Abstract: A system for detecting cyber security events can include a processor to generate a first set of a plurality of time series and aggregate statistics based on a plurality of properties corresponding to user actions for each user in a set of users. The processor can also separate the set of users into a plurality of clusters based on the first set of the plurality of time series or aggregate statistics for each user and assign an identifier to each of the plurality of clusters. Additionally, the processor can generate a second set of a plurality of time series based on properties of the plurality of clusters, wherein the properties of a cluster correspond to a membership, a diameter, and a centroid and detect an anomaly based on a new value stored in the second set of the time series. Furthermore, the processor can execute a prevention instruction.

Abstract: A method comprising using at least one hardware processor for: receiving a topic under consideration (TUC) and content relevant to the TUC; detecting one or more claims relevant to the TUC in the content, based on detection of boundaries of the claims in the content; and outputting a list of said detected one or more claims.

Abstract: A method comprising using at least one hardware processor for: receiving a context; identifying evidence with respect to the context in at least one content resource, wherein the identifying comprises: identifying context-free features that generally characterize evidence in the at least one content resource, and identifying context features indicative of the relevance of text segments in the at least one content resource to the context; and outputting a list of said identified evidence.

Abstract: Embodiments include method, systems and computer program products for protecting sensitive data. Aspects include accessing computer readable program instructions having one or more output commands. Aspects also include locating the one or more output commands in the computer readable program instructions. Aspects also include identifying target output variables and output constants in the one or more output commands. Aspects also include modifying the computer readable program instructions to append one or more obfuscate commands to the target output variables.

Abstract: Detecting computer anomalies by determining probabilities of encountering call stack configurations at various depths, the call stacks being associated with software application instances on computers having the same operating system, where snapshots of the call stacks are recorded on the computers responsive to detecting predefined software application events, determining entropies of call stack configurations at various call stack depths using their associated probabilities, determining stack frame rarity scores of call stack configurations at various depths based on their associated stack frame entropies in accordance with a predefined rarity function, determining a call stack rarity score of any given call stack configuration as the maximum stack frame rarity score of the given configuration, and detecting an anomaly associated with any given one of the computers where any of the snapshots recorded on the given computer is of a call stack whose call stack rarity score meets a predefined anomaly condition.

Abstract: Detecting computer anomalies by determining probabilities of encountering call stack configurations at various depths, the call stacks being associated with software application instances on computers having the same operating system, where snapshots of the call stacks are recorded on the computers responsive to detecting predefined software application events, determining entropies of call stack configurations at various call stack depths using their associated probabilities, determining stack frame rarity scores of call stack configurations at various depths based on their associated stack frame entropies in accordance with a predefined rarity function, determining a call stack rarity score of any given call stack configuration as the maximum stack frame rarity score of the given configuration, and detecting an anomaly associated with any given one of the computers where any of the snapshots recorded on the given computer is of a call stack whose call stack rarity score meets a predefined anomaly condition.

Abstract: Embodiments of the present invention may provide the capability to identify security breaches in computer systems from clustering properties of clusters generated based on monitored behavior of users of the computer systems by using techniques that provide improved performance and reduced resource requirements. For example, behavior of users or resources may be monitored and analyzed to generate clusters and train clustering models. Labeling information relating to some user or resource may be received. When users or resources are clustered and when a cluster contains some labeled users/resources then an anomaly score can be determined for a user/resource belonging to the cluster. A user or resource may be detected to be an outlier of at least one cluster to which the user or resource has been assigned, and an alert indicating detection of the outlier may be generated.

Abstract: A method comprising using at least one hardware processor for: identifying relations between pairs of claims of a set of claims; aggregating the claims of the set of claims into a plurality of clusters based on the identified relations; generating a plurality of arguments from the plurality of clusters, wherein each of the arguments is generated from a cluster of the plurality of clusters, and wherein each of the arguments comprises at least one claim of the set of claims, scoring each possible set of a predefined number of arguments of the plurality of arguments, based on a quality of each argument of the predefined number of arguments and on diversity between the predefined number of arguments; and generating a speech, wherein the speech comprises a top scoring possible set of the possible set of the predefined number of arguments.

Abstract: Techniques for using a scaling relationship between crop drymass and elevation at a farm level to redistribute crop yield data are provided. In one aspect, a method for analyzing crop yield is provided. The method includes the steps of: obtaining crop yield data for a farm; cleansing the crop yield data using a data filter(s), wherein one or more data points are eliminated from the crop yield data by the data filter; and redistributing a value of the data points eliminated from the crop yield data to data points remaining in the crop yield data to create a crop yield distribution for the farm.

Abstract: Incremental generation of models with dynamic clustering. A first set of data is received. A first set of clusters based on the first set of data is generated. A respective first set of models for the first set of clusters is created. A second set of data is received. A second set of clusters, based on the second set of data and based on a subset of the first set of data, is generated. A respective second set of models for the second set of clusters, based on a subset of the first set of models and based on the second set of data, is created.

Abstract: Embodiments include method, systems and computer program products for protecting sensitive data. Aspects include accessing computer readable program instructions having one or more output commands. Aspects also include locating the one or more output commands in the computer readable program instructions. Aspects also include identifying target output variables and output constants in the one or more output commands. Aspects also include modifying the computer readable program instructions to append one or more obfuscate commands to the target output variables.

Abstract: Detecting computer anomalies by determining probabilities of encountering call stack configurations at various depths, the call stacks being associated with software application instances on computers having the same operating system, where snapshots of the call stacks are recorded on the computers responsive to detecting predefined software application events, determining entropies of call stack configurations at various call stack depths using their associated probabilities, determining stack frame rarity scores of call stack configurations at various depths based on their associated stack frame entropies in accordance with a predefined rarity function, determining a call stack rarity score of any given call stack configuration as the maximum stack frame rarity score of the given configuration, and detecting an anomaly associated with any given one of the computers where any of the snapshots recorded on the given computer is of a call stack whose call stack rarity score meets a predefined anomaly condition.

Abstract: Detecting computer anomalies by determining probabilities of encountering call stack configurations at various depths, the call stacks being associated with software application instances on computers having the same operating system, where snapshots of the call stacks are recorded on the computers responsive to detecting predefined software application events, determining entropies of call stack configurations at various call stack depths using their associated probabilities, determining stack frame rarity scores of call stack configurations at various depths based on their associated stack frame entropies in accordance with a predefined rarity function, determining a call stack rarity score of any given call stack configuration as the maximum stack frame rarity score of the given configuration, and detecting an anomaly associated with any given one of the computers where any of the snapshots recorded on the given computer is of a call stack whose call stack rarity score meets a predefined anomaly condition.

Abstract: A method comprising using at least one hardware processor for: receiving (a) a proposition and (b) a plurality of claims; identifying a local claim polarity of each claim of the plurality of claims with respect to the proposition; calculating a pairwise claim polarity agreement score for each pair of claims of the pairs of claims reflecting the likelihood of said each pair of claims to have the same claim polarity, wherein the pairwise claim polarity agreement score is associated with each claim of the pair of claims; and determining a global claim polarity for each claim of the plurality of claims based on the local claim polarity of the claim and pairwise claim polarity agreement scores associated with said each claim.

Abstract: A computer receives human generated reference strings and determines the character, n-gram, type switch, and subtype switch distributions of the reference strings. Each of the aforementioned distributions include corresponding statistical data, such as an average frequency, maximum frequency, minimum frequency, and standard deviation. The computer then receives one or more test strings from which the computer similarly computes the aforementioned statistical data for each of the aforementioned distributions. The computer then compares the distributions of the test string(s) with the distributions of the reference strings. Based on the deviation of the test string distributions from the reference string distributions, the computer determines whether the test strings are human or machine generated.

Abstract: A method comprising using at least one hardware processor for: receiving a context; identifying evidence with respect to the context in at least one content resource, wherein the identifying comprises: identifying context-free features that generally characterize evidence in the at least one content resource, and identifying context features indicative of the relevance of text segments in the at least one content resource to the context; and outputting a list of said identified evidence.

Abstract: A method comprising using at least one hardware processor for: receiving (a) a proposition and (b) a plurality of claims; identifying a local claim polarity of each claim of the plurality of claims with respect to the proposition; calculating a pairwise claim polarity agreement score for each pair of claims of the pairs of claims reflecting the likelihood of said each pair of claims to have the same claim polarity, wherein the pairwise claim polarity agreement score is associated with each claim of the pair of claims; and determining a global claim polarity for each claim of the plurality of claims based on the local claim polarity of the claim and pairwise claim polarity agreement scores associated with said each claim.

Abstract: Embodiments include method, systems and computer program products for protecting sensitive data. Aspects include accessing computer readable program instructions having one or more output commands. Aspects also include locating the one or more output commands in the computer readable program instructions. Aspects also include identifying target output variables and output constants in the one or more output commands. Aspects also include modifying the computer readable program instructions to append one or more obfuscate commands to the target output variables.

Abstract: A method comprising using at least one hardware processor for: receiving a topic under consideration (TUC) and content relevant to the TUC; detecting one or more claims relevant to the TUC in the content, based on detection of boundaries of the claims in the content; and outputting a list of said detected one or more claims.

Abstract: A method, apparatus and product useful for classification reliability prediction. The method being a computer-implemented method performed by a processor, the method comprising: obtaining a prediction of a label for a dataset made by a classifier tool, wherein the classifier tool is aimed at predicting the label based on a classification model and in view of a set of features defining the dataset; obtaining a reliability prediction of a reliability label relating to the prediction of the classifier tool based on a reliability classifier tool, wherein the reliability classifier tool is aimed at predicting the reliability label based on a classification model and in view of a second set of features; and outputting to a user the label prediction and an associated reliability prediction.