Abstract: Embodiments of the invention are directed to a computer system that includes a memory electronically coupled to a processor system. The processor system is operable to perform processor system operations that include accessing a graph model representation of a computer network. The graph model is used to implement a resiliency-problem identification analysis that identifies a set of resiliency problems in the graph model. The graph model is used to apply a resiliency-problem solution analysis to a resiliency problem in the set of resiliency problems to generate a set of resiliency-problem solutions. Each resiliency-problem solution in the set of resiliency-problem solutions is ranked.

Abstract: A processor distributes, from a server, a trained supervised machine learning (ML) model and supervised and unsupervised feature information to a plurality of client devices; at each client device, trains the supervised ML model using local data to generate a local supervised ML model, constructs a local unsupervised ML model using the unsupervised feature information, and deploys the local supervised and unsupervised ML models; determining when a detection performance difference between the local supervised and unsupervised ML models reaches a threshold; identifies a proposed change to the supervised or unsupervised feature information; deploys the proposed change on one client device; responsive to determining the proposed change improves the detection performance of that client device, communicates the proposed change to a sampled set of client devices; and responsive to determining the proposed change improves the detection performance of a majority of the sampled set, communicates the proposed change to

Abstract: A processor distributes, from a server, a trained supervised machine learning (ML) model and supervised and unsupervised feature information to a plurality of client devices; at each client device, trains the supervised ML model using local data to generate a local supervised ML model, constructs a local unsupervised ML model using the unsupervised feature information, and deploys the local supervised and unsupervised ML models; determining when a detection performance difference between the local supervised and unsupervised ML models reaches a threshold; identifies a proposed change to the supervised or unsupervised feature information; deploys the proposed change on one client device; responsive to determining the proposed change improves the detection performance of that client device, communicates the proposed change to a sampled set of client devices; and responsive to determining the proposed change improves the detection performance of a majority of the sampled set, communicates the proposed change to

Abstract: A method, computer system, and a computer program for quick disaster recovery of cloud-native environments is provided. The present invention may include replicating at a secondary server site software executing in a cloud-native environment on a primary server site. The present invention may also include detecting a failure associated with the software executing in the cloud-native environment. The present invention may then include whether the detected failure is causing down time for the software executing in the cloud environment. The present invention may further include deploying the replicated software on the secondary server site in response to determining that the detected failure is causing down time.

Abstract: A method, computer system, and a computer program for quick disaster recovery of cloud-native environments is provided. The present invention may include replicating at a secondary server site software executing in a cloud-native environment on a primary server site. The present invention may also include detecting a failure associated with the software executing in the cloud-native environment. The present invention may then include whether the detected failure is causing down time for the software executing in the cloud environment. The present invention may further include deploying the replicated software on the secondary server site in response to determining that the detected failure is causing down time.

Abstract: In a method for determining anomalous behavior of a candidate taking an exam, a processor receives first exam interface input values captured during an exam session on a candidate testing device. A processor generates a first interaction vector from the first exam interface input values. A processor generates a first interaction timeline from the first interaction vector. A processor determines an anomalous behavior based on a relationship between the first interaction timeline and a selected classification cluster.

Abstract: Systems and methods are described for a data breach detection based on snapshot analytics. The described systems and methods identify a plurality of snapshots of a data structure, identify a plurality of leaf nodes of the data structure for each of the snapshots, generate a vector of data attributes for each of the leaf nodes, assign a weight to each of the vectors to produce a set of weighted vectors for each of the snapshots, compute a distance metric between each pair of the snapshots based on the corresponding sets of weighted vectors, and detect an abnormal snapshot among the plurality of snapshots based on the distance metrics.

Abstract: A method of using a computing device to compare performance of multiple algorithms. The method includes receiving, by a computing device, multiple algorithms to assess. The computing device further receives a total amount of resources to allocate to the multiple algorithms. The computing device additionally assigns a fair share of the total amount of resources to each of the multiple algorithms. The computing device still further executes each of the multiple algorithms using the assigned fair share of the total amount of resources. The computing device additionally compares the performance of each of the multiple based on at least one of multiple hardware relative utility metrics describing a hardware relative utility of any given resource allocation for each of the multiple algorithms.

Abstract: Techniques for securing peer-to-peer off-line transactions such as mobile device energy sharing through the use of broadcast encryption are provided. In one aspect, a method for securing transactions includes: encrypting the transactions in a digital wallet of a user in a digital network (e.g., a blockchain network) in a manner whereby the user can encrypt but cannot decrypt the transactions, and other users in the digital network can decrypt but cannot encrypt the transactions, thereby requiring the user to reveal all or none of the transactions in the digital wallet of the user since the user does not know which of the transactions is which, wherein one or more of the transactions are conducted off-line without users having a connection to the digital network.

Abstract: A method of using a computing device executing to interrelate two or more corpuses of dissimilar data that includes receiving input data from each of two or more corpuses of dissimilar data. The computing device computes a pass for each of the input data into two or more encoder-decoder models. The computing device further obtains a prediction of an identity mapping for each of different domains of knowledge from each of the two or more encoder-decoder models. The computing device additionally computes a distribution distance metric as an output from each of a low-dimensional embedding vector representation from each of the two or more encoder-decoder models. The computing device still further computes a function based on each of the predictions from each of the two or more encoder-decoder models and the distribution distance metrics. The computing device additionally updates the two or more encoder-decoder models.

Abstract: A processor can be configured to receive data associated with, and/or access to, a computing system's file system structure. The processor can also be configured to determine file patterns, file path patterns and/or graph patterns associated with the computing system. The processor can also be configured to build a graph structure having nodes and edges, the graph structure representing the file patterns, file path patterns and graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files. The processor can also be configured to train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file. The processor can also be configured to train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target.

Abstract: Techniques for augmenting data visualizations based on user interactions to enhance user experience are provided. In one aspect, a method for providing real-time recommendations to a user includes: capturing user interactions with a data visualization, wherein the user interactions include images captured as the user interacts with the data visualization; building stacks of the user interactions, wherein the stacks of the user interactions are built from sequences of the user interactions captured over time; generating embeddings for the stacks of the user interactions; finding clusters of embeddings having similar properties; and making the real-time recommendations to the user based on the clusters of embeddings having the similar properties.

Abstract: Systems and methods are described for a data breach detection based on snapshot analytics. The described systems and methods identify a plurality of snapshots of a data structure, identify a plurality of leaf nodes of the data structure for each of the snapshots, generate a vector of data attributes for each of the leaf nodes, assign a weight to each of the vectors to produce a set of weighted vectors for each of the snapshots, compute a distance metric between each pair of the snapshots based on the corresponding sets of weighted vectors, and detect an abnormal snapshot among the plurality of snapshots based on the distance metrics.

Abstract: One embodiment provides a method of determining a revised firmware upgrade plan for one or more devices, said method including: utilizing at least one processor to execute computer code that performs the steps of: selecting, in view of a predetermined change window and risk associated with the firmware upgrade plan, a firmware upgrade plan; detecting a failure during execution of the firmware upgrade plan; and responsive to the detecting, identifying a revised firmware upgrade plan based on time remaining in the predetermined change window and risk associated with the revised firmware upgrade plan. Other aspects are described and claimed.

Abstract: One embodiment provides a method of determining a revised firmware upgrade plan for one or more devices, said method including: utilizing at least one processor to execute computer code that performs the steps of: selecting, in view of a predetermined change window and risk associated with the firmware upgrade plan, a firmware upgrade plan; detecting a failure during execution of the firmware upgrade plan; and responsive to the detecting, identifying a revised firmware upgrade plan based on time remaining in the predetermined change window and risk associated with the revised firmware upgrade plan. Other aspects are described and claimed.

Abstract: A mechanism is provided to automatically retrieve zoning best practices from a centralized repository and to ensure that automatically generated zones do not violate these best practices. A user selects a set of hosts and storage controllers. The user also selects a guidance policy for creating the zone, and also selects a set of validation policies that must be enforced on the zone. If the user selects a guidance policy and a validation policy combination that is incompatible, the mechanism allows the user to change either the selected guidance policy or the set of validation policies. If the user has selected consistent-zoning as a guidance policy, then the mechanism automatically selects a guidance policy that does not violate the known validation policies.

Abstract: Provided is an article of manufacture, system and method for a management system for using host and storage controller port information to configure paths between a host and storage controller in a network. The management system obtains information on ports on at least one host, at least one storage controller, and at least one fabric over which the host and storage controller ports connect. The management system gathers, for at least one host port and storage controller port, a connection metric and a traffic metric. The management system processes the connection and traffic metrics for the host and storage ports to select at least one host port and at least one storage controller port configures the port pair to provide at least one path enabling the access at least one storage volume managed by the selected storage controller.

Abstract: A mechanism is provided to automatically retrieve zoning best practices from a centralized repository and to ensure that automatically generated zones do not violate these best practices. A user selects a set of hosts and storage controllers. The user also selects a guidance policy for creating the zone, and also selects a set of validation policies that must be enforced on the zone. If the user selects a guidance policy and a validation policy combination that is incompatible, the mechanism allows the user to change either the selected guidance policy or the set of validation policies. If the user has selected consistent-zoning as a guidance policy, then the mechanism automatically selects a guidance policy that does not violate the known validation policies.

Abstract: A mechanism is provided to automatically retrieve zoning best practices from a centralized repository and to ensure that automatically generated zones do not violate these best practices. A user selects a set of hosts and storage controllers. The user also selects a guidance policy for creating the zone, and also selects a set of validation policies that must be enforced on the zone. If the user selects a guidance policy and a validation policy combination that is incompatible, the mechanism allows the user to change either the selected guidance policy or the set of validation policies. If the user has selected consistent-zoning as a guidance policy, then the mechanism automatically selects a guidance policy that does not violate the known validation policies.

Abstract: Provided is an article of manufacture, system and method for a management system for using host and storage controller port information to configure paths between a host and storage controller in a network. A management system is coupled to a network, wherein the management system communicates over the network with a plurality of hosts, storage controllers, and a network monitor to configure paths in the network between the hosts and the storage controllers in order for the storage controller to provide storage services to the hosts. The network monitor collects statistics from the components in the network. The management system obtains from the network monitor information on ports on at least one host, ports on at least one storage controller managing access to storage volumes, and at least one fabric over which the at least one host and storage controller ports connect.