Abstract: Predicting the salience of one or more data entities to a particular (target) data entity from among a plurality of data entities may comprise generating a graph of the plurality of data entities and a machine-learned model architecture that predicts the salience of the one or more data entities output by the machine-learned model architecture using the graph. For example, the machine-learned model architecture may comprise a first machine-learned model for generating an embedding using the content of the target data entity, a second machine-learned model for generating a vector using the data type indicated by the target data entity, and a third machine-learned model (e.g., a graph neural network or other feed-forward neural network) for generating a contextual representation of the target data entity to which other contextual representations associated with the plurality of data entities may be compared (e.g., using Euclidean distance, cosine similarity, dot product).

Abstract: A text interaction record is received at a database system. The text interaction record may include interaction text from one or more messages between a client machine and a service provider. An input database record creation prompt that includes natural language instructions to generate database record field text based on the text interaction record may be determined. The input database record creation prompt may include some or all of the interaction text. The input database record creation prompt may be transmitted to a large language model for completion. A completed database record creation prompt may be received from the large language model. The completed database record creation prompt may include a text element created by the large language model based on the input database record creation prompt. A database record including a database field storing the text element may be generated in the database system.

Abstract: Systems, devices, and techniques are disclosed for security configuration evaluation. A binary representation of a reference security configuration for an application may be generated. The binary representation of the reference security configuration for the application may be hashed to generate a reference hash for the application. Data for an instance security configuration for an instance of the application may be received. A binary representation of the instance security configuration may be generated from the received data for the instance security configuration. The binary representation of the instance security configuration may be hashed to generate an instance hash. The computing device may determine the distance between the reference hash and the instance hash. The instance security configuration may be determined to be secure if the distance is not greater than a threshold.

Abstract: Techniques for adaptive processing of media data based on separate data specifying a state of the media data are provided. A device in a media processing chain may determine whether a type of media processing has already been performed on an input version of media data. If so, the device may adapt its processing of the media data to disable performing the type of media processing. If not, the device performs the type of media processing. The device may create a state of the media data specifying the type of media processing. The device may communicate the state of the media data and an output version of the media data to a recipient device in the media processing chain, for the purpose of supporting the recipient device's adaptive processing of the media data.

Abstract: Methods, computer readable media, and devices to automatically construct kill-chain from security alerts are disclosed. One method may include collecting a plurality of security alerts, receiving a selection of a high severity security alert associated with a node and a user from among the plurality of security alerts, creating a security narrative for the high severity security alert by providing a set of historical security alerts to a deep learning architecture, the set including security alerts selected based on a relation to the node and the user, and identifying a subset of the set of historical security alerts, including security alerts relevant to the high severity security alert, in a reverse time order by the deep learning architecture, and providing the security narrative as part of a response to the high severity security alert.

Abstract: Embodiments described herein provide A method for training a neural network based model. The methods include receiving a training dataset with a plurality of training samples, and those samples are encoded into representations in feature space. A positive sample is determined from the raining dataset based on a relationship between the given query and the positive sample in feature space. For a given query, a positive sample from the training dataset is selected based on a relationship between the given query and the positive sample in a feature space. One or more negative samples from the training dataset that are within a reconfigurable distance to the positive sample in the feature space are selected, and a loss is computed based on the positive sample and the one or more negative samples. The neural network is trained based on the loss.

Abstract: A cloud platform establishes a communication session between an agent and a user. The communication session is over an electrical medium. The cloud platform generates an interface on a client device associated with the agent. A first portion of the interface is configured to exchange messages between the agent and the user for a conversation or otherwise transcribe a conversation between the agent and the user. The cloud platform obtains, at a first time, a set of utterances from a transcript of the conversation. The cloud platform accesses a database including a plurality of articles. The cloud platform generates relevance scores between the conversation and the plurality of articles. The cloud platform then selects a subset of articles having relevance scores above a threshold value or proportion. The identified articles are presented on a second portion of the interface.

Abstract: A text interaction record including interaction text from one or more messages between a client machine and a service provider is received at a database system. A search vector including a text embedding representing the interaction text in a multi-dimensional vector space may be determined based on the interaction text via a processor at the database system. A reference interaction record including reference interaction text may be retrieved from the database system based on the search vector. The reference interaction record may include a reference vector representing the reference interaction text in the multi-dimensional vector space. Recommended reply text is determined based on the interaction text and the reference interaction text by a large language model configured to generate the recommended reply text in response to a prompt that includes one or more natural language instructions.

Abstract: A cloud platform establishes a communication session between an agent and a user. The communication session is over an electrical medium. The cloud platform generates an interface on a client device associated with the agent. A first portion of the interface is configured to exchange messages between the agent and the user for a conversation or otherwise transcribe a conversation between the agent and the user. The cloud platform obtains, at a first time, a set of utterances from a transcript of the conversation. The cloud platform accesses a database including a plurality of articles. The cloud platform generates relevance scores between the conversation and the plurality of articles. The cloud platform then selects a subset of articles having relevance scores above a threshold value or proportion. The identified articles are presented on a second portion of the interface.

Abstract: A method and system of authenticating a user logon builds a user logon profile with a plurality of user logon features gathered during at least one successful attempted user logon, determines a logon feature novelty score for each feature, receives a user logon request for authentication and extracts current user logon features, retrieves corresponding logon feature novelty scores, determines a first distance function score for the corresponding logon feature novelty scores of the current user logon features, builds a failed logon attempt database, determines a failed logon feature novelty score, extracts the failed logon feature novelty scores corresponding to current user logon features, determines a second distance function score for the corresponding failed logon feature novelty scores of the current user logon features, and determining to one of allow or deny the user logon request based on at least one of the first distance function score and the second distance function score.

Abstract: Systems, devices, and techniques are disclosed for security configuration evaluation. A binary representation of a reference security configuration for an application may be generated. The binary representation of the reference security configuration for the application may be hashed to generate a reference hash for the application. Data for an instance security configuration for an instance of the application may be received. A binary representation of the instance security configuration may be generated from the received data for the instance security configuration. The binary representation of the instance security configuration may be hashed to generate an instance hash. The computing device may determine the distance between the reference hash and the instance hash. The instance security configuration may be determined to be secure if the distance is not greater than a threshold.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for clustering and visualizing textual data. A data clustering and visualization system clusters large volumes of semi-structured and unstructured textual data into categories. Each category can include a group of similar alerts and incidents. The categories are then graphically presented.

Abstract: A method and system of authenticating a user logon builds a user logon profile with a plurality of user logon features gathered during at least one successful attempted user logon, determines a logon feature novelty score for each feature, receives a user logon request for authentication and extracts current user logon features, retrieves corresponding logon feature novelty scores, determines a first distance function score for the corresponding logon feature novelty scores of the current user logon features, builds a failed logon attempt database, determines a failed logon feature novelty score, extracts the failed logon feature novelty scores corresponding to current user logon features, determines a second distance function score for the corresponding failed logon feature novelty scores of the current user logon features, and determining to one of allow or deny the user logon request based on at least one of the first distance function score and the second distance function score.

Abstract: Methods, computer readable media, and devices to automatically construct kill-chain from security alerts are disclosed. One method may include collecting a plurality of security alerts, receiving a selection of a high severity security alert associated with a node and a user from among the plurality of security alerts, creating a security narrative for the high severity security alert by providing a set of historical security alerts to a deep learning architecture, the set including security alerts selected based on a relation to the node and the user, and identifying a subset of the set of historical security alerts, including security alerts relevant to the high severity security alert, in a reverse time order by the deep learning architecture, and providing the security narrative as part of a response to the high severity security alert.

Abstract: Methods, apparatuses, and computer readable media are disclosed. An application server may receive a dataset that includes records associated with user device interactions with a computer system. The application server may modify one or more records according to a data modification metric. The modifying may result in a modified dataset that satisfies a similarity metric defining a permissible deviation between the received dataset and the modified dataset according to a deviation threshold. The data modification metric may satisfy the similarity metric and may define a deviation in the modified dataset that results in an expected classification by the machine learning predictive model to classify the deviation in the modified dataset as an outlier event. The application server may process the modified dataset with the machine learning predictive model to produce a result. The application server may compare the expected classification to the classification to validate the model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract: Techniques for adaptive processing of media data based on separate data specifying a state of the media data are provided. A device in a media processing chain may determine whether a type of media processing has already been performed on an input version of media data. If so, the device may adapt its processing of the media data to disable performing the type of media processing. If not, the device performs the type of media processing. The device may create a state of the media data specifying the type of media processing. The device may communicate the state of the media data and an output version of the media data to a recipient device in the media processing chain, for the purpose of supporting the recipient device's adaptive processing of the media data.