Abstract: A method for generating a cross-site scripting attack is provided. An attack string sample is analyzed for obtaining a token sequence. A string word corresponding to each token is used to replace the token for generating a cross-site scripting attack string. Accordingly, a large number of cross-site scripting attacks are generated automatically, so as to execute a penetration test for a website.

Abstract: The present invention discloses a method and system for classifying articles. The present invention can be not only capable of distinguishing the type of the article but also novelty to generate an overview article automatically in accordance with the initial prepared keyword combination or articles. Furthermore, the overview article described above comprises a representative topic corresponding to the content of the initial prepared articles, wherein the representative topic is also able to identify the field of the articles. Accordingly, by the said overview article, the present invention is capable of decreasing the time required to understand the spirit and the technical aspect of the articles so as to solve the long lasted problem of the prior art.

Abstract: The invention is to provide a generating method for transaction models with indicators for option. The method comprises: (S1) collecting a variety of indicators from the financial market; (S2) establishing an indicator pool saved with the indicators; (S3) distinguishing and classifying the indicators by Neural Network; (S4) determining a plurality of transaction models, the indicator of each transaction model in an independent classification; (S5) determining a date parameter for each indicator; (S6) deleting a part of the transaction models; (S7) determining a plurality of final transaction models from another transaction models; and (S8) determining a weight of each final transaction model.

Abstract: A citation record extraction system is provided for extracting citation records from publication list pages having different layouts and contents. An HTML rendering engine receives a publication list web page, parses the publication list web page to obtain layout information of the web page. A web page sequence builder generates a web page characteristic sequence for the web page according to the layout information. A web page repeated pattern analyzer analyzes repeated patterns presented in the web page characteristic sequence, screens out non-citation records therefrom, and obtains a citation record of the publication list web page.

Abstract: A method for generating a cross-site scripting attack is provided. An attack string sample is analyzed for obtaining a token sequence. A string word corresponding to each token is used to replace the token for generating a cross-site scripting attack string. Accordingly, a large number of cross-site scripting attacks are generated automatically, so as to execute a penetration test for a website.

Abstract: A network attack detection device is provided, including a spatial coordinate database for storing spatial coordinate data; a standard time zone database for storing standard time zone data; a domain name system packet collector for collecting a domain name system packet; a spatial snapshot feature extractor for extracting internet protocol address corresponding to the domain name system packet according to the domain name system packet, and generating spatial feature data corresponding to the internet protocol address according to the internet protocol address, the spatial coordinate data and the standard time zone data; and an attack detector for determining whether the domain name system packet is an attack according to the spatial feature data and a spatial snapshot detection model, and when determining that the domain name system packet is an attack, sending a warning to indicate the attack.

Abstract: The invention is to provide a generating method for transaction models with indicators for option. The method comprises: (S1) collecting a variety of indicators from the financial market; (S2) establishing an indicator pool saved with the indicators; (S3) distinguishing and classifying the indicators by Neural Network; (S4) determining a plurality of transaction models, the indicator of each transaction model in an independent classification; (S5) determining a date parameter for each indicator; (S6) deleting a part of the transaction models; (S7) determining a plurality of final transaction models from another transaction models; and (S8) determining a weight of each final transaction model.

Abstract: A botnet detection system is provided. A bursty feature extractor receives an Internet Relay Chat (IRC) packet value from a detection object network, and determines a bursty feature accordingly. A Hybrid Hidden Markov Model (HHMM) parameter estimator determines probability parameters for a Hybrid Hidden Markov Model according to the bursty feature. A traffic profile generator establishes a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories. A dubious state detector determines a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determines whether the IRC packet flow of the object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generates a warning signal when the IRC packet flow is regarded as having a dubious traffic state.

Abstract: A streaming query system for extensible markup language is provided. An XPath query translator receives and analyzes a user-input XPath document. An abstract syntax tree analyzer establishes an abstract syntax tree. A XML parser receives and parses an XML document. An index generator generates an index for the XML document. A computation module performs a format calculation based on the abstract syntax tree and the index, and generates a query result accordingly.

Abstract: A method for detecting a malicious script is provided. A plurality of distribution eigenvalues are generated according to a plurality of function names of a web script. After the distribution eigenvalues are inputted to a hidden markov model (HMM), probabilities respectively corresponding to a normal state and an abnormal state are calculated. Accordingly, whether the web script is malicious or not can be determined according to the probabilities. Even an attacker attempts to change the event order, insert a new event or replace an event with a new one to avoid detection, the method can still recognize the intent hidden in the web script by using the HMM for event modeling. As such, the method may be applied in detection of obfuscated malicious scripts.

Abstract: A hot video prediction system is provided. A video comments database stores video comments submitted by a plurality of users. A user social network constructor establishes a user social network according to the video comments. When new comments of a new video are received, a hot video predictor uses the user social network to determine a similar theme between the new video and hot videos that have been hot for a period of time, and predicts whether the new video will become popular accordingly. A social network adaptor checks the prediction, and modifies the user social network accordingly.

Abstract: A method for establishing classifying rules of an intrusion detecting system is provided with the following steps. First, at least one decision tree is provided. Internal nodes of the decision tree respectively represent an attribute judgment condition, and leaf nodes respectively represent an attack event or non-attack event. Next, a plurality of attribute data of at least one new attack event is received. Then, a tree structure of the decision tree is adjusted according to the attribute data. Afterwards, at least one attack rule or at least one non-attack rule is outputted according to the adjusted decision tree. Further, the intrusion detection system is also provided.

Abstract: A network attack detection device is provided, including a spatial coordinate database for storing spatial coordinate data; a standard time zone database for storing standard time zone data; a domain name system packet collector for collecting a domain name system packet; a spatial snapshot feature extractor for extracting internet protocol address corresponding to the domain name system packet according to the domain name system packet, and generating spatial feature data corresponding to the internet protocol address according to the internet protocol address, the spatial coordinate data and the standard time zone data; and an attack detector for determining whether the domain name system packet is an attack according to the spatial feature data and a spatial snapshot detection model, and when determining that the domain name system packet is an attack, sending a warning to indicate the attack.

Abstract: A web mimicry attack detection device is provided, including: a first token sequence collector receiving a hypertext transfer protocol request and extracting string content of the hypertext transfer protocol request according to a token collection method to generate a token sequence corresponding to the hypertext transfer protocol request, wherein the token sequence comprises a plurality of the tokens; and a mimicry attack detector generating a label and a confidence score corresponding individually to the tokens according to the tokens and a conditional random field probability model, summing the confidence score individually corresponding to the tokens in the token sequence by a summary rule to generate a summary confidence score, and determining whether the hypertext transfer protocol request is an attack according to the summary confidence score and the label individually corresponding to the tokens.

Abstract: An expert list recommendation system is provided, including: a domain modeler for establishing an expert knowledge database according to a plurality of expert publications in different domains, receiving an inquired proposal, determining the academic field of the inquired proposal according to keywords of the inquired proposal and keyword sets of the expert publications in different domains stored in the expert knowledge database, and outputting a first domain expert list corresponding to the inquired proposal, wherein the first domain expert list comprises a first group of expert publications and a first group of expert names; and an expertise matcher for receiving the first domain expert list, comparing semantic relatedness between keywords of the inquired proposal and keywords corresponding to the first group of the expert publications of the first domain expert list to output a first expert list to a display device.

Abstract: A conflict of interest detection system is provided. A data extractor retrieves a document and extracts author, title, and date information. A co-authorship finder finds out co-author relation among documents. A relevant group cluster identifies a key researcher in a particular field, and groups researchers connected to the key researcher as a group. A potential link finder identifies researchers who may have co-author relation. A relation filter filters out couples having weaker relation from the group having co-author relation. The filtered co-author relation data is then stored as a conflict of interest list.

Abstract: A streaming query system for extensible markup language is provided. An XPath query translator receives and analyzes a user-input XPath document. An abstract syntax tree analyzer establishes an abstract syntax tree. A XML parser receives and parses an XML document. An index generator generates an index for the XML document. A computation module performs a format calculation based on the abstract syntax tree and the index, and generates a query result accordingly.

Abstract: A citation record extraction system is provided. An HTML rendering engine receives a publication list web page, parses the publication list web page to obtain layout information of the web page. A web page sequence builder generates a web page characteristic sequence for the web page according to the layout information. A web page repeated pattern analyzer analyzes repeated pattern presented in the web page characteristic sequence, screens out non-citation record therefrom, and obtains a citation record of the publication list web page.

Abstract: A botnet detection system is provided. A bursty feature extractor receives an Internet Relay Chat (IRC) packet value from a detection object network, and determines a bursty feature accordingly. A Hybrid Hidden Markov Model (HHMM) parameter estimator determines probability parameters for a Hybrid Hidden Markov Model according to the bursty feature. A traffic profile generator establishes a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories. A dubious state detector determines a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determines whether the IRC packet flow of the object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generates a warning signal when the IRC packet flow is regarded as having a dubious traffic state.

Abstract: A hot video prediction system is provided. A video comments database stores video comments submitted by a plurality of users. A user social network constructor establishes a user social network according to the video comments. When new comments of a new video are received, a hot video predictor uses the user social network to determine a similar theme between the new video and hot videos that have been hot for a period of time, and predicts whether the new video will become popular accordingly. A social network adaptor checks the prediction, and modifies the user social network accordingly.