Abstract: One example method includes receiving telemetry data including network activities of a network. The network activities are linked to core network entities. Causal relationships between the network activities and the core network entities are continually modeled to determine a propagation dynamic for each of the core network entities. The propagation dynamic includes integrity states that estimate a risk of each core network entity to the network. A request for access to the network is received from one of the core network entities. A confidence score is determined based at least on an access policy of the network and the integrity states of the core network entity requesting access. It is then determined if access to the network is to be granted based on the confidence score.

Abstract: Migrating computing systems to zero trust compliant architectures using templates that are constructed from multimodal unstructured sources. The unstructured input data is converted to structured data using a trained machine learning model. The structured data output by the model may be reviewed. If errors are found, a revision script can be revised or refined and the unstructured input data may be re-ingested. When the structured data is suitable, the structured data is parsed and stored as templates in a template database. A database of zero trust approved hardware and/or software may be generated. Migration operations may be performed using the templates in the template database and/or the information in the hardware and software database.

Abstract: One example method includes receiving a set of requirements for aspects of a network, identifying a gap between one of the aspects of the network and a zero trust (ZT) requirement, determining a solution set comprising potential solutions for reducing or eliminating the gap, associating a respective cost with each of the solutions, determining an extent to which the solutions of the solution set comply with requirements, recommending a best solution from the solutions of the solution set, determining a priority of the gap relative to respective priorities of other gaps, and outputting a list of the gaps, sorted by priority, and the recommended best solution.

Abstract: One example method includes collecting telemetry concerning an activity occurring in an IT infrastructure, updating an activity database with the telemetry, applying a rule to determine if the activity is associated with a crossing of an analytics-defined perimeter (ADP) within the IT infrastructure, when a perimeter crossing has been determined to have occurred, applying a policy to determine whether, and what, action should be taken with respect to the perimeter crossing, and implementing an action with respect to an entity whose activity is being evaluated when the perimeter crossing is determined to be contrary to the policy.

Abstract: Method for model updating in a federated learning environment, including distributing a current model to client nodes; receiving a first set of gradient sign vectors, wherein each gradient sign vector of the first set of gradient sign vectors is received from one client node; generating a first updated model based on the first set of gradient sign vectors; distributing the first updated model to the plurality of client nodes; storing a first shape parameter and a second shape parameter; receiving, in response to distributing the first updated model, a second set of gradient sign vectors, wherein each gradient sign vector of the second set of gradient sign vectors is received from one client node; generating a second updated model based on the second set of gradient sign vectors, the first shape parameter, and the second shape parameter; and distributing the second updated model to the plurality of client nodes.

Abstract: One example method includes receiving, at a control plane of a zero trust (ZT) architecture, a request to implement a proposed policy, forwarding the request to multiple policy engines of a blockchain policy engine, executing, by the policy engines, a consensus algorithm that decides whether or not the proposed policy will be implemented, wherein, as part of execution of the consensus algorithm, each of the policy engines performs a respective validation process with respect to the proposed policy, and when a consensus is reached by the policy engines, either implementing the proposed policy, or preventing implementation of the proposed policy, as dictated by the consensus.

Abstract: Monitoring and validating zero trust systems is disclosed. A monitoring engine, which is external to a zero trust architecture, is configured to instantiate clients based on client specifications. This allows a client to issue a request to a zero trust system and evaluate the response to the request in the context of an expected response. The behavior of the zero trust system can be validated or not validated based on this evaluation.

Abstract: One example method includes dynamically monitoring a stream of image portions that have been classified by a segmentation model of a video surveillance system, evaluating the image portions, based on the evaluating, determining that an attack on the video surveillance system is occurring, or has occurred, and implementing, or causing the implementation of, a remedial action with regard to the attack. The image portions may be image portions that have been classified by a segmentation model.

Abstract: One example method includes using a zero trust architecture to surveil a network to obtain information about a vulnerability in a network, determining, based on the information, a threat mitigation strategy responsive to the vulnerability, communicating the threat mitigation strategy to enable resource allocation for implementation of the threat mitigation strategy, allocating any needed resources for implementation of the threat mitigation strategy, and using the resources to implement the threat mitigation strategy.

Abstract: One example method includes receiving a data file at a large language model (LLM). Arbitrary tags that include labels that are attachable to the data file and prompts are also received. The prompts are paired with the arbitrary tags to form arbitrary tag-prompt pairs and include information that is used by the LLM to find the paired arbitrary tag. The LLM determines a selected subset of the arbitrary tags that apply to the data file. A trust module receives the selected subset of the arbitrary tags that apply to the data file and data access policies that specify access rules for the data file. A conditional access decision is determined that specifies whether access should be given to the data file.

Abstract: A framework for rapidly prototyping federated learning algorithms. Specifically, the disclosed framework proposes a method and system for evaluating different hypotheses for configuring learning model, which may be optimized through federated learning. Through the disclosed framework, these hypotheses may be tested for scalability, hardware and network resource performance, as well as for new learning state compression and/or aggregation technique effectiveness. Further, these hypotheses may be tested through federated learning simulations, which avoid costs associated with deploying these hypotheses to be tested across production systems.

Abstract: Techniques are disclosed for providing a framework for fast prototyping attacks and defenses on transfer learning settings. For example, a system can include at least one processing device including a processor coupled to a memory, the at least one processing device being configured to perform the following steps: defining a set of evaluation metrics, each evaluation metric configured to test responses by a machine learning model when applying a given defense among a set of defenses against a set of adversarial inputs generated for the model; selecting one or more defenses from the set of defenses based on the evaluation metrics; and generating a secured model based on incorporating the selected defenses into the model.

Abstract: One example method includes dynamically monitoring a stream of image portions that have been classified by a segmentation model of a video surveillance system, evaluating the image portions, based on the evaluating, determining that an attack on the video surveillance system is occurring, or has occurred, and implementing, or causing the implementation of, a remedial action with regard to the attack. The image portions may be image portions that have been classified by a segmentation model.

Abstract: One example method includes, in an edge node, of a group of edge nodes that are each operable to communicate with a central node, performing operations that include generating a vector that includes gradients associated with a model instance, of a central model, that is operable to run at the edge node, performing a check to determine whether the model instance is overfitting to data generated at the edge node, and either performing sign compression on the vector when overfitting is not indicated, or performing random perc sign compression on the vector when overfitting is indicated, and transmitting the vector, after compression, to the central node that includes the central model.

Abstract: Methods for compression switching that includes distributing a model to client nodes, which use the model to generate a gradient vector (GV) based on a client node data set. The method includes receiving a model update that includes a gradient sign vector (GSV) based on the gradient vector; generating an updated model using the GSV; and distributing the updated model to the client nodes. The client node uses the updated model to generate a second GV based on a second client node data set. The method also includes a determination that a compression switch condition exists; based on the determination, transmitting an instruction to the client node to perform a compression switch; receiving, in response to the instruction, another model update including a subset GSV based on the second gradient vector; generating a second updated model using the subset GSV; and distributing the second updated model to the client nodes.

Abstract: One example method includes accessing input data elements from logs that identify user problems with computing system components, the data elements each associated with a respective original class label that identifies a class of computing system components to which the data element relates, the respective original class labels forming a group of class labels, and a first of the original class labels is overrepresented in the group, and reducing overrepresentation of the first original class label in the group by creating an arbitrary aggregation of some of the class labels that includes the first original class label. The method includes creating, based on a hierarchical modeling structure, prepared data in which an original class label is replaced by the aggregation. Next a hierarchical model and benchmark model are trained, and each model generates respective predictions for comparison. An inferencing process is performed to determine which predicted label will be used.

Abstract: Facilitating detection of anomalies of a target entity is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise training a model on a first set of variables that are constrained by a second set of variables. The second set of variables can characterize elements of a defined entity. The first set of variables can define a normality of the defined entity. The operations also can comprise employing the model to identify expected parameters and unexpected parameters associated with the defined entity to at least a defined level of confidence.

Abstract: One example method includes deploying a discriminator, where the discriminator is trained to recognize an adversarial image received by the discriminator as adversarial, and the adversarial image is generated based upon an original image, the adversarial image including a perturbation that cannot be detected by a human eye but which is effective to deceive an image segmentation model to misclassify the original image, receiving, by the discriminator, an image captured by an autonomous vehicle, and determining, by the discriminator, whether the image received from the autonomous vehicle is adversarial.

Abstract: Facilitating temporal data management for anomalous state detection in data centers is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise performing a process of extraction, transformation, and loading of data from log files into a telemetry data store. The data can be loaded into the telemetry data store as telemetry data. The operations also can comprise dividing the telemetry data into first telemetry data and second telemetry data. The first telemetry data can comprise telemetry data that does not satisfy a defined quality level. The second telemetry data can comprise telemetry data that satisfies the defined quality level. Further, the operations can comprise removing the first telemetry data from the telemetry data store and outputting the second telemetry data based on a request for the second telemetry data.

Abstract: Facilitating detection of anomalies of a target entity is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise training a model on a first set of variables that are constrained by a second set of variables. The second set of variables can characterize elements of a defined entity. The first set of variables can define a normality of the defined entity. The operations also can comprise employing the model to identify expected parameters and unexpected parameters associated with the defined entity to at least a defined level of confidence.