Abstract: A distribution of values of time-series data is obtained. Based on the distribution of the values, the time-series data is sampled to generate an anomaly preserving version of the time-series data. Via a trained machine learning model, a reconstructed version of the time-series data is generated based on the anomaly preserving version of the time-series data.

Abstract: A training dataset for anomaly detection is received. An unsupervised machine learning model is trained using at least a portion of the training dataset to generate a trained unsupervised machine learning model. A supervised machine learning model is trained using an output from the unsupervised machine learning model and an anomaly detection feedback associated with the output from the unsupervised machine learning model to generate a trained supervised machine learning model. Both the trained unsupervised machine learning model and the trained supervised machine learning model are provided for combined use in machine learning anomaly detection inference.

Abstract: For each corresponding configuration item type of a plurality of different configuration item types, a corresponding multi-variate machine learning model of a plurality of multi-variate machine learning models is trained to perform anomaly detection for a corresponding configuration item type of the plurality of different configuration item types. In response to detecting, via a univariate machine learning model, an anomaly associated with a specific configuration item type of the plurality of different configuration item types, an execution of a particular multi-variate machine learning model of the plurality of multi-variate machine learning models is initiated for the specific configuration item type. An output of the execution of the particular multi-variate machine learning model is evaluated to determine an anomaly detection result.

Abstract: A method and system for managing a dataset. An artificial intelligence (AI) model is to be used on the dataset. A data mask describes a labeling status of the data items. A loop is repeated until patience parameters are satisfied. The loop comprises receiving trusted labels provided by trusted labelers; updating the data mask; from a labelled data items subset, training the AI model; cloning the trained AI model into a local AI model on processing nodes; creating and chunking a randomized unlabeled subset into data subsets for dispatching to the processing nodes; receiving an indication that predicted label answers have been inferred by the processing nodes using the local AI model; computing a model uncertainty measurement from statistical analysis of the predicted label answers. The patience parameters include one or more of a threshold value on the model uncertainty measurement and information gain between different training cycles.

Abstract: A program is provided to automatically train using a training dataset a machine learning model for detecting anomalies. The machine learning model is automatically applied to a validation dataset to determine anomaly detection results. A histogram of the anomaly detection results of the machine learning model is automatically generated. The histogram is automatically analyzed, and a first peak and a second peak of the histogram is automatically identified. A threshold activation of the machine learning model is automatically determined based at least in part on the automatically identified second peak of the histogram.

Abstract: A method and server for optimizing hyperparameter tuples for training production-grade artificial intelligence (AI) models. For each one of the AI models, AI model features are extracted and, for the one AI model, an initial distribution of n hyperparameter tuplesis created considering the extracted AI model features therefor. A loop is repeated, until metric parameters are satisfied, comprising: evaluating latency from training the one AI model for each of the n hyperparameters tuples; evaluating model uncertainty from training the one AI model for each of the n hyperparameters tuples; for each of the n hyperparameters tuples, computing a blended quality measurement from the evaluated latency and evaluated model uncertainty; replacing m hyperparameter tuples having the worst blended quality measurements with m newly generated hyperparameter tuples. The metric parameters include one or more of a threshold value on model uncertainty and blended quality measurement gain between successive loops.

Abstract: Systems and methods for executing software modules in a pipelined fashion. A listing of modules to be executed is received and each module is executed in turn. Prior to execution, each module is code and input checked to determine if it corresponds to a previously executed module. If there is correspondence, then cached results from the previously executed module is used in place of executing the module. If there is no correspondence, then the module is executed, and its results are cached such that these results are available to subsequently executed modules. At least one of the modules may be an implementation of a machine learning model.

Abstract: A method and server for optimizing hyperparameter tuples for training production-grade artificial intelligence (AI) models. For each one of the AI models, AI model features are extracted and, for the one AI model, an initial distribution of n hyperparameter tuplesis created considering the extracted AI model features therefor. A loop is repeated, until metric parameters are satisfied, comprising: evaluating latency from training the one AI model for each of the n hyperparameters tuples; evaluating model uncertainty from training the one AI model for each of the n hyperparameters tuples; for each of the n hyperparameters tuples, computing a blended quality measurement from the evaluated latency and evaluated model uncertainty; replacing m hyperparameter tuples having the worst blended quality measurements with m newly generated hyperparameter tuples. The metric parameters include one or more of a threshold value on model uncertainty and blended quality measurement gain between successive loops.

Abstract: A method and a server for updating a dynamic list of labeling tasks. One or more labels are received, each label associated to one labeling task; the one or more received labels are inserted into a dataset; an artificial intelligence (AI) model is trained on labeled data items from the dataset; predicted labels are obtained for a plurality of unlabeled data items from the dataset by applying the model thereon; a model-uncertainty measurement is computed by applying one or more regularization methods; relevancy values are computed for at least a subset of the predicted labels taking into account the predicted label and the model-uncertainty measurement; the data items corresponding to the labeling tasks with the highest relevancy values are inserted in the dynamic list; and the dynamic list is reordered upon computing of the relevancy values.

Abstract: A method and system for managing a dataset. An artificial intelligence (AI) model is to be used on the dataset. A data mask describes a labeling status of the data items. A loop is repeated until patience parameters are satisfied. The loop comprises receiving trusted labels provided by trusted labelers; updating the data mask; from a labelled data items subset, training the AI model; cloning the trained AI model into a local AI model on processing nodes; creating and chunking a randomized unlabeled subset into data subsets for dispatching to the processing nodes; receiving an indication that predicted label answers have been inferred by the processing nodes using the local AI model; computing a model uncertainty measurement from statistical analysis of the predicted label answers. The patience parameters include one or more of a threshold value on the model uncertainty measurement and information gain between different training cycles.

Abstract: Systems and methods are shown for detecting potential attacks on a domain, where one or more servers, in response to a failure event, obtain a lambda value from a baseline model of historical data associated with a current time interval corresponding to the failure event, determine a probability of whether a total count of failure events for the current time interval is within an expected range using a cumulative density function based on the lambda value, and identify a possible malicious attack if the probability is less than or equal to a selected alpha value.

Abstract: Systems and methods are shown for detecting potential attacks on a domain, where one or more servers, in response to a failure event, obtain a lambda value from a baseline model of historical data associated with a current time interval corresponding to the failure event, determine a probability of whether a total count of failure events for the current time interval is within an expected range using a cumulative density function based on the lambda value, and identify a possible malicious attack if the probability is less than or equal to a selected alpha value.