Abstract: Performing anomaly lookup on data sources that include an entity related to an alert. One or more entities related to an alert and a date when the alert occurred are received. The alert may indicate that an anomaly in data collected from a various data sources may be present in at least one of the data sources. The various data sources are searched for the one or more entities around the alert date to determine which of the data sources include the one or more entities. For those data sources including the one or more entities, an anomaly lookup procedure is performed on the data sources during a first time window to determine an initial set of suspicious anomalies.

Abstract: A system includes identification of a data source of a production environment, the data source storing authentic data, generation of simulated data of the data source, reception of a request for data of the data source from a requesting system in the production environment and, in response to the received request, providing of the simulated data to the requesting system. In some aspects, the simulated data is provided to the requesting system if it is determined that the request is related to an electronic attack, and the authentic data of the data source is provided to the requesting system if it is not determined that the request is related to an electronic attack.

Abstract: A computer-implemented filtering method comprising: receiving a set of propositions, each comprising a respective linguistic description expressed by a respective user; forming an input matrix of lexical components vs. propositions, wherein rows in the input matrix represent the propositions and columns in the input matrix represent lexical components in the respective descriptions; performing a matrix factorization on the input matrix to reveal latent clusters of the lexical components and/or propositions; filtering the set of propositions based on one or more of the latent clusters; and outputting a result of the filtering to a target user.

Abstract: Performing anomaly lookup on data sources that include an entity related to an alert. One or more entities related to an alert and a date when the alert occurred are received. The alert may indicate that an anomaly in data collected from a various data sources may be present in at least one of the data sources. The various data sources are searched for the one or more entities around the alert date to determine which of the data sources include the one or more entities. For those data sources including the one or more entities, an anomaly lookup procedure is performed on the data sources during a first time window to determine an initial set of suspicious anomalies.

Abstract: A system for identifying abnormal resource usage in a data center is provided. In some embodiments, the system employs a prediction model for each of a plurality of resources and an abnormal resource usage criterion. For each of a plurality of resources of the data center, the system retrieves current resource usage data for a current time and past resource usage data for that resource. The system then extracts features from the past resource usage data for that resource, predicts using the prediction model for that resource usage data for the current time based on the extracted features, and determines an error between the predicted resource usage data and the current resource usage data. After determining the error data for the resources, the system determines whether errors satisfy the abnormal resource usage criterion. If so, the system indicates that an abnormal resource usage has occurred.

Abstract: In an example embodiment, a computer-implemented method comprises obtaining labels from messages associated with an email service provider, wherein the labels indicate for each message IP how many spam and non-spam messages have been received; obtaining network data features from a cloud service provider; providing the labels and network data features to a machine learning application; generating a prediction model representing an algorithm for determining whether a particular set of network data features are spam or not; applying the prediction model to network data features for an unlabeled message; and generating an output of the prediction model indicating a likelihood that the unlabeled message is spam.

Abstract: A system for detecting an attack by a virtual or physical machine on one or more auto-generated websites is provided. The system includes a processor, a memory, and an application. The application is stored in the memory and includes instructions, which are executable by the processor. The instructions are configured to: access an index of a search engine server computer and determine uniform resource locators (URLs) of auto-generated websites, where the auto-generated websites include the one or more auto-generated websites; and access Internet protocol (IP) address-URL entries stored in a domain name system server computer.

Abstract: A system includes identification of a data source of a production environment, the data source storing authentic data, generation of simulated data of the data source, reception of a request for data of the data source from a requesting system in the production environment and, in response to the received request, providing of the simulated data to the requesting system. In some aspects, the simulated data is provided to the requesting system if it is determined that the request is related to an electronic attack, and the authentic data of the data source is provided to the requesting system if it is not determined that the request is related to an electronic attack.

Abstract: A method that includes accessing, from a database, a correlation between a first variable and a second variable; retrieving a list of suggested user behavior modifications for the correlation; selecting a user behavior modification from the list; presenting the selected user behavior modification to a computer device; receiving adherence data indicating a level of adherence by the user to the user behavior modification; and reevaluating the correlation between the first variable and the second variable based on the adherence data. The method may improve the determination of causality, versus merely correlation, between the variables. This determination may permit for improved recommendations to individuals to achieve a desired user outcome.

Abstract: Computerized systems and methods are provided for determining cumulative success-based recommendations for repeat users. One such method includes determining user and item latent-features based on matrix factorization applied to matrices that include recommendation and feedback events. The feedback events indicate previously provided user preferences for at least a portion of the items. An item-recommendation policy is determined based on a cumulative metric that includes an expected value for the accumulation of stochastic user-item rewards associated with future (or subsequent) recommendations. The accumulation of the rewards is based on the user latent-features, the item latent-features, and the previous rewards included in the feedback events. Machine learning, such as reinforcement learning (RL), is employed to determine the item-recommendation policy based on the feedback events.

Abstract: A computer-implemented filtering method comprising: receiving a set of propositions, each comprising a respective linguistic description expressed by a respective user; forming an input matrix of lexical components vs. propositions, wherein rows in the input matrix represent the propositions and columns in the input matrix represent lexical components in the respective descriptions; performing a matrix factorization on the input matrix to reveal latent clusters of the lexical components and/or propositions; filtering the set of propositions based on one or more of the latent clusters; and outputting a result of the filtering to a target user.

Abstract: Examples are disclosed that relate to providing healthcare-related information. One example provides a computing device comprising a logic machine and a storage machine holding instructions executable by the logic machine to receive an input of information regarding a health state of a user, obtain, based upon the information regarding the health state of the user, an inference of a possible health condition of the user, output a notification of the inference, the notification comprising a first representation of the inference, receive data representing a mechanism for authorizing a healthcare practitioner to access a second representation of the inference, and output a user-selectable control for triggering the mechanism. The instructions may be further executable to receive an input via the user-selectable control triggering the mechanism, and, in response, send authorization to provide the healthcare practitioner with access to the second representation of the inference.

Abstract: A system for detecting an attack by a virtual or physical machine on one or more auto-generated websites is provided. The system includes a processor, a memory, and an application. The application is stored in the memory and includes instructions, which are executable by the processor. The instructions are configured to: access an index of a search engine server computer and determine uniform resource locators (URLs) of auto-generated websites, where the auto-generated websites include the one or more auto-generated websites; and access Internet protocol (IP) address-URL entries stored in a domain name system server computer.

Abstract: Examples are disclosed herein that relate to modifying an analysis of personal behavior based on determining a subset of personal data to be non-routine. One example provides a computing device configured to receive personal data relating to personal behavior of a user, receive contextual data regarding the personal data, determine a subset of the personal data to be non-routine based upon the contextual data, and modify an analysis of personal behavior based upon the subset of the personal data determined to be non-routine.

Abstract: In an example embodiment, a computer-implemented method comprises obtaining labels from messages associated with an email service provider, wherein the labels indicate for each message IP how many spam and non-spam messages have been received; obtaining network data features from a cloud service provider; providing the labels and network data features to a machine learning application; generating a prediction model representing an algorithm for determining whether a particular set of network data features are spam or not; applying the prediction model to network data features for an unlabeled message; and generating an output of the prediction model indicating a likelihood that the unlabeled message is spam.

Abstract: A system for providing care to a ward that alerts a caregiver of the caregiver's capacity to deal competently with the ward's needs.

Abstract: A system for identifying abnormal resource usage in a data center is provided. In some embodiments, the system employs a prediction model for each of a plurality of resources and an abnormal resource usage criterion. For each of a plurality of resources of the data center, the system retrieves current resource usage data for a current time and past resource usage data for that resource. The system then extracts features from the past resource usage data for that resource, predicts using the prediction model for that resource usage data for the current time based on the extracted features, and determines an error between the predicted resource usage data and the current resource usage data. After determining the error data for the resources, the system determines whether errors satisfy the abnormal resource usage criterion. If so, the system indicates that an abnormal resource usage has occurred.

Abstract: A system for identifying abnormal resource usage in a data center is provided. In some embodiments, the system employs a prediction model for each of a plurality of resources and an abnormal resource usage criterion. For each of a plurality of resources of the data center, the system retrieves current resource usage data for a current time and past resource usage data for that resource. The system then extracts features from the past resource usage data for that resource, predicts using the prediction model for that resource usage data for the current time based on the extracted features, and determines an error between the predicted resource usage data and the current resource usage data. After determining the error data for the resources, the system determines whether errors satisfy the abnormal resource usage criterion. If so, the system indicates that an abnormal resource usage has occurred.

Abstract: A method for presenting health notifications begins with creating a plurality of different health notifications, each conveying the same type of information. Each of the different health notifications is provided to a plurality of different users, each user categorized with user health metrics. Post-health notification user activity is tracked for each of the different users. A machine-learning classification machine is trained with tracked user activity, along with corresponding user health metrics, for each of the different health notifications. When provided with user health metrics received from a health-monitoring computing device associated with a user, the machine-learning classification machine chooses a selected health notification for the user from among the different health notifications, the selected notification determined to be more likely than any of the other health notifications to elicit a healthy response from the user. The selected health notification is then sent to the user.

Abstract: A network-accessible computer includes a network-communications interface, configured to receive health metrics of a user over a computer network. The network-accessible computer also includes a logic machine, which is configured to localize the user in a virtual space based on the health metrics, identify k nearest neighbors in the virtual space having k shortest Euclidean distances to the user, and generate a health insight comparing the user to the k nearest neighbors. The network-communications interface is further configured to send the health insight to a computing device associated with the user via the computer network.