Abstract: Systems and methods of reconfiguring machine learning models are disclosed. A method includes receiving, by a server computer, external data and determining, by the server computer, a machine learning model from a plurality of machine learning models, based on the external data. The plurality of machine learning models are in standby mode. The server computer configures an AI engine with the machine learning model. The method also includes receiving, by the server computer, a prediction request from a client computer, processing the prediction request with the AI engine to form a prediction response, and sending the prediction response to the client computer.

Abstract: Methods and systems are described herein for updating cybersecurity enforcement rules in real-time over disparate computer networks. A rule enforcement system may receive a real-time data stream. The real-time data stream may include real-time communications requiring cybersecurity verification. Real-time data communications are processed through a first rule repository. In response to determining that rule updates to rules within the first rule repository are available, a second rule repository is retrieved and brought online. Previously received real-time communication data is processed with the first rule repository and new real-time communication data is routed to the second rule repository. When previously received real-time communication data has been processed, the first rule repository is disabled.

Abstract: Pure machine learning classification approaches can result in a “black box” solution where it is impossible to understand why a classifier reached a decision. This disclosure describes generating new classification rules leveraging machine learning techniques. New rules may have to meet evaluation criteria. Legibility of those rules can be improved for understanding. A machine learning classifier can be created that is used to identify possible candidate classification rules (e.g. from a group of decision trees such as a random forest classifier). Classification rules generated with the assistance of machine learning may allow for identification of transaction fraud or other classifications that a human analyst would be unable to identify. A selection process can identify which possible candidate rules are effective. The legibility of those rules can then be improved so that they can be more easily understood by humans.

Abstract: An item recommendation control platform is disclosed. The item recommendation control platform presents an administrative user one or more user interfaces at which recommendation rules may be defined. Each of the recommendation rules may be associated with one or more nodes within a retail website, such as an item detail page or an item category page. The recommendation rules may be selected, defined, and prioritized, such that one or more item recommendation rules may be reflected within a given item recommendation presented on a retail website. The item recommendation rules can include one or more filters, the filters controlling which items may be recommended to a given user based, for example, on item availability or shipping availability.

Abstract: An interface is rendered on a user-operated device. Selections are made with respect to a first set of options by the user operating the interface. A list of potential food dishes for further selection by the user is presented within the interface based on the selections. A food dish selection is received from the user through the interface. A recipe for the selected food dish is generated and presented within the interface based on the food dish selection and a list of ingredients needed for the recipe are generated as a shopping list for the user to obtain at a store. In an embodiment, a navigation route to obtain the ingredients within the store is provided to the user when the user is at the store, allowing the user to traverse the route within the store and obtain each of the ingredients.

Abstract: Some embodiments determine automatically which synthesized or otherwise autocreated suggestions for source code editing are presented to developers. Some filter out autocreated coding suggestions that have not been sufficiently endorsed by a developer's team, based on a suggestion trust score. The trust score may reflect the suggestion's adoption in a particular repository or codebase, or affiliation of the suggestion with a library release, or an actual or implied review of the suggestion by team members. Some suggestion filters enhance existing development team code review practices, by offering endorsed suggestions in autocompletion or analysis interfaces of tools and by withholding non-endorsed suggestions from display. Context illustrating the autocreated suggestion's provenance may be displayed to help developers decide whether to adopt the suggestion themselves while editing code.

Abstract: System and methods are described which are useful for efficiently combining characteristic detection rules, such as may be done to efficiently and quickly assist in the dispositioning of user reported security threats.

Abstract: Methods, systems, and computer-readable media for read-only data store replication to edge locations are disclosed. A read-only data store is replicated to an edge server. A request for content is received at the edge server from a client device. The content is sought from a content cache at the edge server or from an origin server coupled to the edge server. Processing of the request is initiated, comprising encountering an event. The event is associated with a function specified by a customer, and the function specifies the read-only data store as input. The function associated with the event is executed at the edge server, including retrieval of data from the data store. The content is generated based at least in part on execution of the function. The content is sent from the edge server to the client device.

Abstract: Embodiments of the present disclosure provide a cloud-based integrated charting system that utilizes a universal mapping service across services and clients to provide insights for the provider into customizations made by clients. Additionally, the system provides content building tools that enable clients to customize content to update models provided by the provider. A mapping service maps model codes corresponding to model concepts to a plurality of standard based concept codes corresponding to client domain specific customized concepts for an ontology of the one or more ontologies. A workflow recommendation is provided that enables a user to chart data and includes the model concepts comprising charting elements. Accordingly, the data is stored in a client database in accordance with the client domain specific customized concepts. Since the model concepts are mapped to the client domain specific customized concepts, the workflow recommendation can be prepopulated with data from the client database.

Abstract: A method for processing a potentially fraudulent electronic payment transaction includes: receiving a first fraud detection rule configured to identify a potentially fraudulent electronic payment transaction; storing the first fraud detection rule in a fraud rules database; receiving a transaction request message; generating and storing a first case record associated with the first transaction in a case management database; receiving an updated fraud detection rule superseding the first fraud detection rule; applying the updated fraud detection rule to the first transaction to determine whether the first transaction does not satisfy the at least one updated fraud detection rule; and deleting the first case record from the case management database before the first transaction is further analyzed for fraud.

Abstract: A method includes determining, by an analysis system, a system aspect of a system for an issue detection evaluation. The method further includes determining, by the analysis system, at least one evaluation perspective for use in performing the issue detection evaluation on the system aspect. The method further includes determining, by the analysis system, at least one evaluation viewpoint for use in performing the issue detection evaluation on the system aspect. The method further includes obtaining, by the analysis system, issue detection data regarding the system aspect in accordance with the at least one evaluation perspective and the at least one evaluation viewpoint. The method further includes calculating, by the analysis system, an issue detection rating as a measure of system issue detection maturity for the system aspect based on the issue detection data, the at least one evaluation perspective, the at least one evaluation viewpoint, and at least one evaluation rating metric.

Abstract: A task management platform generates an interactive display tasks based on multi-team activity data of different geographic locations across a plurality of distributed guided user interfaces (GUIs). Additionally the task management platform uses a distributed machine-learning based system to determine a suggested task item for a remote team based on multi-team activity data of different geographic locations.

Abstract: In some examples, a system creates a requirement including EPG selectors representing EPG pairs, a traffic selector, and a communication operator; determines that EPGs in distinct pairs are associated with different network contexts and, for each pair, which network context(s) contains associated policies; creates first data representing the pair, operator, and traffic selector; when only one network context contains the associated policies, creates second data representing a network model portion associated with the only network context and determines whether the first data is contained in the second data to yield a first check; when both network contexts contain the associated policies, also creates third data representing a network model portion associated with a second network context, and determines whether the first data is contained in the second and/or third data to yield a second check; and determines whether policies for the pairs comply with the requirement based on the checks.

Abstract: Systems and methods are described for synergistically combining network security technologies to improve incident classification and enrichment. According to one embodiment, an endpoint protection platform running on an endpoint device receives a request via an event management agent of the endpoint protection platform from an event management service for process information relating to an incident detected by the event management service. The request is caused to be processed by an endpoint detection and response (EDR) service by transmitting the request to an EDR agent of the endpoint protection platform corresponding to the EDR service. A response to the request is received from the EDR service via the EDR agent. The response includes the process information. Enrichment of an alert generated by the event management service based on the process information is facilitated by transmitting the response to the event management service via the event management agent.

Abstract: From each of a plurality of cameras, a visual input of a location is received over a network. For each visual input from the plurality of cameras, a coupling correction is performed between a shaking of the camera with respect to the visual input by subtracting velocity vectors of the plurality of cameras from velocity vectors of pixels defining the visual input to provide a processed input. It is determined whether a shaking identified in the processed input is above a predetermined threshold based on the processed input, thereby detecting one or more anomalies. From the one or more anomalies, at least one of a location, magnitude, or depth of an earthquake are inferred based on the shaking identified in the processed input of each of the plurality of cameras.

Abstract: A system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive a data stream representing events; receive a plurality of complex event patterns (CEPs) comprising (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events; and calculate an optimal multi-pattern evaluation plan corresponding to said CEPs by: (i) generating an initial evaluation plan, (ii) applying a search method to calculate modified versions of said initial evaluation plan, (iii) assigning a score to each of said modified versions based on a cost function, and (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.

Abstract: Text input data may be aggregated and mapped to create composite text input data for electronic records. A semantic event may be automatically detected, triggered by a semantic rule and associated semantic tag. The detected semantic event may be flagged, and a text mining result database may be updated by adding an entry to the database. An indication associated with the event may be transmitted, and a back-end application computer server may establish a hierarchy for multiple elements of the electronic records. The computer server may determine a weight variable and response variable for each element in the hierarchy and apply a hierarchical credibility weighting methodology to the elements from level 1, representing the least granular level in the hierarchy, to level n, representing the most granular level in the hierarchy, calculated recursively from level n, to determine a final estimated credibility for the electronic records.

Abstract: In some implementations, a method includes obtaining an end state of a first content item spanning a first time duration. In some implementations, the end state of the first content item indicates a first state of a synthesized reality (SR) agent at the end of the first time duration. In some implementations, the method includes obtaining an initial state of a second content item spanning a second time duration subsequent the first time duration. In some implementations, the initial state of the second content item indicates a second state of the SR agent at the beginning of the second time duration. In some implementations, the method includes synthesizing an intermediary emergent content item spanning over an intermediary time duration that is between the end of the first time duration and the beginning of the second time duration.

Abstract: This invention predicts results for a media clip posted to a social media influencer channel by maintaining a database of results data for media clips where an influencer channel includes media clips that include unstructured data, and structured data, and then provide to a first machine learning model a first set of channel data, extracting a first set of features, predicting a value for the first target variable, providing to a second machine learning model a second set of channel data including a second selection of structured data, and the predicted value of the first target variable, extracting a second set of features, and predicting a value for the second target variable.

Abstract: An integrated hospital logistics management system and an integrated hospital logistics management method using same is provided. Artificial intelligence analyzes trends and seasonal trends by using big data and predicts actual usage by using an artificial intelligence technology, and an artificial intelligence system automatically processes reorders, replacements, etc., thereby ensuring that an appropriate safety stock level can be maintained at all times according to a stock quantity, stock state, issue quantity, etc. of hospital supplies. The integrated hospital logistics management system includes an order processing module which processes ordering and warehousing of supplies; a logistics management module which requests the order processing module to purchase or replace the supplies according to the states of the supplies; and a system control module including a machine learning unit which generates and learns rules about the operation of the supplies by using metadata.

Abstract: Certain aspects of the present disclose provide techniques for generating a knowledge engine module collection. Techniques for generating the module collection include receiving input data comprising a first identifier, a second identifier, and a third set of fields. Based on the input data, a UI builder tool can retrieve a first set of artifact files and a second set of artifact files corresponding to a first module and a second module. The UI builder tool can generate a third set of artifact files based on the first set of artifact files, the second set of artifact files, and the input data.

Abstract: An intention detection mechanism detects a target user accessing an operational context and accesses sensor data collected by a plurality of sensors encoding signals describing one or more characteristics of the target user and surroundings of the target user. The intention detection mechanism converts the accessed sensor data into a multi-channel sensor data time series, where each channel represents a characteristic of the target user. The intention detection mechanism compares the sensor data time series to a multi-channel intentionality template to determine whether the sensor data time series contains the multi-channel intentionality template. The multi-channel intentionality template describes characteristics indicative of an intent of a target user accessing the operational context. If the sensor data time series contains the multi-channel intentionality template, the intention detection mechanism communicates a signal confirming that the target user intended to access to the operational context.

Abstract: A vehicle and a system and a method of operating the vehicle. The system includes a reasoning engine, an episodic memory, a resolver and a controller. The reasoning engine infers a plurality of possible scenarios based on a current state of an environment of the vehicle. The episodic memory determines a historical likelihood for each of the plurality of possible scenarios. The resolver selects a scenario from the plurality of possible scenarios using the historical likelihoods. The controller operates the vehicle based on the selected scenario.

Abstract: A security threat detection system is used to monitor the physical resource usage of a hosted application in a PaaS service in order to detect anomalous behavior indicative of a security threat. The system analyzes the historical usage of the application's physical resources in order to determine the normal range of consumption of a resource by the application. A security threat alert is then provided when the application's resource consumption exceeds the normal range of consumption.

Abstract: Methods, computer systems, computer-storage media, and graphical user interfaces are provided for facilitating data transformations, according to embodiments of the present invention. In one embodiment, a set of example values including example input values that indicate data values to be transformed and example output values that indicate a desired form in which to transform data. Based on the set of example values, a data transformation function that is relevant to the set of example values is identified. The data transformation function is used to generate a transformation program to transform the example input values to the desired form in which to transform data. A suggestion of the transformation program can be provided to a user device, wherein selection of the transformation program suggestion results in a data transformation.

Abstract: Example aspects of the present disclosure relate to an example computer-implemented method for predicting the intent of actors within an environment. The example method includes obtaining state data associated with a plurality of actors within the environment and map data indicating a plurality of lanes of the environment. The method include determining a plurality of potential goals each actor based on the state data and the map data. The method includes processing the state data, the map data, and the plurality of potential goals with a machine-learned forecasting model to determine (i) a forecasted goal for a respective actor of the plurality of actors, (ii) a forecasted interaction between the respective actor and a different actor of the plurality of actors based on the forecasted goal, and (iii) a continuous trajectory for the respective actor based on the forecasted goal.

Abstract: An orchestration system may receive, from a subscriber management system, a request indicating a subscriber intent for a connectivity service or a cloud service. The orchestration system may identify, based on subscriber information associated with the request, a managed service. The orchestration system may automatically discover subscriber network devices configured to access the managed service and configure network connectivity of the subscriber network devices. The orchestration system may allocate infrastructure and network resources for the managed service. The orchestration system may configure, based on the resources, infrastructure hardware components, software components, and applications of the managed service. The orchestration system may configure managed service components associated with the managed service. The orchestration system may connect the infrastructure hardware components, the software components, the applications, and the managed service components to service assurance systems.

Abstract: An automatic coordination apparatus 30 includes: a scenario creation unit 100 that creates a scenario; a scenario coordination unit 200 that coordinates a plurality of the scenarios; and a scenario management and execution unit 32 that manages and executes the scenario, wherein a failure handling business operation is broken down into common and individual tasks, a parent scenario or a child scenario is defined for each of the separated tasks or each task group made by combining a plurality of tasks, the scenario is divided, management across a plurality of the scenarios is performed based on a relationship between each scenario and a status of execution of each scenario, and the scenario is discontinued or changed depending on a process and a content of failure handling.

Abstract: Method and server apparatus for providing and using a centralized Link Metadata System to identify if navigational links are pop-out links, is provided. The present invention utilizes a Link Metadata System, available on the Internet, of metadata associated with any given, specific Internet domain and URI path combination. Software browsing user agents on remote window servers are then configured with the ability to request metadata from the Link Metadata System indicating that a link is a pop-out link. Upon receiving metadata, the user agent determines whether to perform navigation as normal or perform the pop-out link functionality of reloading the remote client user agent's top level container with the content provided at the link's destination URI.

Abstract: A building system including one or more storage devices storing instructions thereon that, when executed by one or more processors, cause the one or more processors to store a data structure of a digital twin of an entity of a building, the data structure storing information associated with at least one of the entity or entities of the building and determine that a trigger rule of the digital twin is triggered by comparing at least some of the information of the data structure against one or more conditions of the trigger rule. The instructions cause the one or more processors to determine an action of an action rule of the digital twin responsive to determining that the trigger rule is triggered by executing the action rule and cause one or more devices to operate based on the action determined by the action rule.

Abstract: A support service application may process a request that contains a hyperlink. The hyperlink may be examined to determine a level of risk associated with accessing a resource referred to by the hyperlink. An execution environment for processing the hyperlink may be identified. The execution environment may comprise a virtual machine drawn from a pool of virtual machines. The resource may be retrieved by a browser process operating within the context of the virtual machine, and a safe version of the resource may be rendered and made available to customer support personnel using the support service application.

Abstract: An artificial intelligence (“AI”) engine is disclosed with AI-engine modules and a plurality of learning agents. The AI-engine modules include instructor, learner, and predictor modules. The learner module is configured to train a plurality of AI models in parallel, and the instructor module is configured to coordinate with a plurality of simulators for respectively training the AI models. The learning agents are configured to process training requests from the instructor on data from the simulators for training the AI models. The learner module is further configured to first train the AI models on a first batch of similar data synchronously pooled in a memory of the learner module with a first processor. The learner module is further configured to subsequently train the AI models on a second, different batch of similar data synchronously pooled in the memory of the learner module with the first processor.

Abstract: Systems and methods of the present disclosure provide processes for determining how much to adjust machine-learning parameter values in a direction of a gradient for gradient-descent steps in training processes for machine-learning models. Current parameter values of a machine-learning model are vector components that define an initial estimate for a local extremum of a cost function used to measure how well the machine-learning model performs. The initial estimate and the gradient of the cost function for the initial estimate are used to define an auxiliary function. A root estimate is determined for the auxiliary function of the gradient. The parameters are adjusted in the direction of the gradient by an amount specified by the root estimate.

Abstract: A knowledge-based system under uncertainties and/or incompleteness, referred to as augmented knowledge base (AKB) is provided, including constructing, reasoning, analyzing and applying AKBs by creating objects in the form E?A, where A is a rule in a knowledgebase and E is a set of evidences that supports the rule A. A reasoning scheme under uncertainties and/or incompleteness is provided as augmented reasoning (AR).

Abstract: This disclosure describes methods and systems for protecting machine learning models against privacy attacks. A machine learning model may be trained using a set of training data and causal relationship data. The causal relationship data may describe a subset of features in the training data that have a causal relationship with the outcome. The machine learning model may learn a function that predicts an outcome based on the training data and the causal relationship data. A predefined privacy guarantee value may be received. An amount of noise may be added to the machine learning model to make a privacy guarantee value of the machine learning model equivalent to or stronger than the predefined privacy guarantee value. The amount of noise may be added at a parameter level of the machine learning model.

Abstract: Computerized systems and methods for managing API information. An exemplary method includes receiving an input from a user device associated with a first computer system, the input not including identity of a second computer system. The method includes determining a target API based on the input, the target API being the second computer system's API. The method also includes determining whether a user of the user device has access to the target API. The method includes retrieving documentation of the target API from an API database if it is determined that the user has access to the target API. The method includes providing the user device with the retrieved documentation.

Abstract: Some embodiments provide a program that receives a request to sectionize a document, uses a visual model to identify a set of candidate section headers in the document, and uses a language model to determine a type of section header for at least one candidate section header in the set of candidate section headers in the document. Some embodiments provide a program that receives a request to anonymize data in a document, uses a visual model to identify a set of candidate confidential sections in the document that are each predicted to include a collection of confidential data, uses a language model to identify terms in each candidate confidential section that are determined to be confidential data, analyzes the document to identify a set of terms in the document based on the identified terms in the set of candidate confidential sections, and redacts the set of terms in the document.

Abstract: A method and associated systems for a database-management system with artificially intelligent database administration. The DBMS manages one or more databases, each of which is monitored by sensors that detect conditions indicative of database performance. An operational engine receives input from the sensors, translates it into a form understandable by an artificially intelligent decision engine, and forwards the translated input to the decision engine. The decision engine uses preloaded knowledge elements stored in a knowledgebase to infer whether the sensor input identifies an issue that can only be resolved by a database-administration activity. If so, the decision engine attempts to select a best solution, optionally seeks confirmation of its selection from an outside source, and directs the operational engine to implement the selected solution.

Abstract: A model checking system detects violations and conflicts in security and verification policies by running model checking processes. The system detects privilege escalation attacks in misconfigured identification and access management (“IAM”) policies by modeling security policy documents and IAM actions as logical formulas and then running model checking on the model. The system translates non-Boolean variables, such as string variables, into Boolean variables in order to apply an SAT model checker. The model checker also determines whether a policy violation can be achieved in a finite number of steps by elevating privileges of some compromised principal over multiple iterations of the model checking process, or proves absence thereof.

Abstract: Described is a system for detecting and correcting perception errors in a perception system. In operation, the system generates a list of detected objects from perception data of a scene, which allows for the generation of a list of background classes from backgrounds in the perception data associated with the list of detected objects. For each detected object in the list of detected objects, a closest background class is identified from the list of background classes. Vectors can then be used to determine a semantic feature, which is used to identify axioms. An optimal perception parameter is then generated, which is used to adjust perception parameters in the perception system to minimize perception errors.

Abstract: A graph data structure for an artificial intelligence knowledge base includes a plurality of user-centric facts associated with a user. Each user-centric fact has an application-agnostic data format and includes a subject graph node, an object graph node, and an edge connecting the subject graph node to the object graph node. The graph data structure is designed to accommodate facts from different application-specific data providers using the same application-agnostic data format even when the different application-specific data providers use different native data formats.

Abstract: The disclosed systems and methods track and continuously monitor data about a player or a multiple players and create a non-playing character (NPC) and/or modify an existing NPC that replicates the player(s) play style. The disclosed systems implement an artificial intelligence engine that monitors how a real player responds to one or more events in a game and correlates game outcomes with real player actions, with the actions or reactions of third players, and/or with an amount or extent of engagement. The engine may be used to generate, host, or otherwise provide data representative of one or more NPCs to multiple different games, being hosted by one or more servers, concurrently.

Abstract: A system and method allowing machine analytics and multiple human analysts to work together in a collaborative fashion in the analysis of large amounts of data. The collaborative analysis promotes “sensemaking.” Sensemaking is the continued revising and expansion of a developing “story” so that it becomes more comprehensible. As the emerging story is refined, it should successfully incorporate more and more of the observed data and be more defensible with respect to contrary arguments.

Abstract: A task management platform generates an interactive display tasks based on multi-team activity data of different geographic locations across a plurality of distributed guided user interfaces (GUIs). Additionally the task management platform uses a distributed machine-learning based system to determine a suggested task item for a remote team based on multi-team activity data of different geographic locations.

Abstract: Examples of the present disclosure describe systems and methods for behavioral threat detection definition. In an example, a behavior rule comprising a set of rule instructions is used to define one or more events indicative of a behavior. For example, a set of events from which one event must be matched may be defined or a set of events from which all events must be matched may be defined. In some examples, events are matched based on an event name or type, or may be matched based on one or more parameters. Exact and/or inexact matching may be used. The set of rule instructions ultimately specifies one or more halt instructions, thereby indicating that a determination as to the presence of the behavior has been made. Example determinations include, but are not limited to, a match determination, a non-match determination, or an indication that additional monitoring should be performed.

Abstract: In one embodiment, a method includes receiving a user request from a client device associated with a user, accessing an instructional file comprising one or more binary inference engines and one or more encrypted model data corresponding to the one or more binary inference engines, respectively, selecting a binary inference engine from the one or more binary inference engines in the accessed instructional file based on the user request, sending a validation request for a permission to execute the binary inference engine to a licensing server, receiving the permission from the licensing server, decrypting the encrypted model data corresponding to the binary inference engine by a decryption key, executing the binary inference engine based on the user request and the decrypted model data, and sending one or more execution results responsive to the execution of the binary inference engine to the client device.

Abstract: A question inference device comprises: an input unit inputting an inquiry from a user; a storage unit storing a plurality of questions prepared in advance and one or more keywords for identifying each question in association with each other; a choice unit referring to the storage unit and choosing a question associated with a keyword contained in the inquiry inputted by the input unit from among the plurality of questions; a computation unit computing the likelihood of each of the plurality of questions for the inquiry inputted by the input unit; an inference unit inferring, based on a choice result of the choice unit and a computation result of the computation unit, such a question that the user intends the substance of the question from among the plurality of questions; and an output unit outputting information based on an inference result of the inference unit.

Abstract: The present invention is a method and system for automatically producing a learning plan. Upon receiving at least one type of data input, the system analyzes the data input and produces a learning plan based on the results of the analysis of the data input. This process may be used to either generate or update a learning plan, and may be repeated to update an existing learning plan.

Abstract: A testing platform for an auto-decision engine is disclosed. An auto-test database for a decision engine may be accessed and modified by, for example, executing an application programming interface protocol of a third-party computing system. The decision engine may be bypassed, and a simulated auto-decision may be requested based on a unique key corresponding to a scenario in the auto-test database. A graphical user interface displays information regarding the auto-test database on a user computing device, and one or more output data fields in the auto-test database may be modified.

Abstract: A method is disclosed. A server computer may receive, from a client computer, a first rule comprising one or more variables, the first rule configured to predict that an event is either a first classification or a second classification. The server computer applies the first rule to an initial data set of events to identify events that are associated with the first classification. The server computer evaluates performance of the first rule. The server computer provides data relating to the performance of the first rule to the client computer. The client computer automatically evaluates the performance of the first rule and generates a second rule in response to the data relating to the performance of the first rule. The server computer may then evaluate the second rule and provide performance data to the client computer. The server computer may use equi-height histograms to evaluate the performance of the rules.