Abstract: Herein for each source logic in a corpus, a computer stores an identifier of the source logic and operates a logic encoder that infers a distinct fixed-size encoded logic that represents the variable-size source logic. At build time, a multidimensional index is generated and populated based on the encoded logics that represent the source logics in the corpus. At runtime, a user may edit and select a new source logic such as in a text editor or an integrated development environment (IDE). The logic encoder infers a new encoded logic that represents the new source logic. The multidimensional index accepts the new encoded logic as a lookup key and automatically selects and returns a result subset of encoded logics that represent similar source logics in the corpus. For display, the multidimensional index may select and return only encoded logics that are the few nearest neighbors to the new encoded logic.

Abstract: The present invention relates to machine learning (ML) explainability (MLX). Herein are techniques for a novel relevance propagation rule in layer-wise relevance propagation (LRP) for feature attribution-based explanation (ABX) for a reconstructive autoencoder. In an embodiment, a reconstruction layer of a reconstructive neural network in a computer generates a reconstructed tuple that is based on an original tuple that contains many features. A reconstruction residual cost function calculates a reconstruction error that measures a difference between the original tuple and the reconstructed tuple. Applied to the reconstruction error is a novel reconstruction relevance propagation rule that assigns a respective reconstruction relevance to each reconstruction neuron in the reconstruction layer. Based on the reconstruction relevance of the reconstruction neurons, a respective feature relevance of each feature is determined, from which an ABX explanation may be automatically generated.

Abstract: Here is dynamic and contextual ranking of reference documentation based on an interactively selected position in new source logic. A computer receives a vocabulary of lexical tokens, a sequence of references that contains a first reference to a first reference document before a second reference to a second reference document, respective subsets of the vocabulary that occur in the first and second reference documents, a new source logic that contains a sequence of lexical tokens, respective measurements of semantic distance between the new source logic and the first and second reference documents, and a selected position in the sequence of lexical tokens. Based on the selected position, the measurements of semantic distance are selectively increased. Based on that increasing the measurements of the semantic distance, a relative ordering of the first and second references is reversed to generate and display a reordered sequence of references.

Abstract: Approaches herein relate to model decay of an anomaly detector due to concept drift. Herein are machine learning techniques for dynamically self-tuning an anomaly score threshold. In an embodiment in a production environment, a computer receives an item in a stream of items. A machine learning (ML) model hosted by the computer infers by calculation an anomaly score for the item. Whether the item is anomalous or not is decided based on the anomaly score and an adaptive anomaly threshold that dynamically fluctuates. A moving standard deviation of anomaly scores is adjusted based on a moving average of anomaly scores. The moving average of anomaly scores is then adjusted based on the anomaly score. The adaptive anomaly threshold is then adjusted based on the moving average of anomaly scores and the moving standard deviation of anomaly scores.

Abstract: Disclosed herein are a method for automated quality control of at least one photodetector, a photodetector for measuring optical radiation and a spectrometer for spectrally analyzing optical radiation provided by at least one object. Further disclosed herein are a computer program and a computer-readable storage medium for performing the method.

Abstract: Disclosed herein is a method of controlling operation of at least one light-emitting system including at least one light-emitting element. The method includes: a) monitoring at least temporarily, at least one electrical parameter of the light-emitting element; b) evaluating the electrical parameter and verifying if the electrical parameter meets at least one predetermined criterion; and c) taking at least one safeguard action depending on the outcome of step b).

Abstract: Approaches herein relate to reconstructive models such as an autoencoder for anomaly detection. Herein are machine learning techniques that detect and suppress any feature that causes model decay by concept drift. In an embodiment in a production environment, a computer initializes an unsuppressed subset of features with a plurality of features that an already-trained reconstructive model can process. A respective reconstruction error of each feature of the unsuppressed subset of features is calculated. The computer detects that a respective moving average based on the reconstruction error of a particular feature of the unsuppressed subset of features exceeds a respective feature suppression threshold of the particular feature, which causes removal of the particular feature from the unsuppressed subset of features.

Abstract: The present invention relates to threshold estimation and calibration for anomaly detection. Herein are machine learning (ML) and extreme value theory (EVT) techniques for normalizing and thresholding anomaly scores without presuming a values distribution. In an embodiment, a computer receives many unnormalized anomaly scores and, according to peak over threshold (POT), selects a highest subset of the unnormalized anomaly scores that exceed a tail threshold. Based on the highest subset of the unnormalized anomaly scores, parameters of a probability density function are trained according to EVT. After training and in a production environment, a normalized anomaly score is generated based on an unnormalized anomaly score and the trained parameters of the probability density function. Anomaly detection compares the normalized anomaly score to an optimized anomaly threshold.

Abstract: Approaches herein relate to reconstructive models such as an autoencoder for anomaly detection. Herein are machine learning techniques that measure inference confidence based on reconstruction error trends. In an embodiment, a computer hosts a reconstructive model that encodes and decodes features. Based on that decoding, the following are automatically calculated: a respective reconstruction error of each feature, a respective moving average of reconstruction errors of each feature, an average of the moving averages of the reconstruction errors of all features, a standard deviation of the moving averages of the reconstruction errors of all features, and a confidence of decoding the features that is based on a ratio of the average of the moving averages of the reconstruction errors to the standard deviation of the moving averages of the reconstruction errors. The computer detects and indicates that a threshold exceeds the confidence of decoding, which may cause important automatic reactions herein.

Abstract: A computer system includes a detector that monitors DNS communications to detect data exfiltration and/or infiltration that is attempted or has occurred in the DNS communications. DNS communications are stored and parsed to distinguish content that is potentially not public being communicated in a prefix and content contained in a publicly available suffix. The content of the prefix is examined to determine an amount of information conveyed in the prefix based at least in part on a length and a number of unique characters of the prefix. The detector aggregates communications for network sources and/or destinations, and/or for different network groups or characteristics to determine sources, destinations, groups, and/or characteristics associated with aggregate amounts of information that satisfy one or more notification conditions or trigger one or more other corrective actions.

Abstract: In a method for producing an optical element, at least one substrate is supplied with coating material from at least one source for depositing a respective layer system on the substrate. A plurality of zones (111, 112, 121, 122) that are laterally adjacent to one another in at least one predefined direction and each have a defined layer thickness profile and a defined layer composition are formed by targeted spatially resolved selection and/or treatment of the deposited coating material and/or the substrate. These zones differ from each other in their layer thickness profiles and/or their layer compositions. The average dimension of each of the zones in the predefined direction is between 0.1 mm and 2 cm. The optical element is a mirror array with plural mirror elements. For different substrates of this mirror array, mutually different layer thickness profiles and/or layer compositions of the respectively deposited layer system are generated.

Abstract: In an embodiment providing natural language processing (NLP), a computer generates a histogram that correctly represents a graph that represents a lexical text, and generates a token sequence encoder that is trainable and untrained. During training such as pretraining, the token sequence encoder infers an encoded sequence that incorrectly represents the lexical text, and the encoded sequence is dense and saves space. To increase the accuracy of the sequence encoder by learning, the token sequence encoder is adjusted based on, as discussed herein, an indirectly measured numeric difference between the encoded sequence that incorrectly represents the lexical text and the histogram that correctly represents the graph.

Abstract: Systems, methods, and other embodiments associated with quasi-supervised clustering for activity pattern characterization and anomalous activity detection are described. In one embodiment, a method generates a first sparse similarity matrix for nearest neighbors of a plurality of data points. The data points each characterize a pattern of activity associated with an account. The method generates a second sparse similarity matrix for random neighbors of the plurality of data points. The method recursively clusters the plurality of data points based on the first sparse similarity matrix. The method quasi-supervises the recursive clustering based on the second sparse similarity matrix to stop the iterative clustering when the data points are split into N clusters. The value of N is not pre-determined. The method detects that the individual data point has changed clusters, indicating anomalous activity. And, the method generates an electronic alert that the anomalous activity is associated with the account.

Abstract: Disclosed herein is a spectrometer device for detecting incident radiation generated by an object and a spectrometer system The spectrometer device and the spectrometer system for detecting incident radiation generated by an object includes: a measurement window, a detector array, an optical filter, and at least one optical element configured for modifying the field of view of at least one pixelated sensor by increasing at least one overlap between the field of views of the at least two pixelated sensors. Further described herein is the advantage that the spectrometer device and the spectrometer system are robust against the granularity of an object, particularly by providing a sensor signal that may be correlated in a common measurement result, as the fields of view of the single pixelated sensors have an increased overlap.

Abstract: During pretraining, a computer generates three trainable and untrained machine learning models that are a token sequence encoder, a token predictor, and a path predictor. A sequence of lexical tokens is generated that represents a lexical text in a training corpus. A graph is generated that represents the lexical text. In the graph, a next traversal path is selected that corresponds to a next lexical token that is adjacent to a sliding subsequence of the sequence of lexical tokens. From the subsequence, the token sequence encoder infers an encoded sequence that represents the subsequence. The path predictor and token predictor accept the encoded sequence as input for respective inferencing for which respective training losses are measured. Both training losses are combined into a combined loss that is used to increase the accuracy of the three machine learning models by, for example, backpropagation of the combined loss.

Abstract: In an embodiment, a computer stores, in memory or storage, many explanation profiles, many log entries, and definitions of many features that log entries contain. Some features may contain a logic statement such as a database query, and these are specially aggregated based on similarity. Based on the entity specified by an explanation profile, statistics are materialized for some or all features. Statistics calculation may be based on scheduled batches of log entries or a stream of live log entries. At runtime, an inference that is based on a new log entry is received. Based on an entity specified in the new log entry, a particular explanation profile is dynamically selected. Based on the new log entry and statistics of features for the selected explanation profile, a local explanation of the inference is generated. In an embodiment, an explanation text template is used to generate the local explanation.

Abstract: A method and one or more non-transitory storage media are provided to train and implement a one-hot encoder. During a training phase, computation of an encoder state is performed by executing a set of relational statements to extract unique categories in a first training data set, associate each unique category with a unique index, and generate a one-hot encoding for each unique category. The set of relational statements are executed by a query optimization engine. Execution of the set of relational statements is postponed until a result of each relational statement is needed, and the query optimization engine implements one or more optimizations when executing the set of relational statements. During an encoding phase, a set of categorical features in a second training data set are encoded based on the encoder state to form a set of encoded categorical features.

Abstract: Systems, methods, and other embodiments associated with self-reliant characterization of activities of users are described. In one embodiment, a method includes generating a dataset of data points from a batch of electronic log messages that describe electronic actions taken by various accounts. A data point collectively describes actions of a single account. The method includes modeling distinct activities based on clustering of the data points into M behavioral groups and inferring M or more distinct activities from the dataset by probabilistic activity modeling of the actions. The value of M is derived automatically during the clustering. The method includes predicting activity of a user account to be non-conformant based on other accounts in a behavioral group satisfying a threshold for similarity. And, the method includes generating an electronic alert that indicates the user account to have non-conformant activity.

Abstract: In an embodiment, a computer stores and operates a logic encoder that is an artificial neural network that infers a fixed-size encoded logic from textual or tokenized source logic. Without machine learning, a special parser generates a parse tree that represents the source logic and a fixed-size correctly encoded tree that represents the parse tree. For finetuning the logic encoder, an encoded tree generator is an artificial neural network that accepts the fixed-size encoded logic as input and responsively infers a fixed-size incorrectly encoded tree that represents the parse tree. The neural weights of the logic encoder (and optionally of the encoded tree generator) are adjusted based on backpropagation of error (i.e. loss) as a numerically measured difference between the fixed-size incorrectly encoded tree and the fixed-size correctly encoded tree.

Abstract: Disclosed herein is a method for retrieving at least one alternating current (AC) signal SAC from at least one measurement signal Smeas of at least one detector. The measurement signal Smeas includes the AC signal SAC and at least one direct current (DC) signal SDC. The AC signal SAC has at least one predefined frequency f0. The method includes the following steps: a) monitoring the measurement signal Smeas over time by using the detector; b) determining the DC signal SDC by using at least one evaluation unit; and c) determining the AC signal SAC by subtracting the DC signal SDC from the measurement signal Smeas by using the evaluation unit. Also disclosed herein are a method for determining at least one item of information on at least one measurement object, a photodetector and a spectrometer.