Abstract: A computing machine receives an input comprising unstructured text. The computing machine identifies, within the unstructured text, one or more entities using a named entity recognition (NER) engine in a trained machine learning model. The trained machine learning model embeds tokens from the text into a vector space and uses generated embeddings to identify one or more tokens as being associated with the one or more entities. The computing machine determines, using the trained machine learning model that identifies the one or more entities and based on the embedded tokens, an assertion applied, within the text, to at least one entity. The assertion is represented as a vector in a multi-dimensional space. Each dimension corresponds to a part of the assertion. The trained machine learning model is a span-level model that both identifies the one or more entities and determines the assertion based on candidate spans of tokens.

Abstract: A computing machine accesses a directed graph representing one or more sequences of actions. The directed graph comprises nodes and edges between the nodes. Each node is either a beginning node, an intermediate node, or an end node. Each intermediate is downstream from at least one beginning node and upstream from at least one end node. Each beginning node in at least a subset of the beginning nodes has an explainability value vector. The computing machine computes, for each first node from among a plurality of first nodes that are intermediate nodes or end nodes, a provenance value representing dependency of an explainability value vector of the first node on the one or more nodes upstream from the first node. The computing machine computes, for each first node, the explainability value vector. The computing machine provides a graphical output representing at least an explainability value vector of an end node.

Abstract: Provenance analysis systems and methods. Datums representing relationships between entities can be stored in a knowledge store. Datums can be received from agents as agents perform activities. Activity records are be stored in a provenance graph, the activity record and associate received datums with any input datums used in the activity. Provenance subgraphs can 5 be retrieved by traversing the provenance graph for selected datums and presented through a user interface. Provenance subgraphs can be augmented with trust modifiers determined based on attributions, confidences, and refutations provided by a user. Trust modifiers can be propagated downstream to enable the addressing of junctions in variable confidence.

Abstract: A computing machine accesses a directed graph representing one or more sequences of actions. The directed graph comprises nodes and edges between the nodes. Each node is either a beginning node, an intermediate node, or an end node. Each intermediate is downstream from at least one beginning node and upstream from at least one end node. Each beginning node in at least a subset of the beginning nodes has an explainability value vector. The computing machine computes, for each first node from among a plurality of first nodes that are intermediate nodes or end nodes, a provenance value representing dependency of an explainability value vector of the first node on the one or more nodes upstream from the first node. The computing machine computes, for each first node, the explainability value vector. The computing machine provides a graphical output representing at least an explainability value vector of an end node.

Abstract: A computing machine receives an input comprising unstructured text. The computing machine identifies, within the unstructured text, one or more entities using a named entity recognition (NER) engine in a trained machine learning model. The trained machine learning model embeds tokens from the text into a vector space and uses generated embeddings to identify one or more tokens as being associated with the one or more entities. The computing machine determines, using the trained machine learning model that identifies the one or more entities and based on the embedded tokens, an assertion applied, within the text, to at least one entity. The assertion is represented as a vector in a multi-dimensional space. Each dimension corresponds to a part of the assertion. The trained machine learning model is a span-level model that both identifies the one or more entities and determines the assertion based on candidate spans of tokens.

Abstract: Provenance analysis systems and methods. Datums representing relationships between entities can be stored in a knowledge store. Datums can be received from agents as agents perform activities. Activity records are be stored in a provenance graph, the activity record and associate received datums with any input datums used in the activity. Provenance subgraphs can 5 be retrieved by traversing the provenance graph for selected datums and presented through a user interface. Provenance subgraphs can be augmented with trust modifiers determined based on attributions, confidences, and refutations provided by a user. Trust modifiers can be propagated downstream to enable the addressing of junctions in variable confidence.

Abstract: Provenance analysis systems and methods. Datums representing relationships between entities can be stored in a knowledge store. Datums can be received from agents as agents perform activities. Activity records are be stored in a provenance graph, the activity record and associate received datums with any input datums used in the activity. Provenance subgraphs can be retrieved by traversing the provenance graph for selected datums and presented through a user interface. Provenance subgraphs can be augmented with trust modifiers determined based on attributions, confidences, and refutations provided by a user. Trust modifiers can be propagated downstream to enable the addressing of junctions in variable confidence.

Abstract: Methods, systems, and computer-readable storage medium including a computer program product for defending against cyber-attacks are provided. One method includes receiving, by a processor, program code and automatically generating a chronomorphic binary for the program code. The method further includes storing the chronomorphic binary in an executable memory space and diversifying the executable memory space for the chronomorphic binary during runtime of the program code. A system includes memory configured for storing a defense module and a processor connected to the memory. The processor, when executing the defense module, is configured for performing the above-referenced method. One computer program product includes computer code for performing the above-referenced method.

Abstract: Methods, systems, and computer-readable storage medium including a computer program product for defending against cyber-attacks are provided. One method includes receiving, by a processor, program code and automatically generating a chronomorphic binary for the program code. The method further includes storing the chronomorphic binary in an executable memory space and diversifying the executable memory space for the chronomorphic binary during runtime of the program code. A system includes memory configured for storing a defense module and a processor connected to the memory. The processor, when executing the defense module, is configured for performing the above-referenced method. One computer program product includes computer code for performing the above-referenced method.

Abstract: Methods, systems, and computer-readable storage medium including a computer program product for defending against cyber-attacks are provided. One method includes receiving, by a processor, program code and automatically generating a chronomorphic binary for the program code. The method further includes storing the chronomorphic binary in an executable memory space and diversifying the executable memory space for the chronomorphic binary during runtime of the program code. A system includes memory configured for storing a defense module and a processor connected to the memory. The processor, when executing the defense module, is configured for performing the above-referenced method. One computer program product includes computer code for performing the above-referenced method.