assign a weight to each of the vectors to produce a set of weighted vectors for each of the snapshots, compute a distance metric between each pair of the snapshots based on the corresponding sets of weighted vectors, and detect an abnormal snapshot among the plurality of snapshots based on the distance metrics.

Abstract: A system for optimizing deployment of a machine learning workload is provided. A computer device receives information pertaining to a machine learning workload to be processed for a client device. The computer device determines a machine learning model for the workload and a processing location for the workload based, at least in part, on the information. The computer device generates a request to process the workload at the determined processing location utilizing the determined machine learning model.

Abstract: Methods and systems for training a neural network include transmitting a first request for training data. The request includes information about the training data and information about a neural network model. A reduced training dataset is received that includes minimal viable data, responsive to the first request. A reconstructed training dataset is generated from the reduced training dataset. The model is trained using the reconstructed dataset.