Abstract: Techniques are provided for data-driven ensemble-based malware detection. An exemplary method comprises obtaining a file; extracting metadata from the file; obtaining a plurality of malware detection procedures; selecting a subset of the plurality of malware detection procedures to apply to the file utilizing a likelihood that each of the plurality of malware detection procedures will result in a malware detection for the file based on the extracted metadata; applying the selected subset of the malware detection procedures to the file; and processing results of the subset of malware detection procedures using a machine learning model to determine a probability of the file being malware.

Abstract: Techniques are provided for facial recognition using a high probability group database. One method comprises maintaining (i) a first database of facial images of individuals, and (ii) a second database of facial images comprising a subset of the individuals from the first database based on a probability of individuals appearing in sequences of image frames at a given time; applying a face detection algorithm to sequences of image frames to identify one or more faces in the sequences of images; and applying a facial recognition to at least one sequence of image frames using at least the second database to identify one or more individuals in the at least one sequence of image frames. The second database is comprised of facial images of: (i) individuals from multiple angles; (ii) individuals that appeared in prior image frames; and/or (iii) individuals that appeared in an image frame generated by a plurality of cameras.

Abstract: Techniques are provided for facial recognition using a high probability group database and a facial network of related persons.

Abstract: Business Data Lake searching techniques are provided.

Abstract: Techniques are provided for extracting anomaly related rules from organizational data. One method comprises obtaining anomaly analysis data integrated from multiple data sources of an organization, wherein the multiple data sources comprise at least one set of labeled anomaly data related to anomalous transactions; extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly; training multiple machine learning models using the extracted features, where the machine learning models are trained using different combinations of the extracted features; evaluating a performance of the trained machine learning models; and extracting rules from the trained machine learning models based on the performance, wherein the extracted rules are used to classify transactions as anomalous. The trained machine learning models comprise a decision tree comprising paths to an anomaly classification. The extracted rules are optionally in a human-readable format.

Abstract: Techniques are provided for customer support ticket aggregation. One method comprises obtaining a customer support ticket; extracting a topic of the customer support ticket using a topic model based on natural language processing techniques; converting the customer support ticket to a topic vector representation that identifies the extracted topic and comprises a list of words describing the topic based on a collection of processed customer support tickets; extracting features from the customer support ticket; generating a fingerprint for the customer support ticket that comprises the topic vector representation and the extracted features; applying the fingerprint to a machine learning similarity model that compares the fingerprint to fingerprints of processed customer support tickets from the collection of processed customer support tickets; and identifying a processed customer support ticket from the collection of processed customer support tickets that is related to the customer support ticket.

Abstract: A method in one embodiment comprises extracting features from each of a plurality of software investigation log sets, generating representations for respective ones of the software investigation log sets based at least in part on the corresponding extracted features, and storing the representations in a knowledge base. In conjunction with obtaining at least one additional software investigation log set, the method generates a representation of the additional software investigation log set, identifies one or more of the representations previously stored in the knowledge base that exhibit at least a specified similarity to the representation of the additional software investigation log set in accordance with one or more statistical models, and presents information characterizing the one or more software investigation log sets corresponding to respective ones of the identified one or more representations in a user interface.

Abstract: Techniques are provided for identifying anomalies in an Internet of Things (IoT) activity profile of a user using an analytic engine. An exemplary method comprises obtaining data from a plurality of IoT devices of a user, wherein at least one IoT device comprises an agent device that performs an action on behalf of the user; applying the obtained data to a feature engineering module to convert the obtained data into time-series features that capture behavior and/or characteristics of an IoT environment of the user, and applying the time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in the IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned patterns.

Abstract: Techniques are provided for data-driven ensemble-based malware detection. An exemplary method comprises obtaining a file; extracting metadata from the file; obtaining a plurality of malware detection procedures; selecting a subset of the plurality of malware detection procedures to apply to the file utilizing a likelihood that each of the plurality of malware detection procedures will result in a malware detection for the file based on the extracted metadata; applying the selected subset of the malware detection procedures to the file; and processing results of the subset of malware detection procedures using a machine learning model to determine a probability of the file being malware.

Abstract: Techniques are provided for system operational analytics using additional features over time-series counters for health score computation. An exemplary method comprises: obtaining log data from data sources of a monitored system; applying a counting function to the log data to obtain time-series counters for a plurality of distinct features within the log data; applying an additional function to the time-series counters for the plurality of distinct features; and processing an output of the additional function using a machine learning model to obtain a health score for the monitored system based on the output of the additional function.

Abstract: Techniques are provided for decompression of compressed log data, such as for a real-time viewing of compressed log data. An exemplary method comprises: obtaining a compressed log file comprised of a plurality of compressed log messages, wherein a given compressed log message is comprised of one or more message variables and a message signature corresponding to a message template of the given compressed log message; and presenting a first subset of the compressed log file by translating, in memory, the message templates of the compressed log messages within the first subset to corresponding message signatures using a decompression index that maps a plurality of the message signatures to corresponding message templates. The first subset of the compressed log file optionally comprises a predefined number of lines surrounding a requested line of the compressed log file. In further variations, at least one additional subset of the compressed log file is precomputed using the disclosed decompression techniques.

Abstract: Techniques are provided for data-driven scheduling of automated software program test suites. An exemplary method comprises: obtaining a plurality of test cases that test software programs; obtaining a failure likelihood for each of the plurality of test cases; and scheduling the test cases in an order based on the failure likelihoods. Generally, test cases that are more likely to fail are scheduled before test cases that are less likely to fail. Dependencies and/or priorities among the plurality of test cases are also optionally obtained and the scheduling of the test cases is based on the dependencies and/or priorities. The dependencies among the plurality of test cases comprise, for example, an indication of whether a given test case constrains one or more additional test cases.

Abstract: A DNA storage system for binary digital data. The digital data is deduplicated is encoded into a format for representation in DNA, and DNA representing the data is synthesized and stored in pools in a primary library, a hash library and a data library. The primary library stores DNA for accessing a hash object in the hash library corresponding to a hash of the data, and the hash library stores DNA for accessing a data object in the data library that contains the data. The information in the libraries includes information identifying objects, including keys, unique identifiers (UIDs), pool identifiers, and primers.

Abstract: Embodiments include facilitating DNA storage of digital data including a plurality of data assets in a network by building a causal graph of the network and the relationship of the data assets; computing a value of each data asset; computing, using the causal graph and data values, a radius of recovery for each data asset; classifying each data asset as appropriate DNA stored by assigning a numerical ranking of each data asset; defining manual constraints and a DNA storage configuration; and generating a ranked list of recommended data assets for storing in the DNA storage using the classification, manual constraints and DNA storage configuration.