Abstract: An apparatus, computer-readable medium, and computer-implemented method for efficiently classifying a data object, including representing the data object as a data object vector in a vector space, each dimension of the data object vector corresponding to a different feature of the data object, determining a distance between the data object vector and centroids of data domain clusters in the vector space, each data domain cluster comprising data domain vectors representing data domains, sorting the data domain clusters according to their respective distances to the data object vector, and iteratively applying data domain classifiers corresponding to data domains represented in a closest data domain cluster in the sorted data domain clusters to the data object.

Abstract: A system, method and computer-readable medium for determining a data domain associated with data, including parsing a document to generate one or more document indexes corresponding to the document, the one or more document indexes comprising a plurality of index terms and location information, determining a syntactic confidence score corresponding to a non-dictionary term in the plurality of index terms based on a syntactic analysis of the non-dictionary term, determining a proximity confidence score corresponding to the non-dictionary term based on the location information and at least one proximity query associated with the non-dictionary term and one or more other terms in the document index, determining a semantic confidence score based on a plurality of dictionary terms in the plurality of index terms, and determining an overall confidence score corresponding to the non-dictionary term based on the syntactic confidence score, the proximity confidence score, and the semantic confidence score.

Abstract: A method, apparatus, and computer-readable medium for searching polymorphically encrypted data includes storing one or more pseudonymous tokens in a data store, the one or more pseudonymous tokens being generated by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm to the same plaintext, and identifying data in the data store that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the plaintext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.

Abstract: The present invention relates to systems and methods for detecting anomalies in computer network traffic with fewer false positives and without the need for time-consuming and unreliable historical baselines. Upon detection, traffic anomalies can be processed to determine valuable network insights, including health of interfaces, devices and network services, as well as to provide timely alerts in the event of attack.

Abstract: A system, method, and computer-readable medium for determining risk associated with anomalous behavior of a user on a computer network including receiving anomalous behavioral data corresponding to anomalous activity of the user on the computer network, determining surprisal values corresponding to one or more behavioral factors based on one or more of: one or more probabilities corresponding to one or more current values or one or more characteristics of the one or more behavioral factors, determining one or more dynamic weights corresponding to the one or more behavioral factors based at least in part on the one or more current values and historically expected values of the one or more behavioral factors for the user, and determining a risk metric corresponding to the anomalous activity of the user based on the surprisal values, the one or more dynamic weights, and static weights assigned to the one or more behavioral factors.

Abstract: A method, apparatus, and computer-readable medium for searching polymorphically encrypted data includes storing one or more pseudonymous tokens in a data store, the one or more pseudonymous tokens being generated by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm to the same plaintext, and identifying data in the data store that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the plaintext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.

Abstract: A system, method and computer-readable medium for determining a data domain associated with data, including parsing a document to generate one or more document indexes corresponding to the document, the one or more document indexes comprising a plurality of index terms and location information, determining a syntactic confidence score corresponding to a non-dictionary term in the plurality of index terms based on a syntactic analysis of the non-dictionary term, determining a proximity confidence score corresponding to the non-dictionary term based on the location information and at least one proximity query associated with the non-dictionary term and one or more other terms in the document index, determining a semantic confidence score based on a plurality of dictionary terms in the plurality of index terms, and determining an overall confidence score corresponding to the non-dictionary term based on the syntactic confidence score, the proximity confidence score, and the semantic confidence score.

Abstract: An apparatus, computer-readable medium, and computer-implemented method for efficiently classifying a data object, including representing the data object as a data object vector in a vector space, each dimension of the data object vector corresponding to a different feature of the data object, determining a distance between the data object vector and centroids of data domain clusters in the vector space, each data domain cluster comprising data domain vectors representing data domains, sorting the data domain clusters according to their respective distances to the data object vector, and iteratively applying data domain classifiers corresponding to data domains represented in a closest data domain cluster in the sorted data domain clusters to the data object.

Abstract: An apparatus, computer-readable medium, and computer-implemented method for postal address identification, including receiving one or more sequences of tokens corresponding to candidate postal address data objects, evaluating the sequences of tokens with the statistical postal address model to identify candidate postal address data objects, computing candidate vectors corresponding to the identified candidate postal address data objects in the vector space, and determining whether the identified candidate postal address data objects correspond to a postal address based on applying outlier detection methods to the candidate vectors and one or more clusters of the clusters.

Abstract: A system, method, and computer-readable medium for determining risk associated with anomalous behavior of a user on a computer network including receiving anomalous behavioral data corresponding to anomalous activity of the user on the computer network, determining surprisal values corresponding to one or more behavioral factors based on one or more of: one or more probabilities corresponding to one or more current values or one or more characteristics of the one or more behavioral factors, determining one or more dynamic weights corresponding to the one or more behavioral factors based at least in part on the one or more current values and historically expected values of the one or more behavioral factors for the user, and determining a risk metric corresponding to the anomalous activity of the user based on the surprisal values, the one or more dynamic weights, and static weights assigned to the one or more behavioral factors.

Abstract: A system, method and computer-readable medium format-preserving encryption of a numerical value, including storing a binary numerical value, the binary numerical value comprising a plurality of binary bits, dividing the plurality of binary bits into a plurality of bit groups and storing the plurality of bit groups in a plurality of bytes, encrypting each byte in the plurality of bytes using a radix value corresponding to a quantity of binary bits in a bit group corresponding to that byte to generate a plurality of ciphertext bytes, and combining a quantity of least-significant bits from each ciphertext byte in the plurality of ciphertext bytes to generate a binary ciphertext value, the quantity of least-significant bits combined from each ciphertext byte corresponding to the radix value used to generate that ciphertext byte.

Abstract: A system, method, and computer-readable medium for determining risk associated with anomalous behavior of a user on a computer network including receiving anomalous behavioral data corresponding to anomalous activity of the user on the computer network, determining surprisal values corresponding to one or more behavioral factors based on one or more of: one or more probabilities corresponding to one or more current values or one or more characteristics of the one or more behavioral factors, determining one or more dynamic weights corresponding to the one or more behavioral factors based at least in part on the one or more current values and historically expected values of the one or more behavioral factors for the user, and determining a risk metric corresponding to the anomalous activity of the user based on the surprisal values, the one or more dynamic weights, and static weights assigned to the one or more behavioral factors.

Abstract: The present invention relates to systems and methods for detecting anomalies in computer network traffic with fewer false positives and without the need for time-consuming and unreliable historical baselines. Upon detection, traffic anomalies can be processed to determine valuable network insights, including health of interfaces, devices and network services, as well as to provide timely alerts in the event of attack.

Abstract: A system, method and computer-readable medium for generating a data masking syntactic definition for a data element of an unknown data type, including generating one or more alphabets corresponding to one or more element member positions of the data element based at least in part on element members occurring at each element member position in a plurality of data elements of the unknown type, each alphabet comprising a set of one or more sequential element members that have occurred in the plurality of data elements at an element member position and generating a positional map describing a syntactic structure of the data element by mapping at least one of the one or more alphabets to each element member position of the data element.

Abstract: A system, method and computer-readable medium format-preserving encryption of a numerical value, including storing a binary numerical value, the binary numerical value comprising a plurality of binary bits, dividing the plurality of binary bits into a plurality of bit groups and storing the plurality of bit groups in a plurality of bytes, encrypting each byte in the plurality of bytes using a radix value corresponding to a quantity of binary bits in a bit group corresponding to that byte to generate a plurality of ciphertext bytes, and combining a quantity of least-significant bits from each ciphertext byte in the plurality of ciphertext bytes to generate a binary ciphertext value, the quantity of least-significant bits combined from each ciphertext byte corresponding to the radix value used to generate that ciphertext byte.

Abstract: The present invention relates to systems and methods for detecting anomalies in computer network traffic with fewer false positives and without the need for time-consuming and unreliable historical baselines. Upon detection, traffic anomalies can be processed to determine valuable network insights, including health of interfaces, devices and network services, as well as to provide timely alerts in the event of attack.

Abstract: A method, apparatus, and computer-readable medium for searching polymorphically encrypted data includes storing one or more pseudonymous tokens in a data store, the one or more pseudonymous tokens being generated by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm to the same plaintext, and identifying data in the data store that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the plaintext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.

Abstract: A system, method and computer-readable medium for generating a data masking syntactic definition for a data element of an unknown data type, including generating one or more alphabets corresponding to one or more element member positions of the data element based at least in part on element members occurring at each element member position in a plurality of data elements of the unknown type, each alphabet comprising a set of one or more sequential element members that have occurred in the plurality of data elements at an element member position and generating a positional map describing a syntactic structure of the data element by mapping at least one of the one or more alphabets to each element member position of the data element.

Abstract: A method, apparatus, and computer-readable medium for searching polymorphically encrypted data includes generating one or more pseudonymous tokens by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm to the same plaintext, storing, the one or more pseudonymous tokens in one or more data stores, and identifying data in the one or more data stores that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the plaintext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.

Abstract: A system, method and computer-readable medium format-preserving encryption of a numerical value, including storing a binary numerical value, the binary numerical value comprising a plurality of binary bits, dividing the plurality of binary bits into a plurality of bit groups and storing the plurality of bit groups in a plurality of bytes, encrypting each byte in the plurality of bytes using a radix value corresponding to a quantity of binary bits in a bit group corresponding to that byte to generate a plurality of ciphertext bytes, and combining a quantity of least-significant bits from each ciphertext byte in the plurality of ciphertext bytes to generate a binary ciphertext value, the quantity of least-significant bits combined from each ciphertext byte corresponding to the radix value used to generate that ciphertext byte.