Abstract: A dynamic agent runtime engine (DARE) instantiates, orchestrates, and governs multiple types of software, LLM-based agents in an enterprise computing environment. Agents are declaratively defined by human-readable configuration files that specify parameters such as role, inputs, outputs, orchestration directives, governance requirements, and enterprise-specific content. Based on these files, the DARE instantiates runtime agent processes and couples them to enterprise systems of record. Two categories of agents are supported: dynamic agents, instantiated ephemerally in volatile memory to perform non-state-changing operations under pooled governance, and apply agents, instantiated persistently to perform state-changing operations under individual lifecycle governance. Human-in-the-loop directives, customizable content fields, and declarative non-functional requirements may also be enforced.

Abstract: A computer system may be configured to access a rule including one or more conditions, providing a user interface configured for user input of a modification to a condition of the rule, receive from a user, via the user interface, a modification to a first condition of the rule constituting a first changed condition, wherein the first changed condition is associated with a modified rule, determine an output data set, based on an input data set including a plurality of past data samples, and the first changed condition of the modified rule, and update the user interface to include a visualization indicating at least some of the output data set.

Abstract: A computer-implemented method and system standardize code patterns within enterprise software environments. A code modernization system utilizes a Large Language Model (LLM) and a specialized prompt library. The library includes pattern recognition prompts to guide the LLM in identifying specific code patterns within selected software code, potentially using enterprise-specific context. It also includes standardized solution prompts to guide the LLM in generating replacement code conforming to predefined enterprise standards for the identified patterns. The system orchestrates communication, transmitting code and relevant prompts to the LLM and receiving identified patterns and subsequently the generated standardized replacement code. This automated approach facilitates improved code quality, consistency, maintainability, and can support code translation efforts within the enterprise.

Abstract: A computer-implemented system analyzes program and data flows in a software system comprising code written in multiple programming languages using a generative large language model (LLM) directed by programming-language-specific prompts. The LLM identifies functional components within the code, generating labeled graph nodes that include a node type, a node name, and dependency information. A graph construction computer system processes the labeled graph nodes to generate a directed graph, where nodes represent functional components and directed edges represent dependencies. The system stores the graph in a database and provides a web-based interface for visualization, allowing users to explore, query, and analyze program and data flows across the software system. The system enables automated, language-agnostic dependency mapping, facilitating software analysis, debugging, and modernization.

Abstract: Computer-implemented systems and methods use a Large Language Model (LLM) for converting a legacy computer program in a first language to a human-language description of the legacy computer program, which description can be validated as being an accurate description of the legacy computer program. Once validated, the human-language description can be converted, again using an LLM, to a computer program in a target programming language. An LLM can also be used to generate test scripts for the new target-language program to test the performance of the target-language program in a production environment. An LLM can also be used to reconcile outputs from the legacy program to the new target program, such as on a function-by-function basis. If the differences between the outputs (if any) are sufficiently negligible, the legacy computer program can be decommissioned, and the new, target language program can be used in production.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: A computer-implemented method and system standardize code patterns within enterprise software environments. A code modernization system utilizes a Large Language Model (LLM) and a specialized prompt library. The library includes pattern recognition prompts to guide the LLM in identifying specific code patterns within selected software code, potentially using enterprise-specific context. It also includes standardized solution prompts to guide the LLM in generating replacement code conforming to predefined enterprise standards for the identified patterns. The system orchestrates communication, transmitting code and relevant prompts to the LLM and receiving identified patterns and subsequently the generated standardized replacement code. This automated approach facilitates improved code quality, consistency, maintainability, and can support code translation efforts within the enterprise.

Abstract: A computer-implemented system analyzes program and data flows in a software system comprising code written in multiple programming languages using a generative large language model (LLM) directed by programming-language-specific prompts. The LLM identifies functional components within the code, generating labeled graph nodes that include a node type, a node name, and dependency information. A graph construction computer system processes the labeled graph nodes to generate a directed graph, where nodes represent functional components and directed edges represent dependencies. The system stores the graph in a database and provides a web-based interface for visualization, allowing users to explore, query, and analyze program and data flows across the software system. The system enables automated, language-agnostic dependency mapping, facilitating software analysis, debugging, and modernization.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: Computer-implemented systems and methods use a Large Language Model (LLM) for converting a legacy computer program in a first language to a human-language description of the legacy computer program, which description can be validated as being an accurate description of the legacy computer program. Once validated, the human-language description can be converted, again using an LLM, to a computer program in a target programming language. An LLM can also be used to generate test scripts for the new target-language program to test the performance of the target-language program in a production environment. An LLM can also be used to reconcile outputs from the legacy program to the new target program, such as on a function-by-function basis. If the differences between the outputs (if any) are sufficiently negligible, the legacy computer program can be decommissioned, and the new, target language program can be used in production.

Abstract: A method comprises creating and storing a dependency graph representing at least one derived dataset and one or more raw datasets or intermediate derived datasets on which the at least one derived dataset depends; reading configuration data specifying one or more periods; detecting, at a first unscheduled time, a first update to a first dataset among the one or more raw datasets or intermediate derived datasets, the first dataset being a beginning of a series of derived datasets ending with a final dataset; initiating a first transformation of the first dataset to generate a first intermediate derived dataset; detecting, at a second unscheduled time, a second update to the first dataset; determining that a throttle condition specified in the configuration data is not met; initiating, when the final dataset is not yet built in response to the first update, a second transformation of the first dataset.

Abstract: A data processing method comprises creating and storing a dependency graph representing at least one derived dataset and one or more raw datasets or intermediate derived datasets on which the at least one derived dataset depends; reading configuration data specifying one or more periods for one or more datasets in the dependency graph; detecting a first update to a first dataset; initiating a first build of a first intermediate derived dataset only when a then-current time is within a first period of the one or more periods or a previous build of the first intermediate derived dataset occurred earlier than a then-current time less a second period of the one or more periods; asynchronously detecting a second update to a second dataset; initiating, in response to the second update, a second build of a second intermediate derived dataset that depends on the second dataset.

Abstract: A method, performed by one or more processors, includes: receiving an indication of a desired modification to a cybersecurity event detector that is being contemporaneously used for the detection of potential cybersecurity events in a production environment; modifying, in a sandbox environment, the cybersecurity event detector based on the indication of the desired modification to the cybersecurity event detector; and for each system event in a set of system events, determining, in the sandbox environment, whether the respective system event is indicative of a potential cybersecurity event using the modified cybersecurity event detector. Related apparatus are also disclosed.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: Methods, systems, and devices for wireless communications are described. In some aspects, a device may support multi-link operation (MLO) and may include a first arbitration block that manages communication on a first radio link and a second arbitration block that manages communication on a second radio link. The first arbitration block and the second arbitration block may support a signaling mechanism according to which each of the first arbitration block and the second arbitration block share or exchange information relating to a transmit power used on their respective radio link. For example, the first arbitration block may transmit, to the second arbitration block, an indication of a first transmit power for a first transmission on the first radio link and the second arbitration block may use the indication of the first transmit power to select a second transmit power for a second transmission on the second radio link.

Abstract: A computer system may be configured to access a rule including one or more conditions, providing a user interface configured for user input of a modification to a condition of the rule, receive from a user, via the user interface, a modification to a first condition of the rule constituting a first changed condition, wherein the first changed condition is associated with a modified rule, determine an output data set, based on an input data set including a plurality of past data samples, and the first changed condition of the modified rule, and update the user interface to include a visualization indicating at least some of the output data set.

Abstract: A system includes a processor and a memory device communicatively coupled to the processor. The system also includes a database communicatively coupled to the processor. The database is configured to store a first plurality of prediction sets. Each prediction set is associated with a respective individual within a first population. Each prediction set comprises a plurality of prediction results, and each prediction result corresponds to a selected one of a plurality of features. The processor is configured to receive a request for a distribution value associated with a selected feature and one or more parameters. The distribution value indicate how often the selected feature appears in a second population of individuals, the second population being defined by the one or more parameters.

Abstract: A system for troubleshooting network problems is disclosed. A model can use demographic information, network usage information, and network membership information to determine an importance of a problem. The importance of the problem for the user who reported the problem, a number of other users affected by the problem, and the importance of the problem to the other users can be used to determine a priority for resolving the problem. Before and after a work order is executed to resolve the problem, network metrics can be gathered, including aggregate network metrics, and automatically presented in various user interfaces. The analysis of the metrics can be used to update a database of which work orders are assigned in response to which problems.