Abstract: Accelerated machine learning using an efficient preconditioner for Kernel Ridge Regression (KRR). A plurality of anchor points may be selected by: projecting an initial kernel onto a random matrix in a lower dimensional space to generate a randomized decomposition of the initial kernel, permuting the randomized decomposition to reorder its columns and/or rows to approximate the initial kernel, and selecting anchor points representing a subset of the columns and/or rows based on their permuted order. A reduced-rank approximation kernel may be generated comprising the subset of columns and/or rows represented by the selected anchor points. A KRR system may be preconditioned using a preconditioner generated based on the reduced-rank approximation kernel. The preconditioned KRR system may be solved to train the machine learning model. This KRR technique may be executed without generating the KRR kernel, reducing processor and memory consumption.

Abstract: One embodiment of a computer-implemented method for detecting positivity violations within a dataset comprises generating, using a trained machine learning model, a plurality of propensity scores based on observational data associated with a group of entities; analyzing the plurality of propensity scores to identify one or more potential positivity violations; performing one or more training operations on the observational data based on the one or more potential positivity violations to generate a first trained decision tree associated with the one or more potential positivity violations; and determining, based on the trained first decision tree, a first positivity violation comprising a first combination of attribute values that is associated with at least one entity included in treatment group and is not associated with any entity included in a control group.

Abstract: Accelerated machine learning using an efficient preconditioner for Kernel Ridge Regression (KRR). A plurality of anchor points may be selected by: projecting an initial kernel onto a random matrix in a lower dimensional space to generate a randomized decomposition of the initial kernel, permuting the randomized decomposition to reorder its columns and/or rows to approximate the initial kernel, and selecting anchor points representing a subset of the columns and/or rows based on their permuted order. A reduced-rank approximation kernel may be generated comprising the subset of columns and/or rows represented by the selected anchor points. A KRR system may be preconditioned using a preconditioner generated based on the reduced-rank approximation kernel. The preconditioned KRR system may be solved to train the machine learning model. This KRR technique may be executed without generating the KRR kernel, reducing processor and memory consumption.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: Detection of abnormalities in HDBD is performed by processing it to obtain a dictionary from a training data. This is done by computing a low rank randomized LU decomposition which enables constant online updating of the training data and thus gets constant updating of the normal profile in the background.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiment comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a reduced dimension embedded space and classifying, based in the reduced dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiment comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiments comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: An analysis system capable of classifying possible defects identified within an inspection image of an inspected object includes a storage device and a processor. The processor matches a template and a portion of the inspection image, thus giving rise to a matching portion of the inspection image. The inspection image is captured by an inspection tool. The processor associates, using a mask corresponding to the template and defining one or more segments within the matching portion of the inspection image, a potential defect with a segment defined by the mask and corresponding to a location of the potential defect, and classifies the potential defect in accordance with the segment defined by the mask within the matching portion of the inspection image and associated with the potential defect.

Abstract: In accordance with an aspect of the presently disclosed subject matter, there is provided an analysis system for classifying possible defects identified within an inspection image of an inspected object, the system comprising a pattern matcher configured to determine an anchor location with respect to the inspection image, based on a matching of a template and a portion of the inspection image; wherein an accuracy of the determining of the anchor location exceeds a resolution of the inspection image; a distribution analysis module configured to determine, based on the anchor location and a mask which defines different segments within an area, a distribution of a potential defect with respect to one or more of the segments; and a classifier, configured to classify the potential defect based on the distribution.

Abstract: An analysis system for detection of defects within an inspection image of an inspected object, the inspection image comprising a plurality of pixels, the system including: a computerized segmentation module configured to segmentize the inspection image based on multiple anchor locations and on a mask which defines multiple mask-segments, by assigning each part out of multiple parts of the inspection image to a respective image-segment selected out of a multiple image segments, wherein the multiple image segments correspond to at least one mask-segment of said multiple mask-segments; and a defect detection processor configured to determine a presence of a defect in the inspection image based on the segmentation at least by assessing each pixel out of a plurality of pixels of the inspection image.

Abstract: An analysis system for detection of defects within an inspection image of an inspected object, the inspection image comprising a plurality of pixels, the system including: a computerized segmentation module configured to segmentize the inspection image based on multiple anchor locations and on a mask which defines multiple mask-segments, by assigning each part out of multiple parts of the inspection image to a respective image-segment selected out of a multiple image segments, wherein the multiple image segments correspond to at least one mask-segment of said multiple mask-segments; and a defect detection processor configured to determine a presence of a defect in the inspection image based on the segmentation at least by assessing each pixel out of a plurality of pixels of the inspection image.

Abstract: In accordance with an aspect of the presently disclosed subject matter, there is provided an analysis system for classifying possible defects identified within an inspection image of an inspected object, the system comprising a pattern matcher configured to determine an anchor location with respect to the inspection image, based on a matching of a template and a portion of the inspection image; wherein an accuracy of the determining of the anchor location exceeds a resolution of the inspection image; a distribution analysis module configured to determine, based on the anchor location and a mask which defines different segments within an area, a distribution of a potential defect with respect to one or more of the segments; and a classifier, configured to classify the potential defect based on the distribution.