公开(公告)号：US20250110961A1

公开(公告)日：2025-04-03

申请号：US18374209

申请日：2023-09-28

Applicant: Oracle International Corporation

Inventor： Tomas Feith ,  Arno Schneuwly ,  Saeid Allahdadian ,  Matteo Casserini ,  Kristopher Leland Rice ,  Felix Schmidt

IPC: G06F16/2457 ,  G06F16/248

Abstract: Here is dynamic and contextual ranking of reference documentation based on an interactively selected position in new source logic. A computer receives a vocabulary of lexical tokens, a sequence of references that contains a first reference to a first reference document before a second reference to a second reference document, respective subsets of the vocabulary that occur in the first and second reference documents, a new source logic that contains a sequence of lexical tokens, respective measurements of semantic distance between the new source logic and the first and second reference documents, and a selected position in the sequence of lexical tokens. Based on the selected position, the measurements of semantic distance are selectively increased. Based on that increasing the measurements of the semantic distance, a relative ordering of the first and second references is reversed to generate and display a reordered sequence of references.

公开(公告)号：US20250077519A1

公开(公告)日：2025-03-06

申请号：US18955689

申请日：2024-11-21

Applicant: Oracle International Corporation

Inventor： Felix Schmidt ,  Matteo Casserini ,  Milos Vasic ,  Marija Nikolic

IPC: G06F16/2453 ,  G06F16/2458

Abstract: A method and one or more non-transitory storage media are provided to train and implement a one-hot encoder. During a training phase, computation of an encoder state is performed by executing a set of relational statements to extract unique categories in a first training data set, associate each unique category with a unique index, and generate a one-hot encoding for each unique category. The set of relational statements are executed by a query optimization engine. Execution of the set of relational statements is postponed until a result of each relational statement is needed, and the query optimization engine implements one or more optimizations when executing the set of relational statements. During an encoding phase, a set of categorical features in a second training data set are encoded based on the encoder state to form a set of encoded categorical features.

公开(公告)号：US20240037383A1

公开(公告)日：2024-02-01

申请号：US17873482

申请日：2022-07-26

Applicant: Oracle International Corporation

Inventor： Kenyu Kobayashi ,  Arno Schneuwly ,  Renata Khasanova ,  Matteo Casserini ,  Felix Schmidt

IPC: G06N3/08

CPC classification number: G06N3/08

Abstract: Herein are machine learning (ML) explainability (MLX) techniques for calculating and using a novel fidelity metric for assessing and comparing explainers that are based on feature attribution. In an embodiment, a computer generates many anomalous tuples from many non-anomalous tuples. Each anomalous tuple contains a perturbed value of a respective perturbed feature. For each anomalous tuple, a respective explanation is generated that identifies a respective identified feature as a cause of the anomalous tuple being anomalous. A fidelity metric is calculated by counting correct explanations for the anomalous tuples whose identified feature is the perturbed feature. Tuples may represent entries in an activity log such as structured query language (SQL) statements in a console output log of a database server. This approach herein may gauge the quality of a set of MLX explanations for why log entries or network packets are characterized as anomalous by an intrusion detector or other anomaly detector.

公开(公告)号：US11784964B2

公开(公告)日：2023-10-10

申请号：US17197375

申请日：2021-03-10

Applicant: Oracle International Corporation

Inventor： Renata Khasanova ,  Felix Schmidt ,  Stuart Wray ,  Craig Schelp ,  Nipun Agarwal ,  Matteo Casserini

IPC: H04L61/4511 ,  G06N20/00 ,  H04L41/16 ,  G06F40/30

CPC classification number: H04L61/4511 ,  G06N20/00 ,  H04L41/16 ,  G06F40/30

Abstract: Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.

公开(公告)号：US12182122B2

公开(公告)日：2024-12-31

申请号：US17964084

申请日：2022-10-12

Applicant: Oracle International Corporation

Inventor： Felix Schmidt ,  Matteo Casserini ,  Milos Vasic ,  Marija Nikolic

IPC: G06F16/00 ,  G06F16/2453 ,  G06F16/2458

Abstract: A method and one or more non-transitory storage media are provided to train and implement a one-hot encoder. During a training phase, computation of an encoder state is performed by executing a set of relational statements to extract unique categories in a first training data set, associate each unique category with a unique index, and generate a one-hot encoding for each unique category. The set of relational statements are executed by a query optimization engine. Execution of the set of relational statements is postponed until a result of each relational statement is needed, and the query optimization engine implements one or more optimizations when executing the set of relational statements. During an encoding phase, a set of categorical features in a second training data set are encoded based on the encoder state to form a set of encoded categorical features.

公开(公告)号：US20240345811A1

公开(公告)日：2024-10-17

申请号：US18202756

申请日：2023-05-26

Applicant: Oracle International Corporation

Inventor： Arno Schneuwly ,  Saeid Allahdadian ,  Pritam Dash ,  Matteo Casserini ,  Felix Schmidt ,  Eric Sedlar

IPC: G06F8/36 ,  G06F16/955 ,  G06F40/40

CPC classification number: G06F8/36 ,  G06F16/955 ,  G06F40/40

Abstract: Herein for each source logic in a corpus, a computer stores an identifier of the source logic and operates a logic encoder that infers a distinct fixed-size encoded logic that represents the variable-size source logic. At build time, a multidimensional index is generated and populated based on the encoded logics that represent the source logics in the corpus. At runtime, a user may edit and select a new source logic such as in a text editor or an integrated development environment (IDE). The logic encoder infers a new encoded logic that represents the new source logic. The multidimensional index accepts the new encoded logic as a lookup key and automatically selects and returns a result subset of encoded logics that represent similar source logics in the corpus. For display, the multidimensional index may select and return only encoded logics that are the few nearest neighbors to the new encoded logic.

公开(公告)号：US20230421528A1

公开(公告)日：2023-12-28

申请号：US18237853

申请日：2023-08-24

Applicant: Oracle International Corporation

Inventor： Renata Khasanova ,  Felix Schmidt ,  Stuart Wray ,  Craig Schelp ,  Nipun Agarwal ,  Matteo Casserini

IPC: H04L61/4511 ,  G06N20/00 ,  H04L41/16

CPC classification number: H04L61/4511 ,  G06F40/30 ,  H04L41/16 ,  G06N20/00

Abstract: Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.

公开(公告)号：US20230419169A1

公开(公告)日：2023-12-28

申请号：US17851120

申请日：2022-06-28

Applicant: Oracle International Corporation

Inventor： Kenyu Kobayashi ,  Arno Schneuwly ,  Renata Khasanova ,  Matteo Casserini ,  Felix Schmidt

IPC: G06N20/00

CPC classification number: G06N20/00

Abstract: Herein are machine learning (ML) explainability (MLX) techniques that perturb a non-anomalous tuple to generate an anomalous tuple as adversarial input to any explainer that is based on feature attribution. In an embodiment, a computer generates, from a non-anomalous tuple, an anomalous tuple that contains a perturbed value of a perturbed feature. In the anomalous tuple, the perturbed value of the perturbed feature is modified to cause a change in reconstruction error for the anomalous tuple. The change in reconstruction error includes a decrease in reconstruction error of the perturbed feature and/or an increase in a sum of reconstruction error of all features that are not the perturbed feature. After modifying the perturbed value, an attribution-based explainer automatically generates an explanation that identifies an identified feature as a cause of the anomalous tuple being anomalous. Whether the identified feature of the explanation is or is not the perturbed feature is detected.

公开(公告)号：US20230368054A1

公开(公告)日：2023-11-16

申请号：US17745103

申请日：2022-05-16

Applicant: Oracle International Corporation

Inventor： Marija Nikolic ,  Matteo Casserini ,  Arno Schneuwly ,  Nikola Milojkovic ,  Milos Vasic ,  Renata Khasanova ,  Felix Schmidt

IPC: G06N7/00 ,  G06N20/00

CPC classification number: G06N7/005 ,  G06N20/00

Abstract: The present invention relates to threshold estimation and calibration for anomaly detection. Herein are machine learning (ML) and extreme value theory (EVT) techniques for normalizing and thresholding anomaly scores without presuming a values distribution. In an embodiment, a computer receives many unnormalized anomaly scores and, according to peak over threshold (POT), selects a highest subset of the unnormalized anomaly scores that exceed a tail threshold. Based on the highest subset of the unnormalized anomaly scores, parameters of a probability density function are trained according to EVT. After training and in a production environment, a normalized anomaly score is generated based on an unnormalized anomaly score and the trained parameters of the probability density function. Anomaly detection compares the normalized anomaly score to an optimized anomaly threshold.

公开(公告)号：US20220294757A1

公开(公告)日：2022-09-15

申请号：US17197375

申请日：2021-03-10

Applicant: Oracle International Corporation

Inventor： Renata Khasanova ,  Felix Schmidt ,  Stuart Wray ,  Craig Schelp ,  Nipun Agarwal ,  Matteo Casserini

IPC: H04L29/12 ,  H04L12/24 ,  G06N20/00

Abstract: Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.