Abstract: Herein are generative adversarial networks to ensure realistic local samples and surrogate models to provide machine learning (ML) explainability (MLX). Based on many features, an embodiment trains an ML model. The ML model inferences an original inference for original feature values respectively for many features. Based on the same features, a generator model is trained to generate realistic local samples that are distinct combinations of feature values for the features. A surrogate model is trained based on the generator model and based on the original inference by the ML model and/or the original feature values that the original inference is based on. Based on the surrogate model, the ML model is explained. The local samples may be weighted based on semantic similarity to the original feature values, which may facilitate training the surrogate model and/or ranking the relative importance of the features. Local sample weighting may be based on populating a random forest with the local samples.

Abstract: Approaches herein relate to machine learning for detection of anomalous logic syntax. Herein is acceleration for comparison of parse trees such as suspicious database queries. In an embodiment, a computer identifies subtrees in each of many trees. A respective subset of participating subtrees is selected in each tree. A respective root node of each participating subtree should directly have a child node that is a leaf and/or should have a degree that exceeds a branching threshold such as one. For each pairing of a respective first tree with a respective second tree, based on a count of subtree matches between the participating subset of subtrees in the first tree and the participating subset of subtrees in the second tree, a respective tree similarity score is calculated. A machine learning model inferences based on the tree similarity scores of the many trees. In an embodiment, each tree similarity score is a convolution kernel.

Abstract: Herein is resource-constrained feature enrichment for analysis of parse trees such as suspicious database queries. In an embodiment, a computer receives a parse tree that contains many tree nodes. Each tree node is associated with a respective production rule that was used to generate the tree node. Extracted from the parse tree are many sequences of production rules having respective sequence lengths that satisfy a length constraint that accepts at least one fixed length that is greater than two. Each extracted sequence of production rules consists of respective production rules of a sequence of tree nodes in a respective directed tree path of the parse tree having a path length that satisfies that same length constraint. Based on the extracted sequences of production rules, a machine learning model generates an inference. In a bag of rules data structure, the extracted sequences of production rules are aggregated by distinct sequence and duplicates are counted.

Abstract: Systems and methods of detecting a parallel Wi-Fi network or a parallel Wi-Fi access point include, subsequent to installing a new Wi-Fi network at a location, detecting whether there is a parallel Wi-Fi network or a parallel Wi-Fi access point operating at the location with the new network; and responsive to detecting the parallel Wi-Fi network or the parallel Wi-Fi access point operating, performing one or more of causing resolution of the parallel Wi-Fi network or the parallel Wi-Fi access point and providing a notification to a user associated with the location based on the detecting.

Abstract: Approaches herein relate to reconstructive models such as an autoencoder for anomaly detection. Herein are machine learning techniques that detect and suppress any feature that causes model decay by concept drift. In an embodiment in a production environment, a computer initializes an unsuppressed subset of features with a plurality of features that an already-trained reconstructive model can process. A respective reconstruction error of each feature of the unsuppressed subset of features is calculated. The computer detects that a respective moving average based on the reconstruction error of a particular feature of the unsuppressed subset of features exceeds a respective feature suppression threshold of the particular feature, which causes removal of the particular feature from the unsuppressed subset of features.

Abstract: Herein are counterfactual explanations of machine learning (ML) inferencing provided by generative adversarial networks (GANs) that ensure realistic counterfactuals and use latent spaces to optimize perturbations. In an embodiment, a first computer trains a generator model in a GAN. A same or second computer hosts a classifier model that inferences an original label for original feature values respectively for many features. Runtime ML explainability (MLX) occurs on the first or second or a third computer as follows. The generator model from the GAN generates a sequence of revised feature values that are based on noise. The noise is iteratively optimized based on a distance between the original feature values and current revised feature values in the sequence of revised feature values. The classifier model inferences a current label respectively for each counterfactual in the sequence of revised feature values.

Abstract: Approaches herein relate to model decay of an anomaly detector due to concept drift. Herein are machine learning techniques for dynamically self-tuning an anomaly score threshold. In an embodiment in a production environment, a computer receives an item in a stream of items. A machine learning (ML) model hosted by the computer infers by calculation an anomaly score for the item. Whether the item is anomalous or not is decided based on the anomaly score and an adaptive anomaly threshold that dynamically fluctuates. A moving standard deviation of anomaly scores is adjusted based on a moving average of anomaly scores. The moving average of anomaly scores is then adjusted based on the anomaly score. The adaptive anomaly threshold is then adjusted based on the moving average of anomaly scores and the moving standard deviation of anomaly scores.

Abstract: Herein are machine learning (ML) techniques for unsupervised training with a corpus of signaling system 7 (SS7) messages having a diversity of called and calling parties, operation codes (opcodes) and transaction types, numbering plans and nature of address indicators, and mobile country codes and network codes. In an embodiment, a computer stores SS7 messages that are not labeled as anomalous or non-anomalous. Each SS7 message contains an opcode and other fields. For each SS7 message, the opcode of the SS7 message is stored into a respective feature vector (FV) of many FVs that are based on respective unlabeled SS7 messages. The FVs contain many distinct opcodes. Based on the FVs that contain many distinct opcodes and that are based on respective unlabeled SS7 messages, an ML model such as a reconstructive model such as an autoencoder is unsupervised trained to detect an anomalous SS7 message.

Abstract: In general, embodiments of the present invention provide systems, methods and computer readable media for recommending contextually relevant promotions to consumers in order to facilitate their discovery of promotions that they are likely to purchase from a promotion and marketing service.

Abstract: End-to-end explanation techniques, which efficiently explain the behavior (feature importance) of any machine learning model on large tabular datasets, are disclosed. These techniques comprise two down-sampling methods to efficiently select a small set of representative samples of a high-dimensional dataset for explaining a machine learning model by making use of the characteristics of the dataset or of an explainer of a machine learning model to optimize the explanation quality. These techniques significantly improve the explanation speed while maintaining the explanation quality of a full dataset evaluation.

Abstract: Approaches herein relate to reconstructive models such as an autoencoder for anomaly detection. Herein are machine learning techniques that measure inference confidence based on reconstruction error trends. In an embodiment, a computer hosts a reconstructive model that encodes and decodes features. Based on that decoding, the following are automatically calculated: a respective reconstruction error of each feature, a respective moving average of reconstruction errors of each feature, an average of the moving averages of the reconstruction errors of all features, a standard deviation of the moving averages of the reconstruction errors of all features, and a confidence of decoding the features that is based on a ratio of the average of the moving averages of the reconstruction errors to the standard deviation of the moving averages of the reconstruction errors. The computer detects and indicates that a threshold exceeds the confidence of decoding, which may cause important automatic reactions herein.

Abstract: In an embodiment, a computer-implemented method includes receiving a query from a client and determining a query plan for the query. The query plan comprises one or more query operators for executing at least a portion of the query on a database. The method also includes sending the one or more query operators to one or more computing nodes for the one or more computing nodes to execute the one or more query operators on one or more data fragments of the database. In this example, each computing node of the one or more computing nodes hosts a respective data fragment of the one or more data fragments. Further, the method includes detecting an error in executing a first query operator by a first computing node on a first data fragment, and sending, in response to detecting the error, the first query operator to a replacement computing node for executing on the first data fragment hosted by the spare computing node.

Abstract: The present disclosure relates to methods, systems, and apparatuses for providing promotion recommendations using a promotion and marketing service. Some aspects may provide a method for providing a promotion recommendation framework. The method includes receiving, via a network interface, a promotion recommendation inquiry from a component of a promotion and marketing service, the promotion recommendation inquiry including electronic identification data identifying at least one of a consumer or a consumer characteristic. The method also includes identifying, via processing circuitry, promotion transaction information associated with the electronic identification data. The promotion transaction information includes electronic data identifying at least one transaction performed using the promotion and marketing service.

Abstract: In an embodiment based on computer(s), an ML model is trained to detect outliers. The ML model calculates anomaly scores that include a respective anomaly score for each item in a validation dataset. The anomaly scores are automatically organized by sorting and/or clustering. Based on the organized anomaly scores, a separation is measured that indicates fitness of the ML model. In an embodiment, a computer performs two-clustering of anomaly scores into a first organization that consists of a first normal cluster of anomaly scores and a first anomaly cluster of anomaly scores. The computer performs three-clustering of the same anomaly scores into a second organization that consists of a second normal cluster of anomaly scores, a second anomaly cluster of anomaly scores, and a middle cluster of anomaly scores. A distribution difference between the first organization and the second organization is measured. An ML model is processed based on the distribution difference.

Abstract: Embodiments utilize trained query performance machine learning (QP-ML) models to predict an optimal compute node cluster size for a given in-memory workload. The QP-ML models include models that predict query task runtimes at various compute node cardinalities, and models that predict network communication time between nodes of the cluster. Embodiments also utilize an analytical model to predict overlap between predicted task runtimes and predicted network communication times. Based on this data, an optimal cluster size is selected for the workload. Embodiments further utilize trained data capacity machine learning (DC-ML) models to predict a minimum number of compute nodes needed to run a workload. The DC-ML models include models that predict the size of the workload dataset in a target data encoding, models that predict the amount of memory needed to run the queries in the workload, and models that predict the memory needed to accommodate changes to the dataset.

Abstract: A systematic explainer is described herein, which comprises local, model-agnostic, surrogate ML model-based explanation techniques that faithfully explain predictions from any machine learning classifier or regressor. The systematic explainer systematically generates local data samples around a given target data sample, which improves on exhaustive or random data sample generation algorithms. Specifically, using principles of locality and approximation of local decision boundaries, techniques described herein identify a hypersphere (or data sample neighborhood) over which to train the surrogate ML model such that the surrogate ML model produces valuable, high-quality information explaining data samples in the neighborhood of the target data sample.

Abstract: Systems and methods of detecting a parallel Wi-Fi network or a parallel Wi-Fi access point include, subsequent to installing a new Wi-Fi network at a location, detecting whether there is a parallel Wi-Fi network or a parallel Wi-Fi access point operating at the location with the new network; and responsive to detecting the parallel Wi-Fi network or the parallel Wi-Fi access point operating, performing one or more of causing resolution of the parallel Wi-Fi network or the parallel Wi-Fi access point and providing a notification to a user associated with the location based on the detecting.

Abstract: Herein are acceleration techniques for resuming offloaded execution by replacing a failed computer with a hot spare computer. In an embodiment, a distributed system configures a DBMS, a set of participating computers, and a set of spare computers. The DBMS receives a query of a database. From the query, an offload query plan is generated for distributed execution. The DBMS sends the offload query plan and a respective portion of the database to each participating computer. The distributed system detects that a participating computer failed after the offload query plan was sent. Responsively, the DBMS sends the same offload query plan and same respective portion of the database of the failed computer to a replacement computer from the spare computers. Despite the computer failure, the DBMS receives results of successful distributed execution of the offload query plan that include a result from the replacement computer.

Abstract: Herein, a computer generates and evaluates many preprocessor configurations for a window preprocessor that transforms a training timeseries dataset for an ML model. With each preprocessor configuration, the window preprocessor is configured. The window preprocessor then converts the training timeseries dataset into a configuration-specific point-based dataset that is based on the preprocessor configuration. The ML model is trained based on the configuration-specific point-based dataset to calculate a score for the preprocessor configuration. Based on the scores of the many preprocessor configurations, an optimal preprocessor configuration is selected for finally configuring the window preprocessor, after which, the window preprocessor can optimally transform a new timeseries dataset such as in an offline or online production environment such as for real-time processing of a live streaming timeseries.

Abstract: Systems and methods for adjusting parameters for a spin-lock implementation of concurrency control are described herein. In an embodiment, a system continuously retrieves, from a resource management system, one or more state values defining a state of the resource management system. Based on the one or more state values, the system determines that the resource management system has reached a steady state and, in response adjusts a plurality of parameters for spin-locking performed by said resource management system to identify optimal values for the plurality of parameters. After adjusting the plurality of parameters, the system detects, based on one or more current state values, a workload change in the resource management system and, in response, readjusts the plurality of parameters for spin-locking performed by said resource management system to identify new optimal values for the parameters.