Abstract: Computer-implemented methods for repairing a software of a computing system are provided. Aspects include receiving a request to diagnose the software, the software including a plurality of software components configured to communicate with each other via application programing interfaces and creating a representation of the software in a virtual reality environment. Aspects also include identifying an error in the software based on error logs generated by the software and identifying one or more of the plurality of software components and the application programing interfaces that correspond to the error. Aspects further include displaying a visual indication of the error in the virtual reality environment, wherein the visual indication is determined based on a type of the error, receiving, via the virtual reality environment, a corrective action from a user, and performing a task in the software based on the corrective action, wherein the task is configured to address the error.

Abstract: Embodiments related to using a foundational model for network packet traces. A technique includes receiving network traffic of a network and extracting features from the network traffic, the features having a function related to communications in the network. The technique includes generating tokens from the features, each of the features corresponding to a respective one of the tokens, training a machine learning model by inputting the tokens, the machine learning model being trained to output contextual embeddings for the tokens, and using the contextual embeddings to determine an anomaly in the network traffic.

Abstract: Data associated with performances of microservices functioning in a distributed computing environment is clustered by executing an unsupervised machine learning algorithm. A representative data is selected from a cluster, selecting performed for a plurality of the clusters. Based on time series data of the representative data associated with the plurality of the clusters, causal extraction is performed. Based on the causal extraction and the plurality of the clusters, a causal graph is constructed. The causal graph is embedded into vector space. Based on the embedded vector space, an artificial neural network model can be trained for managing the distributed computing environment.

Abstract: A computer-implemented method, according to one embodiment, includes determining a plurality of downstream task models of a foundation model, and arranging the downstream task models into a logical tree structure. Each node of the logical tree structure represents a sequence of layers of an associated one of the downstream task models. In response to a determination that a request for inferencing on a target model has resulted in a cache miss occurring, the logical tree structure is used to identify an inferencing server that satisfies at least a first predetermined prerequisite for fulfilling the inferencing request. The method further includes causing the identified inferencing server to fulfill the inferencing request. A computer program product, according to one embodiment, includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and/or executable by a computer to cause the computer to perform the foregoing method.

Abstract: Aspects of the invention include techniques for decomposing trend and seasonality components in a forecast of parametric time series data. A non-limiting example method includes receiving time series data that includes a plurality of values taken over a first period of time. A forecast is generated using the time series data. The forecast can include one or more predicted values over a second period of time. The forecast is decomposed into N components and 2N coalitions are defined for the N components. A coalition value is determined for each coalition of the 2N coalitions.

Abstract: A method, computer system, and a computer program product is provided for establishing a dynamically adaptive network firewall. A firewall model is established that identifies resources that can be used and a plurality of nodes that connect to one another to form a network. A set of external rules and policies are provided to each resource. The firewall implemented using the firewall model upon receiving of incoming data and upon traffic flow. The firewall expands or contracts the network by adding or removing resources according to work that needs to be performed. The work includes both tasks to be completed and efforts that has to be taken by the firewall to ensure security by preventing unauthorized access into the network.

Abstract: Embodiments related to using a foundational model for network packet traces. A technique includes receiving network traffic of a network and extracting features from the network traffic, the features having a function related to communications in the network. The technique includes generating tokens from the features, each of the features corresponding to a respective one of the tokens, training a machine learning model by inputting the tokens, the machine learning model being trained to output contextual embeddings for the tokens, and using the contextual embeddings to determine an anomaly in the network traffic.

Abstract: An embodiment includes detecting a set of anomalies recorded during a first predefined window of time in log entries for a computer environment. The embodiment also includes generating cluster data representative of a cluster of anomalies from among the set of anomalies, where the cluster is formed using a lattice clustering algorithm that spatially distinguishes the cluster of anomalies from other anomalies in the set of anomalies. The embodiment also includes composing an explanation using log templates generated from log entries associated with the cluster of anomalies.

Abstract: A method for determining a correlation of one or more events occurring in a plurality of nodes of a network includes accessing, by a computing device, address information associated with each of the plurality of nodes on the network. The computing device can further access one or more event IDs associated with one or more events occurring on the plurality of nodes. The computing device can further create an association the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information.

Abstract: A computer implemented method performs data skipping in a hierarchically organized computing system. A group of processor units determines leaf node data sketches for data in leaf nodes in the hierarchically organized computing system. The leaf node data sketches summarize attributes of data in the leaf nodes. The group of processor units aggregates the leaf node data sketches at intermediate nodes in the hierarchically organized computing system to form aggregated data sketches at the intermediate nodes and retains data sketches received at the intermediate nodes from a group of child nodes to form retained data sketches. The retained data sketches are one of leaf node data sketches and the aggregated data sketches. The group of processor units searches the data using the retained data sketches and the data skipping within the hierarchically organized computing system in response to queries made to the intermediate nodes in the hierarchically organized computing system.

Abstract: A computer implemented method performs data skipping in a hierarchically organized computing system. A group of processor units determines leaf node data sketches for data in leaf nodes in the hierarchically organized computing system. The leaf node data sketches summarize attributes of data in the leaf nodes. The group of processor units aggregates the leaf node data sketches at intermediate nodes in the hierarchically organized computing system to form aggregated data sketches at the intermediate nodes and retains data sketches received at the intermediate nodes from a group of child nodes to form retained data sketches. The retained data sketches are one of leaf node data sketches and the aggregated data sketches. The group of processor units searches the data using the retained data sketches and the data skipping within the hierarchically organized computing system in response to queries made to the intermediate nodes in the hierarchically organized computing system.

Abstract: Systems, methods and/or computer program products for controlling and visualizing topic modeling results using a topic modeling interface. The interface allows user directed exploration, understanding and control of topic modeling algorithms, while offering both semantic summaries and/or structure attribute explanations about results. Explanations and differentiations between results are presented using metrics such as cohesiveness and visual displays depicting hierarchical organization. Through user-manipulation of features of the interface, iterative changes are implemented through user-feedback, adjusting parameters, broadening or narrowing topic results, and/or reorganizing topics by splitting or merging topics. As users trigger visual changes to results being displayed, users can compare and contrast output from the topic modeling algorithm.

Abstract: A computer-implemented method and a computer system establish network slices within a physical network having a plurality of network elements. The method includes receiving a request to instantiate a network slice at a network element. The method also includes determining a performance metric of the network element. The method further includes delaying instantiation of the requested network slice within the network element in response to determining that the performance metric of the network element is below a threshold. The method also includes instantiating the requested network slice within the network element in response to determining that the performance metric of the network element is at or above the threshold. Finally, the method includes deactivating the requested network slice in response to determining that the performance metric of the network element is below the threshold at a time subsequent to instantiating the requested network slice.

Abstract: A computer-implemented method, a computer program product, and a computer system for supervised anomaly detection in federated learning. A server in a federated learning system generates a training dataset including malicious data samples and benign data samples. The server trains update-generating models on the malicious data samples and the benign data samples in the training dataset. The server generates benign model updates and malicious model updates, through training the update-generating models. The server trains an anomaly detector on the malicious model updates and the benign model updates. The server deploys the anomaly detector to the federated learning system, for supervised anomaly detection in the federated learning system.

Abstract: A computer-implemented method, a computer system and a computer program product provide differentiated services to spectrum zones based on user activity. The method includes obtaining a current spectrum zone configuration for a physical environment from a server. The method also includes capturing activity data from the physical environment. The method further includes identifying an event of interest in the activity data, wherein the event of interest comprises network requirements. The method also includes determining that the network requirements of the event of interest are not satisfied by the current spectrum zone configuration for the physical environment. Lastly, the method includes modifying the current spectrum zone configuration based on the network requirements.

Abstract: A method, computer system, and a computer program product managing data usage integrity is provided. In one embodiment, the method comprises receiving data connected with data usage of at least one user in a computer environment. The pricing information is then for the user relating to the data usage. The computer embodiment is segmented into a plurality of segment areas and a payment price is calculated for each segment area. An anomaly is detected by comparing the data usage and the associated pricing for each of segmented areas according to a preselected value. If an anomaly is selected, an end-to-end simulation check is performed for the computer environment to ascertain whether the payment price for the segment may be inconsistent with a resource usage affecting an end-to-end flow for the computer environment.

Abstract: A computer-implemented method, a computer system and a computer program product route meeting sessions through a venue based on device availability. The method includes identifying a plurality of sessions in a venue network, where each session in the plurality of sessions comprises session data that is associated with a network slice. The network slice includes connection requirements. The method also includes receiving a connection request from a user, where the connection request includes a session in the plurality of sessions. The method further includes determining an available device to receive the session data, where the available device satisfies the connection requirements of the network slice. Lastly, the method includes associating the available device with the network slice, where the session data is transmitted to the available device.

Abstract: A first classification is received from a neural network regarding a training dataset sent to the neural network. A modified training dataset with a perturbation of the training dataset is identified, where this modified training dataset causes the neural network to return a second classification. The perturbation is analyzed to identify a negative rule of the neural network.

Abstract: Embodiments are disclosed for a method for a wearable secure data device. The method includes setting an operational mode for the wearable secure data device that stores a plurality of secure data items. The method also includes receiving a request for at least one of the secure data items from a client device that is communicating with a third-party device. Additionally, the method includes determining if the operational mode is associated with allowing access to the secure data items. Further, the method includes providing a response based on the determination.

Abstract: Disclosed are methods method, systems, and computer program products for automatic management of a data processing system (DPS). One embodiment of the method may comprise receiving, at a computer processor, operations data associated with a DPS; and generating, by a Question-Answer (QA) system executing on the computer processor, a Question sentence from the operations data. The method may further comprise sampling a window of the operations data, extracting a plurality of key performance indicators (KPI) from the operations data in the sampled window, and providing the plurality of KPI to the QA system.