Abstract: The present invention relates to a first device and at least two second devices for performing distributive machine learning and inference in a communication system. Each device comprises a neural network, NN. The NNs are trained distributively in a training phase and may also be activated during the inference phase, so that an amount of data exchange may be reduced in the communication system. During the training phase and the inference phase, the at least two second devices provide activation vectors of output layers of their NNs to the first device. The first device combines those activation vectors to generate an input for its NN. During backpropagation, the first device may split or broadcast an error vector of the input layer of its NN to the at least two second devices. In this way, an arbitrary number of data sources may be handled by the communication system.

Abstract: Described is a data processing device for performing an attention-based operation on a graph neural network. The device is configured to receive one or more input graphs each having a plurality of nodes and to, for at least one of the input graphs: form an input node representation for each node in the respective input graph, wherein a respective norm is defined for each input node representation; form a set of attention parameters; multiply each of the input node representations with each of the set of attention parameters to form a score function of the respective input graph; normalize the score function based on a maximum of the norms of the input node representations to form a normalised score function; and form a weighted node representation by weighting each node in the respective input graph using a respective element of the normalised score function. The normalization of the score function enables deep attention-based neural networks to perform better by enforcing Lipschitz continuity.

Abstract: A data processing system for implementing a machine learning process in dependence on a graph neural network, the system being configured to receive a plurality of input graphs each having a plurality of nodes, at least some of the nodes having an attribute, the system being configured to: for at least one graph of the input graphs: determine one or more sets of nodes of the plurality of nodes, the nodes of each set having identical attributes; for each set, assign a label to each of the nodes of that set so that each node of a set has a different label from the other nodes of that set; process the sets to form an aggregate value; and implement the machine learning process taking as input: (i) the input graphs with the exception of the said sets and (ii) the aggregate value.

Abstract: Apparatuses and methods for determining if a computer program is malware and to which malware class it belongs to. In the method the behaviour of a computer program is traced by observing the activity of the program. Behaviour sequences comprising API-calls or similar activity of a computer program are then provided into a classifier for classifying the computer program. From the outcome of the classifier a classification result and the portions relevant to decision can be provided to a person for further confirmation.