Abstract: A method of forming an integrated circuit (IC) package with improved performance and reliability is disclosed. The method includes forming a singulated IC die, coupling the singulated IC die to a carrier substrate, and forming a routing structure. The singulated IC die has a conductive via and the conductive via has a peripheral edge. The routing structure has a conductive structure coupled to the conductive via. The routing structure further includes a cap region overlapping an area of the conductive via, a routing region having a first width from a top-down view, and an intermediate region having a second width from the top-down view along the peripheral edge of the conductive via. The intermediate region is arranged to couple the cap region to the routing region and the second width is greater than the first width.

Abstract: A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Abstract: An approach to workflow management in response to a detected security incident in a computer system. The approach may include an inference driven response based on prior artifacts. The inference driven response may predict the condition of the system and the outcomes of actions in response to the security incident. The predictions made by the inference drive response may be based on a machine learning model. The inference driven response may pause or prevent scheduled actions of the system based on the predictions. The inference driven response may continue to monitor the system and dynamically update its predictions for the condition of the system. In response to the updated predictions, the inference driven response may cancel or execute the previously scheduled actions of the system.

Abstract: A method, computer system, and a computer program product for smart SDN is provided. The present invention may include recording and clustering a pod's behavior to generate a behavior transition model for the pod. The present invention may include watching a behavior of the pod and comparing the behavior to the generated behavior transition model. The present invention may include triggering a network policy change based on determining that the behavior of the pod is a misbehavior.

Abstract: A computer-implemented method for automatically adjusting a Uniform Resource Locator (URL) seed list. The method includes crawling for documents based on a seed URL list. The method generates relations data from the documents using a Natural Language Processing (NLP) model. The method analyzes the relations data using an auto-seed model. The method modifies the seed URL list.

Abstract: A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Abstract: A computational device generates a graph data structure comprising a plurality of inductive nodes having a plurality of attributes. The plurality of inductive nodes are clustered into a plurality of groupings based on the plurality of attributes. A substitution is made of more than one inductive node with a single distribution node that represents characteristics of the more than one inductive node based on distribution models of attributes included in the plurality of groupings.

Abstract: An approach to workflow management in response to a detected security incident in a computer system. The approach may include an inference driven response based on prior artifacts. The inference driven response may predict the condition of the system and the outcomes of actions in response to the security incident. The predictions made by the inference drive response may be based on a machine learning model. The inference driven response may pause or prevent scheduled actions of the system based on the predictions. The inference driven response may continue to monitor the system and dynamically update its predictions for the condition of the system. In response to the updated predictions, the inference driven response may cancel or execute the previously scheduled actions of the system.

Abstract: In an approach location allocation planning, one or more computing units determine at least one location matching model for a first current participating entity of a plurality of current participating entities of a current event, wherein an output of the location matching model indicates a matching degree between the first current participating entity and a current event location. The one or more computing units create at least one initial location allocation plan for the plurality of current participating entities of the event based, at least in part, on the at least one location matching model. The one or more computing units receive feedback from at least one of the plurality of current participating entities. Responsive to the feedback indicating acceptance of the initial location allocation plan, the one or more computing units determine a final location allocation plan based on the initial location allocation plan.

Abstract: One or more processors track internet usage of a user. The tracking includes tracking a first user input into one or more websites using a keylogging subprogram. One or more processors analyze the first user input. Analyzing the first user input includes using machine learning to gain knowledge of one or more interests of the first user based on the first user input. One or more processors determine a proximity of the first user to at least one point of interest within a first threshold distance of the first user while the first user is mobile, match at least one interest of the one or more interests of the first user with one or more interests associated with the at least one point of interest, and provide a notification that the first user is within the first threshold distance of the at least one point of interest.

Abstract: A computer-implemented method for automatically adjusting a Uniform Resource Locator (URL) seed list. The method includes crawling for documents based on a seed URL list. The method generates relations data from the documents using a Natural Language Processing (NLP) model. The method analyzes the relations data using an auto-seed model. The method modifies the seed URL list.

Abstract: A first natural language document is received. The document includes unstructured data and a first table structure that includes a plurality of first table entries. The first table structure is identified based on the document. The first table structure is extracted from the document in response to the identifying. A first machine learning output is generated based on a first machine learning model and from the document. A second machine learning output is generated based on a second machine learning model and from the first table structure. The first output of the document and the second output of the first table structure are combined.

Abstract: A method, computer program product, and computer system for receiving, by a computing device, one or more user preferences for a video clip. The one or more user preferences may be matched with one or more branches of the video clip, wherein each of the one or more branches may include one or more segments of the video clip. The one or more segments of the video clip may be selected from the one or more branches based upon, at least in part, matching the one or more user preferences with the one or more branches of the video clip. The video clip may be composed based upon, at least in part, the one or more user preferences.

Abstract: Embodiments of the present invention are directed to a computer-implemented method for identifying advertisements in a video. The method includes obtaining a plurality of copies of the video and processing each of the plurality of copies of the video, wherein the processing identifies a plurality of iframes in each of the plurality of copies of the video. The method also includes comparing the plurality of iframes of each of the plurality of copies of the video. The method further includes identifying one or more common portions of each of the plurality of copies of the video one or more advertisement in the video, based on the comparison.

Abstract: Provided are systems, methods, and media for multiphase graph partitioning for malware entity detection. An example method includes receiving an input string associated with the malware entity. A determination is made as to whether the input string includes a symbolic word, a non-symbolic word, a symbolic phrase, or a non-symbolic phrase. A branching graph is formed based on a combination of the input string and a plurality of stored strings that are each associated with the malware entity to determine whether the input string is a valid detection name of the malware entity, in which the branching graph is formed by at least performing a first graph partitioning stage and a second graph partitioning stage. The input string is then labeled based on the formed branching graph and then outputted to a malware detection engine.

Abstract: In various embodiments, a computer-implemented method includes identifying data files in external storage, where the data files correspond to a computer software application (application) on a mobile device. The method may also include sorting the one or more data files into different access levels. The method may also include predicting the sorted one or more data files that will be accessed on the mobile device using a prediction engine. The method may also include locating the predicted one or more data files in the external storage using a migration map. The method may also include determining whether the predicted one or more data files were previously migrated to the external storage from the mobile device. The method may also include migrating the predicted one or more data files from the external storage to the mobile device.

Abstract: A method, computer system, and a computer program product for crawling and extracting main content from a web page is provided. The present invention may include retrieving a HTML document associated with a web page. The present invention may then include identifying at least one entry point located in the retrieved HTML document by utilizing a self-adaptive entry point locator. The present invention may also include extracting a main content article associated with the retrieved HTML document based on the identified at least one entry point. The present invention may further include presenting the extracted main content associated with the retrieved HTML document to the user.

Abstract: Methods, systems and computer program products for flagging abnormal videos are provided. Aspects include training an image recognition model based on a plurality of images that depict one or more of a plurality of subjects. Aspects also include generating a normal subject relationship graph representing normal relationships between the plurality of subjects by applying the image recognition model to a plurality of training videos and a test subject relationship graph representing test relationships between subjects depicted in a test video by applying the image recognition model to the test video. Each normal relationship is associated with a strength value. Responsive to determining that a difference between a strength value associated with a first normal relationship and a strength value associated with a corresponding first test relationship exceeds a predetermined threshold, aspects include flagging the test video as being abnormal.

Abstract: Methods, systems and computer program products for flagging abnormal videos are provided. Aspects include training an image recognition model based on a plurality of images that depict one or more of a plurality of subjects. Aspects also include generating a normal subject relationship graph representing normal relationships between the plurality of subjects by applying the image recognition model to a plurality of training videos and a test subject relationship graph representing test relationships between subjects depicted in a test video by applying the image recognition model to the test video. Each normal relationship is associated with a strength value. Responsive to determining that a difference between a strength value associated with a first normal relationship and a strength value associated with a corresponding first test relationship exceeds a predetermined threshold, aspects include flagging the test video as being abnormal.

Abstract: Embodiments of the present invention are directed to a computer-implemented method for identifying advertisements in a video. The method includes obtaining a plurality of copies of the video and processing each of the plurality of copies of the video, wherein the processing identifies a plurality of iframes in each of the plurality of copies of the video. The method also includes comparing the plurality of iframes of each of the plurality of copies of the video. The method further includes identifying one or more common portions of each of the plurality of copies of the video one or more advertisement in the video, based on the comparison.