Abstract: Techniques are provided for reinforcement learning-based evaluation of software product usage. One method comprises obtaining key performance indicators indicating software product usage by a user; determining, for a predefined time window: (i) a mean and/or a median of the obtained KPIs; (ii) an amount of time that the software product was active; and (iii) an amount of interactions by the user with a user interface; evaluating possible login states of the software product using at least one reinforcement learning agent, wherein the evaluating comprises (a) observing the plurality of possible login states, including a current state comprising a current login state of the software product, and (b) obtaining an expected utility score for changing from the current login state to a different login state of the software product; and determining whether to change from the current login state to a different login state of the software product based on the expected utility score.

Abstract: Techniques are provided for multi-party prediction using feature contribution values. One method comprises obtaining a first set of feature contribution values associated with respective ones of a plurality of machine learning models, wherein each machine learning model is trained using training data of a different party and each feature contribution value indicates a contribution by a corresponding feature to a prediction generated by the associated machine learning model; training an aggregate machine learning model using the obtained first sets of feature contribution values; receiving a second set of feature contribution values generated by applying data of at least one party to at least one machine learning model; and applying the second set of feature contribution values to the trained aggregate machine learning model to obtain a global prediction.

Abstract: Techniques are provided for evaluating multiple machine learning models to identify issues with a communication. One method comprises applying an audio signal associated with a communication to at least two of: (i) a trigger word analysis module that evaluates contextual information to determine if a trigger word is detected in the audio signal; (ii) an audio activity pattern analysis module that determines if a silence pattern anomaly is detected; and (iii) a communication application analysis module that evaluates features provided by a communication application relative to applicable thresholds; and combining results of the at least two of the trigger word analysis module, the audio activity pattern analysis module and the communication application analysis module to identify a communication issue. The combining may evaluate an accuracy of the trigger word analysis module, the audio activity pattern analysis module and/or the communication application analysis module to combine the results.

Abstract: Techniques described herein relate to a method for predicting results using ensemble models. The method may include receiving trained model data sets from a model source nodes, each trained model data set comprising a trained model, an important feature list, and a missing feature generator; receiving a prediction request data set; making a determination that the prediction request data set does not include an input feature for a trained model; generating, based on the determination and using a missing feature generator, a substitute feature to replace the input feature; executing the trained model using the prediction request data set and the substitute feature to obtain a first prediction; executing a second trained model using the prediction request data set to obtain a second prediction; and obtaining a final prediction using the first prediction, the second prediction, and an ensemble model.

Abstract: Information technology resource forecasting based on time series analysis is described. A system creates multiple forecasts for an information technology resource by applying corresponding multiple time series models to first data associated with the information technology resource. The system selects a model of the multiple time series models by comparing the multiple forecasts for the information technology resource to second data associated with the information technology resource. The system outputs a forecast that is created by applying the selected model to third data associated with the information technology resource.

Abstract: Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp.

Abstract: One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

Abstract: One example method includes data protection operations including cyber security operations, threat detection operations, and other security operations. Normal device behavior is learned based on data collected by an anomaly detection engine operating in a kernel. The normal data is used to train a machine learning model. Threats are detected when the machine learning model indicates that new data points deviate from normal device behavior. Associated processes are stopped. This allows threats to be detected based on normal behavior rather than on unknown threat behavior.

Abstract: Techniques are provided for generating workspace recommendations based on prior user ratings of selected workspaces, as well as other similar selections. One method comprises obtaining user workspace ratings provided by a user; calculating a first workspace recommendation score for workspaces that the user previously rated based on the obtained user workspaces ratings; calculating a second workspace recommendation score for additional workspaces that are: (i) similar to workspaces previously rated by the user based on a predefined workspace similarity metric, and/or (ii) selected by similar users, based on a predefined user similarity metric; and recommending workspaces for the user based on the first workspace recommendation score and the second workspace recommendation score.

Abstract: Techniques are provided for fraud mitigation using enhanced spatial features. One method comprises obtaining transaction data associated with a transaction; obtaining a machine learning module trained using training transaction data for multiple geographic areas to learn a correlation of the training transaction data with fraudulent activity for each geographic area; extracting a transaction address from the transaction data; determining a given geographic area for the transaction using the transaction address; determining values for a predefined spatial feature for a predefined region that includes the transaction address in the given geographic area using a query of an external online data source; applying the determined values for the predefined spatial feature to the machine learning module to obtain an anomaly score for the transaction; and initiating a predefined remedial step and/or a predefined mitigation step when the transaction is determined to be a predefined anomaly based on the anomaly score.

Abstract: Techniques are provided for multi-party prediction using feature contribution values. One method comprises obtaining a first set of feature contribution values associated with respective ones of a plurality of machine learning models, wherein each machine learning model is trained using training data of a different party and each feature contribution value indicates a contribution by a corresponding feature to a prediction generated by the associated machine learning model; training an aggregate machine learning model using the obtained first sets of feature contribution values; receiving a second set of feature contribution values generated by applying data of at least one party to at least one machine learning model; and applying the second set of feature contribution values to the trained aggregate machine learning model to obtain a global prediction.

Abstract: Techniques are provided for evaluating multiple machine learning models to identify issues with a communication. One method comprises applying an audio signal associated with a communication to at least two of: (i) a trigger word analysis module that evaluates contextual information to determine if a trigger word is detected in the audio signal; (ii) an audio activity pattern analysis module that determines if a silence pattern anomaly is detected; and (iii) a communication application analysis module that evaluates features provided by a communication application relative to applicable thresholds; and combining results of the at least two of the trigger word analysis module, the audio activity pattern analysis module and the communication application analysis module to identify a communication issue. The combining may evaluate an accuracy of the trigger word analysis module, the audio activity pattern analysis module and/or the communication application analysis module to combine the results.

Abstract: Recommending applications is disclosed. An application graph is disclosed that represents applications. Each node of the graph corresponds to an application and edges relate applications that can handle the same file type. When an input application is identified, the graph can be used to recommend other applications that may be a suitable replacement for the input application. The recommendation is based on the graph and its links and on characteristics of the organization.

Abstract: Techniques are provided for system operational analytics using additional features over time-series counters for health score computation. An exemplary method comprises: obtaining log data from data sources of a monitored system; applying a counting function to the log data to obtain time-series counters for a plurality of distinct features within the log data; applying an additional function to the time-series counters for the plurality of distinct features; and processing an output of the additional function using a machine learning model to obtain a health score for the monitored system based on the output of the additional function.

Abstract: Recommending applications is disclosed. An application graph is disclosed that represents applications. Each node of the graph corresponds to an application and edges relate applications that can handle the same file type. When an input application is identified, the graph can be used to recommend other applications that may be a suitable replacement for the input application. The recommendation is based on the graph and its links and on characteristics of the organization.

Abstract: Techniques are provided for identifying anomalies in an Internet of Things (IoT) activity profile of a user using an analytic engine. An exemplary method comprises obtaining data from a plurality of IoT devices of a user, wherein at least one IoT device comprises an agent device that performs an action on behalf of the user; applying the obtained data to a feature engineering module to convert the obtained data into time-series features that capture behavior and/or characteristics of an IoT environment of the user; and applying the time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in the IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned patterns.

Abstract: Techniques are provided for fraud mitigation using enhanced spatial features. One method comprises obtaining transaction data associated with a transaction; obtaining a machine learning module trained using training transaction data for multiple geographic areas to learn a correlation of the training transaction data with fraudulent activity for each geographic area; extracting a transaction address from the transaction data; determining a given geographic area for the transaction using the transaction address; determining values for a predefined spatial feature for a predefined region that includes the transaction address in the given geographic area using a query of an external online data source; applying the determined values for the predefined spatial feature to the machine learning module to obtain an anomaly score for the transaction; and initiating a predefined remedial step and/or a predefined mitigation step when the transaction is determined to be a predefined anomaly based on the anomaly score.

Abstract: Techniques are provided for generating workspace recommendations based on prior user ratings of selected workspaces, as well as other similar selections. One method comprises obtaining user workspace ratings provided by a user; calculating a first workspace recommendation score for workspaces that the user previously rated based on the obtained user workspaces ratings; calculating a second workspace recommendation score for additional workspaces that are: (i) similar to workspaces previously rated by the user based on a predefined workspace similarity metric, and/or (ii) selected by similar users, based on a predefined user similarity metric; and recommending workspaces for the user based on the first workspace recommendation score and the second workspace recommendation score.

Abstract: Techniques are provided for software license optimization using machine learning-based user clustering. One method comprises obtaining key performance indicators indicating individual usage by a plurality of users of a software product; applying at least one function to the key performance indicators to obtain a plurality of time dependent features; processing the time dependent features using a machine learning model to cluster the users into a plurality of persona clusters; and determining a number of each available license type for the software product for the plurality of users based on the persona clusters. The key performance indicators comprise, for example, user behavioral data with respect to usage of the software product and/or performance data with respect to usage of the software product. One or more policies can be determined for managing an allocation of the available license types for the software product to the plurality of users.

Abstract: Techniques are provided for software license optimization using machine learning-based user clustering. One method comprises obtaining key performance indicators indicating individual usage by a plurality of users of a software product; applying at least one function to the key performance indicators to obtain a plurality of time dependent features; processing the time dependent features using a machine learning model to cluster the users into a plurality of persona clusters; and determining a number of each available license type for the software product for the plurality of users based on the persona clusters. The key performance indicators comprise, for example, user behavioral data with respect to usage of the software product and/or performance data with respect to usage of the software product. One or more policies can be determined for managing an allocation of the available license types for the software product to the plurality of users.