Method and system for graph computation using hybrid reasoning

Abstract

Embodiments for graph computation are provided. A graph is generated including a plurality of explicit nodes and at least one implicit node. With deductive reasoning, a traversal is made between a first explicit node of the plurality of explicit nodes and a second explicit node of the plurality of explicit nodes. With inductive reasoning, a traversal is made between a third explicit node of the plurality of explicit nodes and a fourth explicit node of the plurality of explicit nodes via the at least one implicit node.

Description

Invention Field

[0001] The present invention relates generally to computing systems, and more specifically to different embodiments of graph computing using hybrid reasoning. Background Technology

[0002] In recent years, various forms of artificial intelligence (AI) (and / or machine learning, cognitive analytics, etc.) have been implemented in a growing range of applications, such as object detection, speech recognition, and language processing. This trend is most likely to continue, as the benefits of such systems appear to be limitless.

[0003] However, one problem with at least some AI systems is the lack of "interpretability" of the outputs they generate (such as responses to queries, predictions, etc.). That is, some AI systems are considered "black boxes." More precisely, while current AI systems have proven extremely useful in some applications (e.g., high predictive accuracy), individuals (e.g., software engineers) often find it difficult, if not impossible, to precisely understand why an AI system generates the outputs it makes and / or to explain to other individuals the reasoning the system utilizes. This is at least the case when certain AI systems (e.g., deep learning or neural networks) are used for specific applications.

[0004] While this may be insignificant when AI is used for relatively trivial applications (e.g., image processing, transcription, etc.), it is at least undeniably the case when it is used for important or critical applications or scenarios (e.g., security / military operations, medical decision-making, investment advice, vehicle control, etc.). Summary of the Invention

[0005] According to an illustrative embodiment, a method for graph computation performed by a processor is provided. The method includes: generating a graph comprising a plurality of explicit nodes and at least one implicit node; traversing between a first explicit node and a second explicit node among the plurality of explicit nodes using deductive reasoning; and traversing between a third explicit node and a fourth explicit node among the plurality of explicit nodes through the at least one implicit node using inductive reasoning. According to other illustrative embodiments, a corresponding system and computer program product are provided. Attached Figure Description

[0006] To make the advantages of the invention readily apparent, a more specific description of the invention described above will be presented by reference to specific embodiments shown in the accompanying drawings. It should be understood that these drawings depict only exemplary embodiments of the invention and are therefore not intended to limit its scope. The invention will be described and explained with additional features and details using the drawings, in which:

[0007] Figure 1 This is a block diagram depicting an exemplary computing node according to an embodiment of the present invention;

[0008] Figure 2 This is an additional block diagram depicting an exemplary cloud computing environment according to an embodiment of the present invention;

[0009] Figure 3 This is an additional block diagram depicting the abstract model layer according to an embodiment of the present invention;

[0010] Figures 4 to 8 This is a schematic diagram of a graph database according to an embodiment of the present invention;

[0011] Figure 9 This is a schematic diagram of a graph database with multiple implicit nodes according to an embodiment of the present invention;

[0012] Figure 10 This is a block diagram of a method for graph computation according to an embodiment of the present invention;

[0013] Figure 11 It is a plan view of a series of reasoning steps input by a user according to an embodiment of the present invention; and

[0014] Figure 12 This is a flowchart of an exemplary method for graph computation according to an embodiment of the present invention. Detailed Implementation

[0015] As discussed above, in recent years, various forms of artificial intelligence (AI) (and / or machine learning, cognitive analytics, etc.) have been implemented in a growing number of applications, such as object detection, speech recognition, and language processing. This trend is most likely to continue, as the benefits of such systems appear to be limitless.

[0016] However, one problem with at least some AI systems is the lack of "interpretability" of the outputs they generate, such as responses to queries, predictions, etc. That is, some AI systems are considered "black boxes." More precisely, while current AI systems have proven to be very useful in some applications (e.g., high predictive accuracy), it is often difficult (if not impossible) for individuals (e.g., software engineers) to precisely understand why an AI system generates the outputs it makes and / or to explain to others the reasoning that the system utilizes.

[0017] At least, this is the case when certain AI systems are used for specific applications. More specifically, as some examples, deep learning and neural networks are generally considered to offer relatively high predictive accuracy, but are also considered to offer the least amount of interpretability relative to the generated output. Ensemble methods such as random forests and support vector machines (SVMs) are generally considered to offer slightly improved interpretability, but at the cost of reduced accuracy. Utilizing graphical models (e.g., Bayesian networks), decision trees, and classification rules further improves interpretability to some extent, but with even lower accuracy.

[0018] As a concrete example, consider using a decision tree to predict whether a specific webpage related to a published article is a "normal" webpage (i.e., including the entire article) or a "summary" page (i.e., including only excerpts, summaries, briefs, etc.). In such a scenario, an AI system utilizing a decision tree could take into account the length (or character count) of the webpage's URL when making this prediction (e.g., the longer the URL, the more likely the webpage includes the entire article). While using such a metric can offer some improvement in interpretability compared to similar outputs generated by neural networks, the use of this metric itself may not be easily understood by users (e.g., individuals, humans, etc.). That is, users may not understand how and / or why the URL length is relevant to the content on the webpage.

[0019] While the question of interpretability may not be important when AI is used for relatively trivial applications (e.g., image processing, transcription, etc.), it is certainly not a contestable situation for important or critical applications or scenarios (e.g., security / military operations, medical decision-making, investment advice, vehicle control, etc.).

[0020] In contrast to AI systems, inference engines (or semantic inferencers, rule engines, etc.) can be utilized in a way that provides relatively explicit or clear explanations. However, inference engines typically do not have the same capabilities as modern AI systems, particularly regarding learning and / or training based on provided samples.

[0021] As an example of an application of reasoning, consider a scenario where reasoning (or a reasoning engine) is used to determine whether a particular web domain is “malicious” (i.e., includes any kind of malicious software or “malicious software”) and / or to identify the actors behind that domain. As an initial step, any Internet Protocol (IP) addresses associated with the domain can be identified. Then, any software hashes (or software components) communicating with any of those IP addresses can be identified. Then, different data sources (such as antivirus engine detection, storage, databases, etc.) can be searched to determine whether any hashes (and / or associated software components) have been listed and / or classified as malicious software (and / or whether the actors behind them have been listed). However, conventional reasoning (or conventional reasoning engines) is typically only capable of reasoning (or deductive reasoning) based on “known” facts. As those skilled in the art will recognize, the derived independent variables (or reasoning) are those that the conclusion follows or appears to follow, necessarily and / or include those that begin with a general principle and apply that general principle to a particular situation. For example, given the evidence that “all teachers are interesting” and “Karen is a teacher,” it must be followed that Karen is interesting.

[0022] Accordingly, when used in such a scenario, a conventional inference engine can only identify a domain as associated with malware and / or a specific actor if another entity (e.g., government agency, antivirus engine, etc.) has previously made such a determination, and as mentioned above, inference engines do not have the learning and / or training capabilities of many AI systems.

[0023] To address these needs and / or shortcomings in the prior art, some embodiments described herein disclose methods and / or systems for providing (and / or utilizing) an inference engine that combines at least some of the benefits of modern AI (or machine learning (ML), cognitive analytics, etc.) systems, such as learning and / or training based on provided samples (e.g., training data) to generate predictions, while also providing improved interpretability. Specifically, in some embodiments, methods and / or systems for graph computation are provided that utilize inductive reasoning (or probability-based reasoning or probability-based inductive reasoning) that may combine deductive reasoning. In particular, in some embodiments, the methods and systems described herein can be considered as utilizing graph knowledge (or graph computation) protected or enhanced by mathematical functions of discriminative power to provide inductive reasoning.

[0024] For example, regarding the cybersecurity scenarios described above, the methods and systems described herein can utilize inference engines similar to those described above. However, in at least some embodiments, the inference is enhanced, enabling the engine to generate predictions and / or perform inductive reasoning. Accordingly, as an example, whether a particular piece of software (or hash) has been flagged or marked as suspicious or questionable by one or more antivirus engines (as opposed to being explicitly listed as malware by an organization) can be used by the system to generate predictions about whether the software is malware (and / or predictions of the actors in the control domain, etc.). More specifically, in some embodiments, induced (or non-inductive) reasoning can be used to arrive at specific conclusions (or predictions, determinations, etc.) even without any known facts. As those skilled in the art will understand, inductive arguments (or reasoning) are those that conclude that a conclusion “may” or appears to follow and / or include those that begin with one or more specific (or particular) cases and attempt to generate a general principle based on one or more specific cases. For example, given the evidence that “90% of teachers are interesting” and “Karen is a teacher,” then (possibly) Karen is interesting (or more specifically, there is a 90% probability that Karen is interesting).

[0025] More specifically, continuing with the cybersecurity scenario, if a particular hash is identified but not formally documented as being associated with a malware family, the system can search multiple antivirus engine databases to identify any information or detections related to that hash. Depending on the identified information (e.g., flagging the hash / software as suspicious by multiple antivirus engines), the system may be able to generate a prediction as to whether the software is malware. In some embodiments, inductive reasoning can be “stacked,” allowing multiple inductions to be performed, as discussed in more detail below.

[0026] It should be understood that although some of the embodiments provided herein are described with reference to cybersecurity scenarios, the methods and / or systems described herein can be applied to any scenario where inference engines and / or machine learning technologies (or AI, cognitive analytics, etc.) can be utilized.

[0027] In some embodiments, as is generally understood in the art, the reasoning described herein is performed using graph computation (or traversal of a graph database). According to at least some aspects of the functionality described herein, traversal between nodes (of the graph) is performed using hybrid reasoning, which includes inductive reasoning combined with deductive reasoning in some embodiments. In some embodiments, a graph can be understood as comprising two types of nodes: explicit (or first type) nodes and implicit or “via” (or second type) nodes. Deductive reasoning can be used to perform traversal between explicit nodes. However, when deductive reasoning cannot allow traversal between two explicit nodes, inductive reasoning can be used, which can be considered to include traversing one or more implicit nodes “indirectly” between two explicit nodes. In some embodiments, inductive reasoning includes and / or utilizes probability-based inductive reasoning.

[0028] It should be understood that cognitive analytics can be used to perform at least some aspects of the functionality described herein. Cognitive analytics may include natural language processing (NLP) or NLP techniques, such as classifying natural language, analyzing tone, and analyzing sentiment regarding content and communications, for example, sent to or received by users or entities and / or other available data sources (e.g., scanning for keywords, keyword phrases, etc.). In some embodiments, as generally understood, natural language processing (NLP), Mel-frequency cepstral coefficients (MFCC) (e.g., for audio content), and / or region-based convolutional neural network (R-CNN) pixel mapping (e.g., for object detection / classification in images / videos) are used.

[0029] The processes described herein may utilize various information or data sources and / or communications associated with users and / or entities (e.g., the subject of a query, a data source, etc.). Data sources may include any available source of information (or data) associated with users and / or entities. For example, in some embodiments, a profile (e.g., a cognitive profile) of the user (and / or entity) may be generated. Data sources that can be used to generate a cognitive profile may include any suitable data source that is system-accessible and associated with the user / entity (possibly with the user / entity's permission or authorization). Examples of such data sources include, but are not limited to, communication sessions and / or their content (or communications) (e.g., phone calls, video calls, text messaging, emails, personal / face-to-face conversations, etc.), user / entity profiles (or basic information about users / entities) (e.g., job title, work location, length of time at current location, family role, etc.), schedules or calendars (i.e., items listed thereon, time ranges, etc.), projects (e.g., projects related to past, present, or future work), locations (e.g., previous and / or current locations and / or locations relative to other users), social media activity (e.g., posts, reactions, comments, groups, etc.), browsing history (e.g., web pages visited), and online purchases.

[0030] Therefore, in some embodiments, as commonly understood by those skilled in the art, the methods and / or systems described herein may utilize “cognitive analytics,” “cognitive systems,” “machine learning,” “cognitive modeling,” “predictive analytics,” and / or “data analytics.” Typically, these processes may include, for example, receiving and / or retrieving multiple sets of inputs and associated outputs of one or more systems, and processing the data (e.g., using a computing system and / or processor) to generate or extract models, rules, etc., corresponding to, governing, and / or estimating the operation of the system, or relating to the implementations described herein, of the graph computing described herein. Using said models, the performance (or operation) of the system (e.g., utilizing / based on new inputs) can be predicted, and / or the performance of the system can be optimized by investigating how changes in the inputs affect the outputs. Feedback received from (or provided by) users and / or administrators may also be utilized, which can allow the performance of the system to be further improved with continued use.

[0031] It should be understood that, as used herein, the term "computing node" (or simply "node") can refer to computing devices (such as mobile electronic devices, desktop computers, etc.) and / or applications (such as chat programs, email applications, social media applications, web browsers, etc.). In other words, as used herein, examples of computing nodes include, for example, computing devices (such as mobile phones, tablets, desktop computers) or other devices (such as appliances owned and / or otherwise associated with an individual (or user) (IoT appliances)), and / or different applications used by said individual on such computing devices.

[0032] Specifically, in some embodiments, a method for graph computation performed by a processor is provided. A graph comprising a plurality of explicit nodes and at least one implicit node is generated. Traversal is performed between a first explicit node and a second explicit node using deductive reasoning. Traversal is then performed between a third explicit node and a fourth explicit node using inductive reasoning, passing through at least one implicit node.

[0033] Queries associated with the graph can be received. A response to the query can be generated based on traversal between a first and a second of the plurality of explicit nodes, and between a third and a fourth of the plurality of explicit nodes. The at least one implicit node may include multiple implicit nodes.

[0034] The traversal between the third explicit node and the fourth explicit node among the plurality of explicit nodes may include: a first traversal using inductive reasoning, from the third explicit node through the first implicit node among the plurality of implicit nodes to the fourth explicit node among the plurality of explicit nodes, and a second traversal using inductive reasoning, from the third explicit node through the second implicit node among the plurality of implicit nodes to the fourth explicit node among the plurality of explicit nodes. The first traversal may be outside the second implicit node of the plurality of implicit nodes, and the second traversal may be outside the first implicit node of the plurality of implicit nodes.

[0035] The traversal between the third explicit node and the fourth explicit node among the plurality of explicit nodes may include: using inductive reasoning to traverse from the third explicit node among the plurality of explicit nodes through the first implicit node among the plurality of implicit nodes to the second implicit node among the plurality of implicit nodes, and using inductive reasoning to traverse from the second implicit node among the plurality of implicit nodes to the fourth explicit node among the plurality of explicit nodes.

[0036] The graph generation may include receiving user input associated with the at least one implicit node and generating the at least one implicit node based on the user input. Probabilistic inductive reasoning may be used to perform traversal between the at least one implicit node and a third explicit node among a plurality of explicit nodes.

[0037] It should be understood in advance that while this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter, such as cellular networks.

[0038] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services), which can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0039] The features are as follows:

[0040] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0041] Extensive network access: Capabilities are available through networks and accessed via standard mechanisms that facilitate the use of heterogeneous thin client platforms or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0042] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated as needed. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0043] Rapid elasticity: Capacity can be provided quickly and flexibly (in some cases, automatically) to shrink rapidly and expand rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0044] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0045] The service model is as follows:

[0046] Software as a Service (SaaS): This provides consumers with the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from different client devices via thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0047] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created by the consumer or acquired using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0048] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources that enable consumers to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0049] The deployment model is as follows:

[0050] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0051] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0052] Public cloud: Cloud infrastructure that is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0053] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public clouds) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0054] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure comprising a network of interconnected nodes.

[0055] See now Figure 1 The diagram illustrates an instance of a cloud computing node. Cloud computing node 10 is merely an example of a suitable cloud computing node and is not intended to impose any limitation on the use or scope of functionality of the embodiments of the invention described herein. In any case, cloud computing node 10 (and / or one or more processors described herein) can be implemented and / or perform (or cause or enable) any of the functions set forth above.

[0056] A computer system / server 12 exists in cloud computing node 10, which can operate with many other general-purpose or special-purpose computing system environments or configurations. Examples of known computing systems, environments, and / or configurations that may be suitable for computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0057] Computer system / server 12 can be described in the general context of computer system executable instructions (such as program modules) executed by the computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform specific tasks or implement specific abstract data types. Computer system / server 12 can be implemented in a distributed cloud computing environment, where tasks are performed by remote processing devices linked via a communication network. In a distributed cloud computing environment, program modules can reside in local and remote computer system storage media, including memory storage devices.

[0058] like Figure 1 As shown, the computer system / server 12 in cloud computing node 10 is illustrated in the form of a general-purpose computing device. The components of the computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 that couples the various system components, including the system memory 28, to the processor 16.

[0059] Bus 18 represents any one or more of several types of bus architectures, including memory buses or memory controllers, peripheral buses, accelerated graphics ports, and processor or local buses using any of the various bus architectures. By way of example and not limitation, such architectures include the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MCA) bus, the Enhanced ISA (EISA) bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0060] Computer system / server 12 typically includes a variety of computer system readable media. Such media can be any available media that can be accessed by computer system / server 12, and includes volatile and non-volatile media, removable and non-removable media.

[0061] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be provided for reading from and writing to non-removable, non-volatile magnetic media (not shown, and generally referred to as "hard disk drives"). Although not shown, disk drives for reading from or writing to removable non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable non-volatile optical disks (e.g., CD-ROMs, DVD-ROMs, or other optical media) may be provided. In such cases, each may be connected to bus 18 via one or more data media interfaces. As will be further described and illustrated below, system memory 28 may include at least one program product having at least one set of program modules configured to perform embodiments of the invention.

[0062] A program / utility 40 having a set (at least one) of program modules 42, along with an operating system, one or more applications, other program modules, and program data, may be stored in system memory 28 by way of example, not limitation. Each or some combination of the operating system, one or more applications, other program modules, and program data may include an implementation of a network environment. Program modules 42 typically perform functions and / or methods as described herein in embodiments of the invention.

[0063] Computer system / server 12 can also communicate with one or more external devices 14 (such as a keyboard, pointing device, display 24, etc.), and / or any device that enables computer system / server 12 to communicate with one or more other computing devices (e.g., network interface card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, computer system / server 12 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) via network adapter 20. As shown, network adapter 20 communicates with other components of computer system / server 12 via bus 18. It should be understood that, although not shown, other hardware and / or software components can be used in conjunction with computer system / server 12. Examples include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving storage systems.

[0064] In the context of this invention, and as those skilled in the art will understand, Figure 1 The various components depicted can reside in computing systems such as personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, mobile electronic devices (such as mobile (or cellular and / or smartphone) phones), personal data assistants (PDAs), tablet computers, wearable technology devices, laptops, handheld game consoles, portable media players, and vehicles (such as cars, airplanes, watercraft, etc.). However, in some embodiments, in Figure 1 Some of the components described herein may reside in a computing device, for example, in a satellite, such as a Global Positioning System (GPS) satellite. For example, some processing and data storage capabilities associated with the mechanisms of the illustrated embodiments may occur locally via local processing components, while the same components may be networked to remotely located distributed computing data processing and storage components to achieve different purposes of the invention. Again, as those skilled in the art will understand, this description is intended to convey only a subset of the entire interconnected network of distributed computing components that may collectively accomplish different inventive aspects.

[0065] See now Figure 2 The figure depicts an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 to which local computing devices used by cloud consumers can communicate, such as, for example, cellular (or mobile) phones or PDAs 54A, desktop computers 54B, laptop computers 54C, and vehicle computing systems (e.g., integrated in cars, airplanes, ships, etc.) 54N.

[0066] See also Figure 2 Nodes 10 can communicate with each other. They can be physically or virtually grouped in one or more networks (not shown), such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services to cloud consumers who do not need to maintain resources on their local computing devices. It should be understood that... Figure 2 The types of computing devices 54A-N shown are intended to be illustrative only, and computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connection (e.g., using a web browser).

[0067] See now Figure 3 This demonstrates the 50 (cloud computing environment) Figure 2 This provides a set of functional abstractions. It should be understood beforehand. Figure 3 The components, layers, and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0068] Device layer 55 includes physical and / or virtual devices embedded and / or independent electronics, sensors, actuators, and other objects to perform various tasks within the cloud computing environment 50. Each device in device layer 55 integrates networking capabilities with other functional abstraction layers, enabling information obtained from the device to be provided to other functional abstraction layers, and / or information from other abstraction layers to be provided to the device. In one embodiment, the different devices including device layer 55 can be merged into a physical network collectively referred to as the “Internet of Things” (IoT). As those skilled in the art will understand, such a physical network allows for the interoperability, collection, and dissemination of data for a wide variety of purposes.

[0069] As shown, device layer 55 includes sensor 52, actuator 53, a “learning” thermostat 56 with integrated processing, sensor and network electronics, camera 57, controllable household socket / socket 58, and controllable electrical switch 59 as shown. Other possible devices may include, but are not limited to, various additional sensor devices, network devices, electronic devices (such as remote control devices), additional actuator devices, so-called “smart” appliances (such as refrigerators, washing machines / dryers, or air conditioning units), and a variety of other possible interconnected devices / objects.

[0070] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a mainframe 61; a RISC (Reduced Instruction Set Computer) based server 62; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0071] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0072] In one example, management layer 80 may provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources, anticipating future requirements for those resources according to the SLA.

[0073] Workload layer 90 provides examples of functionalities that can leverage a cloud computing environment. Examples of workloads and functionalities that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics processing 94; transaction processing 95; and, in the context of the illustrated embodiments of the invention, various workloads and functions 96 are used for graph computation, as described herein. Those skilled in the art will recognize that workloads and functions 96 can also work in conjunction with other parts of different abstraction layers (e.g., hardware and software 60, virtualization 70, management 80, and other workloads 90, such as data analytics processing 94) to achieve the different objectives of the illustrated embodiments of the invention.

[0074] As previously described, in some embodiments, methods and / or systems for providing (and / or utilizing) an inference engine are described that combine at least some of the benefits of modern AI (or machine learning (ML), cognitive analytics, etc.) systems, such as learning and / or training based on provided samples (e.g., training data) to generate predictions, while also providing improved interpretability.

[0075] In some embodiments, as is generally understood in the art, the reasoning described herein is performed using graph computation. According to at least some aspects of the functionality described herein, traversal between nodes (of the graph) is performed using hybrid reasoning, which includes inductive reasoning combined with deductive reasoning in some embodiments. In some embodiments, a graph can be understood as comprising two types of nodes: explicit (or first type) nodes and implicit or “via” (or second type) nodes. Deductive reasoning can be used to perform traversal between explicit nodes. However, when deductive reasoning cannot allow traversal between two explicit nodes, inductive reasoning can be used, which can be considered to include traversing between two explicit nodes in an “indirect” manner through one or more implicit nodes. In some embodiments, inductive reasoning includes and / or utilizes probability-based inductive reasoning.

[0076] Figure 4 A graph (or graph database, inference engine, or method) 400 according to an embodiment of the present invention is shown. However, it should be understood that... Figure 4 This can be understood simply as illustrating the reasoning process that can be performed by the methods and systems described herein. In the example shown, Figure 400 relates to network security queries (e.g., those received from a user), such as the network security queries described above (i.e., whether a domain is malicious and / or whether an actor is behind the domain). The graph includes (explicit) nodes 402-412, and although not shown, traversal of Figure 400 can be performed using implicit (or via) nodes, as explained below. As those skilled in the art will understand, node 402 represents a specific web domain, node 404 represents an IP address, node 406 represents a software hash, node 408 represents one or more antivirus (AV) engines (or engine detection), node 410 represents a malware family, and node 412 represents a threat actor.

[0077] Multiple edges (or connections or links) 414-418 of interconnected nodes are shown, each edge potentially representing at least a possible traversal between associated explicit nodes 402-412 that may utilize implicit nodes (not shown). Specifically, edge 414 represents a reasoning step that can be performed based on known information and / or deductive reasoning. More specifically, in the specific example shown, deductive reasoning can be used to determine that a particular IP address is associated with a web domain (i.e., a traversal from node 402 to node 404), a particular software hash is associated with an IP address (i.e., a traversal from node 404 to node 406), and one or more AV engines have somehow flagged or labeled the hash, such as by marking the hash as “suspicious” (i.e., a traversal from node 406 to node 408).

[0078] However, in the example shown, no additional traversal can be performed using deductive reasoning. For example, although the software hash has been flagged / marked / detected by one or more AV engines, it has not been classified as associated with a malware family, nor has any threat actor associated with the software hash been identified (e.g., by appropriate cyber threat organizations, authorities, etc.).

[0079] See also Figure 4 Edge 416 may represent information related to an example that indicates traversal between two associated nodes is possible, but is not specific (e.g., real-world information suggesting inductive reasoning could allow traversal to occur). For example, edge 416 between nodes 408 and 410 may indicate that one or more AV engines have labeled a software hash as potentially associated with a malware family represented by node 410. In some embodiments, as represented by edge 418 between nodes 408 and 410, such information can be used to predict (or estimate, etc.) whether a software hash is associated with a malware family based on inductive reasoning (e.g., probability-based inductive reasoning). Furthermore, edge 416 between nodes 410 and 412 may represent information indicating that a particular malware family is used by a particular threat actor, but this is not specific information. Again, as represented by edge 418 between nodes 410 and 412, inductive reasoning can be used to predict whether a malware family is associated with or used by a particular threat actor (if sufficient information is available to allow such inference). In some embodiments, a threshold regarding probability-based induction is utilized (e.g., the probability of allowing / performing inference is determined to be at least 80% or some other percentage). In this way, traversal of graph 400 can be performed using deductive reasoning and inductive reasoning (or "hybrid reasoning").

[0080] If such conclusions are reached through inductive reasoning, these conclusions can be used as training data for the inference engine, as represented by edge 420 between node 406 and nodes 410 and 412, and / or any appropriate conclusions, predictions, etc., can be provided to the user (e.g., as a response to a query). Furthermore, at least when compared to most AI systems, the inference steps used (including any inductive reasoning) can be provided to the user to offer improved interpretability.

[0081] See also Figure 4It should be noted that nodes 402-408 are also interconnected by three edges 416 (i.e., representing information / evidence that may be inferred). For example, edge 416 between nodes 402 and 404 could represent information indicating that many IP addresses are resolved from the domain of interest, and edge 416 between nodes 404 and 406 could represent information indicating that many software hashes communicate with the IP addresses of interest. However, as an example, it can be assumed that such information is insufficient to allow for inference (although these may be irrelevant in these instances, since deductive reasoning could potentially be used for traversal between the nodes in question).

[0082] Figure 5 A diagram (or a portion thereof) 500 is shown according to an embodiment of the present invention. Figure 500 includes a software hash node 502 (i.e., a node representing the concept of a particular software hash) (or a source node) and a malware family node 504 (i.e., a node representing the concept of a particular malware family) (or a target node). In the example shown, edge 506 is shown as an interconnect (or link) between nodes 502 and 504. As an example, it can be assumed that the traversal performed using edge 506 is performed using deductive reasoning. That is, the particular software hash represented by node 502 (or more specifically, the associated software component) can generally be "known" as a member of a particular malware family represented by node 504 (e.g., as indicated in a database managed by an appropriate organization) and / or malware. Accordingly, traversal can be performed directly from node 502 to node 504 using deductive reasoning.

[0083] On the contrary, Figure 6 The example shown may not utilize inductive reasoning; this example includes similar software hash nodes 602 and malware family nodes 604. More specifically, in this instance, the particular software hash represented by node 502 may not be "known" as a member of the particular malware family represented by node 504, thus making inductive reasoning potentially unnecessary for direct traversal from (source) node 602 to (target) node 604. Thus, in some embodiments, the methods and systems described herein substantially search for additional information (or information / data sources) that may (or may not) allow inference using inductive reasoning (e.g., "indirect" paths / traversals from node 602 to node 604). In some embodiments, this process is performed using one or more implicit (or "via") nodes (such as AV engine detection node 606). The utilization (and / or generation) of implicit (or via) nodes can be performed in response to user input. That is, if inductive reasoning is not utilized, the user can provide the system with instructions to find alternative ways to traverse between nodes. In the example shown, the implicit node is associated with the AV engine detection (and / or its database, which stores different information related to the hash). Although Figure 6Only implicit nodes are shown in the graph; however, it should be understood that multiple implicit nodes can be utilized (and / or generated within the graph).

[0084] Still referencing Figure 6 In the example shown, an edge 608 is formed between node 602 and implicit node 606, representing inference for traversing between node 602 and implicit node 606. More specifically, it has been found that the AV engine detection represented by node 606 includes information related to the software hash of node 602. Accordingly, inference can be used to traverse implicit node 606. However, while the AV engine detection includes information related to the hash (e.g., the AV engine has labeled / marked the hash as suspicious, etc.), the associated software component has not been determined to be "known" as malware and / or from a specific malware family (i.e., it is not definitively known). Accordingly, inference may not be used to traverse from implicit node 606 to node 604.

[0085] In some embodiments, the system utilizes information available through implicit nodes to determine whether such a traversal can be performed using inductive reasoning (e.g., probability-based inductive reasoning) or deduction. This process may include calculating probabilities (and / or scores) using the available information (e.g., the system calculates the probability that a software hash is associated with a software component that is malware). If the calculated probability (or score) exceeds a predetermined threshold (e.g., 80%), the system may allow the traversal to occur (and / or perform the traversal) and generate its signals to notify the user, train using the inference, etc. It should be understood that the system may disallow such a traversal using inductive reasoning until multiple independent sources of information indicate relevant inferences (e.g., dozens of AV engines classify the hash as suspicious). The generated inferences can then be used to train for future use of the graph (or graph database).

[0086] See now Figure 7 This shows again Figure 6 Figure 600, but with additional (explicit) nodes 612 representing specific threat actors. In some implementations, the use of implicit nodes and / or inductive reasoning can be “stacked.” For example, if inductive reasoning allows (via node 606) the inference that a software hash is associated with a specific malware family, the system may be able to make similar inferences about whether a specific threat actor (e.g., a country, a “hacker” group, etc.) is behind malware (e.g., via edge 614). For example, different types of information can be located through one or more nodes (e.g., AV engine detection) that a specific malware family is “typically” associated with the actions of a specific threat actor. Thus, in Figure 7In this context, node 604 can be considered (or act as) an implicit node. A probability-based inductive reasoning process similar to that described above can be used. Then, any such inferences made can be utilized in any suitable manner (e.g., to notify the user, for system training, etc.).

[0087] See now Figure 8 Figure 800 (similar to those described above) is shown. This graph includes four explicit nodes 802-808 (and / or an explicit graph that explicitly includes or contains nodes 802-808) and three implicit (or via) nodes 810-814 (and / or an implicit graph that implicitly includes or contains nodes 810-814). Graph 800 and / or nodes 802-814 can be generated in response to user input. As shown, explicit nodes 802-808 represent a domain, IP address, software hash, and malware family, respectively. Implicit nodes 810-814 represent "siblings" 810, download 812, and AV engine detection 814.

[0088] That is, when using Figure 8 As shown in Figure 800, the system can first attempt to resolve a specific IP address from the domain in question using deductive reasoning. If this is not possible, the system can attempt to infer (or use deductive reasoning) via sibling node 810 (i.e., attempt to infer whether the IP address can be resolved to a domain because it is associated with "sibling" domains, such as those managed in another country). Similarly, if the system cannot infer that software associated with a software hash communicates with an IP address, the system can look for ways to infer the association between the software hash and the IP address because the associated software has been downloaded from the IP address via download node 812. Implicit node 814 can be detected using the AV engine as described above. It should be noted that in Figure 8 In Figure 800 shown, the user has defined the transit nodes between each pair of consecutive explicit node pairs. Accordingly, it should be understood that implicit (or transit) nodes can be used (or defined) in multiple places on the graph (or graph database) along with inductive reasoning (i.e., if the available information allows for such inference).

[0089] Figure 9Figure 900 (or at least a portion thereof) is illustrated according to an embodiment of the present invention. The figure includes explicit nodes 902-906 and implicit (or via) nodes 908-920. Explicit nodes 902, 904, and 906 may represent specific software hashes, specific malware families, and specific threat actors, respectively, and each of the implicit nodes 908-920 may represent a specific AV engine. If the system cannot traverse from node 902 to node 904 using inductive reasoning, the system may subsequently query the implicit nodes. As an example, node 908 may have a hash labeled “Trojan.General”, and node 910 may have a hash labeled “Insecure”. Node 912 may have a label “Malware (AI score = 100)”, etc. It should be noted that some AV engines will label hashes as more suspicious, malicious, etc., and / or more specific and / or have a higher confidence level than others. This may be the same in other embodiments (i.e., when the methods / systems described herein are applied to other scenarios / fields). This can be used to apply weighting schemes to the nodes used (e.g., giving higher confidence and / or specific information and / or giving higher weight to information sources). However, even if the association of the hash with malware is not "known," different labels on the hash discovered by querying implicit nodes allow the system to infer that the software is malware and / or associated with a specific malware family, as described above.

[0090] See also Figure 9 It should be noted that multiple distinct independent paths can be used to traverse between nodes 902 and 904 using inductive reasoning. For example, the first traversal (path) can pass through node 908, while the second traversal (and node 908) outside the first traversal, outside the second traversal, etc., can pass through node 918.

[0091] Regarding the calculation of probability and / or score, when using deductive reasoning to traverse from the first node (A) to the second node (B), the probability can generally be expressed as P(A and B) = P(A). P(B given). Because P(B, given A) is derived from a database lookup (i.e., known facts, 100% certainty, etc.), the probability is always 1. In mathematical form, probability can be expressed as...

[0092]

[0093] However, when using inductive reasoning to traverse between the first node (A) and the second node (B) via implicit (or via) node (V), the probability can generally be expressed as P(A and B) = P(A and V). P(B|(A and V)) can be written as P(A) P(V|A) P(B|(A and V)). Since P(V|A) comes from a database lookup, it is always 1. Therefore, P(A and V) = P(A) and P(A and B) = P(A). P(B|V). Note that V is a set and can have more than one element (e.g., {V1, V2, ..., V...}). n}). P(B|V) can be determined by the number of nodes with discriminative forces #(V dp It can be determined and represented as:

[0094]

[0095] For each node via (or implicitly) a node, its discriminative power can be expressed as:

[0096]

[0097] Simply put, we want a node to reach fewer classes than the number of its edges. In some embodiments, if a node “points” to three classes via three edges, then the discriminative power of that node is insufficient to point to a particular class. In Equation 3, p represents the number of outgoing edges of a particular node, and q is the number of node classes reachable from the current class. Typically, discriminative power can be expressed as...

[0098]

[0099] In Equation 4, x = sensitivity / (1 - sensitivity), and Y = specificity / (1 - specificity). Sensitivity can be defined as tp / (tp + fn), and specificity can be defined as tp / (fp + tn). In some embodiments, node discriminative power can be scaled between 0 and 3 (or 4), where a value of approximately 2.5 or greater (or 3.0) is considered sufficient for generating predictions. In some embodiments, probabilities are based on previous nodes. For example, when utilizing inductive reasoning, the probability associated with traversing from node B to node C may be influenced by the probability associated with traversing from node A to node B.

[0100] See now Figure 10 The diagram illustrates a method (and / or system) 1000 for reasoning (or graph computation). In block 1002, a user provides one or more reasoning steps, which in some embodiments include both explicit nodes and implicit (or via) nodes. In other words, in some embodiments, implicit nodes (and possibly explicit nodes) are generated in response to user input. In some embodiments, such as at block 1004, the user may also provide probabilities for a set of targets (or target nodes).

[0101] At box 1006, as described above, the system attempts to traverse the next target based on (or utilizing) inference. If such traversal is possible, then at box 1008, any implicit nodes associated with the explicit nodes that have already been traversed are generated (and can be used in the future). Subsequently, at box 1010, at least some targets may be merged (e.g., based on high probability, similarity, etc.), and method 1000 returns to box 1006.

[0102] However, if further traversal is not possible using deductive reasoning, then at box 1012, the system attempts to traverse the next target using inductive reasoning, as described above. If possible, the method proceeds to box 1010 and then returns to box 1006. If not, then at box 1014, the system determines whether any further traversal is possible. If yes, the system can return to box 1006, and if no, then at box 1016, the reasoning process ends. The system can then generate any suitable predictions, notifications, etc., based on the traversals performed during the reasoning process, possibly including information that provides improved interpretability.

[0103] Figure 11 An inference path 1100, either as input or defined by the user (and as shown on a graphical user interface or computing device), is illustrated. As shown, the inference path comprises a series of inference steps, each associated with at least one pair of nodes. Specifically, the first (or the first six) inference steps 1102 are associated with attempting to traverse directly from a first explicit node to a second explicit node using deductive reasoning (e.g., domain node to IP address node, domain node to malware family, etc.). The last (or bottom) two inference steps 1104 are associated with the system attempting to traverse from the first explicit node to the second explicit node using inductive reasoning via a hash node (e.g., a hash node from an AV detection node to a malware family node, etc.). In some embodiments, the system may receive such input from a user and use that input to generate a graph and perform the traversal, as described above. In some embodiments, if the associated explicit nodes cannot be traversed using deductive reasoning, the system utilizes only inference steps, including the use of implicit nodes (and / or inductive reasoning).

[0104] Therefore, in some embodiments, the methods and systems described herein allow for the definition (e.g., for each pair of explicit nodes) of “additional” (or implicit or via) nodes in a graph (or graph database), which can automatically generate implicit graphs (or portions of graphs including implicit nodes) for inductive reasoning. In some embodiments, implicit nodes (and / or associated inductive reasoning) can be “stacked” for complex reasoning scenarios. Furthermore, the methods and systems described herein can allow for traversal of both explicit nodes (or explicit portions of a graph) and implicit nodes (or implicit portions of a graph) using both deductive and inductive reasoning (or “hybrid” reasoning).

[0105] The methods and systems described in this paper can provide “white-box” reasoning that can be verified and / or easily understood by humans (at least on a relative basis compared to most AI systems) because, for example, the reasoning steps (including any inductive reasoning utilized) can be provided to the user. In other words, the methods and / or systems described in this paper can provide improved interpretability, accountability, credibility, etc., compared to most AI systems. Furthermore, the methods and systems described in this paper are capable of incrementally learning from “known” cases and classifying unknown cases. In contrast, most AI systems can undergo repeated training and deployment even when the utilized model no longer works. Further, the methods and systems described in this paper can be dynamically configured to predict new categories without affecting previously constructed graphs (or knowledge graphs). In contrast, most AI systems require retraining.

[0106] Turning Figure 12 A flowchart of an exemplary method 1200 for graph computation (or reasoning) is provided. Method 1200 begins, for example, by receiving information or input from a user about one or more explicit nodes and one or more implicit nodes (as described above) (step 1202).

[0107] Generate a graph (or graph database) comprising multiple explicit nodes and at least one implicit node (step 1204). The at least one implicit node may include multiple implicit nodes. The graph generation may be based on received user input.

[0108] Traverse between the first explicit node and the second explicit node among multiple explicit nodes using deductive reasoning (step 1206).

[0109] A traversal of at least one implicit node is performed between a third explicit node and a fourth explicit node among a plurality of explicit nodes using inductive reasoning (step 1208). This traversal may include a first traversal using inductive reasoning from the third explicit node to the fourth explicit node through a first implicit node among a plurality of implicit nodes, and a second traversal using inductive reasoning from the third explicit node to the fourth explicit node through a second implicit node among a plurality of implicit nodes. The first traversal may be outside the second implicit node of the plurality of implicit nodes, and the second traversal may be outside the first implicit node of the plurality of implicit nodes. In some embodiments, the traversal between the third explicit node and the fourth explicit node among a plurality of explicit nodes may include: traversing from the third explicit node among a plurality of explicit nodes through the first implicit node among a plurality of implicit nodes to the second implicit node among a plurality of implicit nodes using inductive reasoning, and traversing from the second implicit node among a plurality of implicit nodes to the fourth explicit node among a plurality of explicit nodes using inductive reasoning. Probabilistic inductive reasoning can be used to perform a traversal through at least one implicit node between a third explicit node and a fourth explicit node among the plurality of explicit nodes.

[0110] In some embodiments, a query associated with the graph may be received. A response (and / or its signaled representation) to the query may be generated based on a traversal between a first explicit node and a second explicit node among the plurality of explicit nodes, and a traversal between a third explicit node and a fourth explicit node among the plurality of explicit nodes.

[0111] Method 1200 concludes (step 1210), wherein, for example, as described above, the graph is traversed as much as possible using derivation and inductive reasoning. In some embodiments, feedback from the user can also be used to improve the system's performance over time.

[0112] The present invention may be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the present invention.

[0113] Computer-readable storage media can be tangible devices that can hold and store instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DvD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0114] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device or to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the corresponding computing / processing device.

[0115] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and conventional procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may be personalized to execute computer-readable program instructions by utilizing state information from the computer-readable program instructions in order to perform aspects of this invention.

[0116] This document describes various aspects of the invention with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0117] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, thereby comprising an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0118] These computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, thereby causing these instructions to be executed on the computer, other programmable apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0119] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a non-linear order. For example, depending on the functions involved, two consecutively shown blocks may actually execute substantially simultaneously, or these blocks may sometimes execute in reverse order. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

Claims

1. A method for performing graph computation by a processor, comprising: Generate a graph comprising multiple explicit nodes and at least one implicit node, the graph being generated based on received user input, the user input comprising at least one of text, audio, image, or video; Traversal is performed between the first explicit node and the second explicit node among the plurality of explicit nodes using deductive reasoning; In response to determining that additional traversal cannot be performed in the graph using only the inductive reasoning, a probability threshold is calculated that allows traversal through at least one implicit node between the third explicit node and the fourth explicit node among the plurality of explicit nodes using inductive reasoning, wherein the probability threshold is based on a plurality of independent information sources that validate the generated relevant inference. as well as In response to determining that the probability threshold has been exceeded, the inductive reasoning is used to traverse between the third explicit node and the fourth explicit node among the plurality of explicit nodes through the at least one implicit node.

2. The method according to claim 1, further comprising: Receive queries associated with the graph; as well as A response to the query is generated based on the traversal between the first explicit node and the second explicit node among the plurality of explicit nodes, and the traversal between the third explicit node and the fourth explicit node among the plurality of explicit nodes.

3. The method according to claim 1, wherein, The at least one implicit node includes multiple implicit nodes.

4. The method according to claim 3, wherein, The traversal between the third explicit node and the fourth explicit node in the plurality of explicit nodes includes: a first traversal using inductive reasoning from the third explicit node in the plurality of explicit nodes through a first implicit node in the plurality of implicit nodes to the fourth explicit node in the plurality of explicit nodes, and a second traversal using inductive reasoning from the third explicit node in the plurality of explicit nodes through a second implicit node in the plurality of implicit nodes to the fourth explicit node in the plurality of explicit nodes, wherein the first traversal is outside the second implicit node in the plurality of implicit nodes, and the second traversal is outside the first implicit node in the plurality of implicit nodes.

5. The method according to claim 3, wherein, The traversal between the third explicit node and the fourth explicit node among the plurality of explicit nodes includes: using inductive reasoning to traverse from the third explicit node among the plurality of explicit nodes through the first implicit node among the plurality of implicit nodes to the second implicit node among the plurality of implicit nodes, and using inductive reasoning to traverse from the second implicit node among the plurality of implicit nodes to the fourth explicit node among the plurality of explicit nodes.

6. The method according to claim 1, wherein, The generation of the graph includes receiving user input associated with the at least one implicit node and generating the at least one implicit node based on the user input.

7. The method according to claim 1, wherein, Traversal through at least one implicit node is performed between the third explicit node and the fourth explicit node among the plurality of explicit nodes using probability-based inductive reasoning.

8. A system for performing graph computation, comprising means adapted to perform all the steps of the method according to any one of claims 1-7.

9. A computer program product comprising, when executed on a computer system, instructions for performing all steps of the method according to any one of claims 1-7.

Images