Abstract: A method includes associating anomalous first text, from a first unstructured data set, with a first classification; processing the first unstructured data set using at least one of ML or AI to identify a second text that is in close context to the first text, and adding the second text to a text list associated with the first classification; enriching the text list by processing the second text to generate a third text, and adding the third text to the text list to produce an enriched text list and such that the third text is also associated with the first classification; matching the text in the enriched text list to text in a second unstructured data set; and classifying the text in the second unstructured data set as having the first classification when the text in the second unstructured data set matches text in the enriched text list.

Abstract: A method includes associating anomalous first text, from a first unstructured data set, with a first classification; processing the first unstructured data set using at least one of ML or AI to identify a second text that is in close context to the first text, and adding the second text to a text list associated with the first classification; enriching the text list by processing the second text to generate a third text, and adding the third text to the text list to produce an enriched text list and such that the third text is also associated with the first classification; matching the text in the enriched text list to text in a second unstructured data set; and classifying the text in the second unstructured data set as having the first classification when the text in the second unstructured data set matches text in the enriched text list.

Abstract: Techniques are provided for segmentation of data points after a dimension reduction. A proxy model is then trained based on results of the segmentation. The proxy model provides low latency high throughput labeling of additional data points, without the need to reduce dimensions of the additional data points. A second segmentation is performed with results of the second segmentation compared to that of the first segmentation. When results of the comparison meet certain criterion, configuration parameters of the segmentation are modified. For example, in some embodiments, a user interface is provided that displays shapley values indicating a mapping from the high dimension data to the segmented data. Input is then received that modifies the configuration parameters.

Abstract: In one embodiment, an apparatus obtains unstructured text generated by a device regarding operation of the device. The apparatus identifies the unstructured text as associated with a particular command or process that generated the unstructured text. The apparatus classifies a portion of the unstructured text as anomalous by inputting the portion of the unstructured text to a machine learning-based model trained to predict text generated by the particular command or process. The apparatus provides provide the unstructured text for display that includes an indication that the portion of the unstructured text is anomalous.

Abstract: In one embodiment, a device obtains content data provided by a social media platform to a user of the social media platform. The social media platform selects the content data for the user based on a behavioral model of the user. The device maintains an artificial intelligence-based model that models associations between the content data and interaction data indicative of interactions between the user and the social media platform. The device selects, using the artificial intelligence-based model, an obfuscation action to lower an accuracy of the behavioral model of the user, based on one or more configuration parameters set by the user. The device initiates performance of the obfuscation action.

Abstract: Presented herein are techniques to analyze network anomaly signals based on both a spatial component and a temporal component. A method includes identifying a plurality of factors that trigger a first anomaly signal by a first network node and a second anomaly signal by a second network node in a network comprising a plurality of network nodes, determining that the first network node is adjacent to the second network node in the plurality of network nodes, calculating an anomaly severity score for the first network node based on a number of co-occurring factors from among the plurality of factors that trigger both the first anomaly signal and the second anomaly signal, and adjusting the anomaly severity score for the first network node based on a value of a prior anomaly severity score for the first network node.

Abstract: Presented herein are techniques to analyze network anomaly signals based on both a spatial component and a temporal component. A method includes identifying a plurality of factors that trigger a first anomaly signal by a first network node and a second anomaly signal by a second network node in a network comprising a plurality of network nodes, determining that the first network node is adjacent to the second network node in the plurality of network nodes, calculating an anomaly severity score for the first network node based on a number of co-occurring factors from among the plurality of factors that trigger both the first anomaly signal and the second anomaly signal, and adjusting the anomaly severity score for the first network node based on a value of a prior anomaly severity score for the first network node.

Abstract: A method includes associating anomalous first text, from a first unstructured data set, with a first classification; processing the first unstructured data set using at least one of ML or AI to identify a second text that is in close context to the first text, and adding the second text to a text list associated with the first classification; enriching the text list by processing the second text to generate a third text, and adding the third text to the text list to produce an enriched text list and such that the third text is also associated with the first classification; matching the text in the enriched text list to text in a second unstructured data set; and classifying the text in the second unstructured data set as having the first classification when the text in the second unstructured data set matches text in the enriched text list.

Abstract: In one embodiment, a device obtains an output of a machine learning-based anomaly detector for unstructured text. The output of the anomaly detector includes a sequence of text analyzed by the detector and an indication that a portion of the sequence of text was flagged by the detector as an anomaly. The device extracts a context for the anomaly as an n-gram of portions of the sequence of text surrounding the anomaly. The device identifies a structure of the anomaly by identifying anchor portions of the extracted context. The device generates, based on the identified structure, an expression that represents the structure of the anomaly within the unstructured text.

Abstract: In one embodiment, an apparatus obtains unstructured text generated by a device regarding operation of the device. The apparatus identifies the unstructured text as associated with a particular command or process that generated the unstructured text. The apparatus classifies a portion of the unstructured text as anomalous by inputting the portion of the unstructured text to a machine learning-based model trained to predict text generated by the particular command or process. The apparatus provides provide the unstructured text for display that includes an indication that the portion of the unstructured text is anomalous.