Abstract: An approach is provided for access control management. Experts included in a mixture of experts (MoE) architecture are trained. A router selects a set of experts from the MoE model architecture as having greatest probabilities of being relevant to a data point received at the router. An expert in the set is identified as not having a privilege allowing access to the data point. A masking mechanism masks out the identified expert from the selected set of experts and identifies a previously unselected expert that has a next greatest probability of being relevant to the data point. It is determined that the identified previously unselected expert has the privilege allowing access to the data point. Based on the identified previously unselected expert having the privilege allowing the access to the data point, the identified previously unselected expert is added to the selected set of experts.

Abstract: An approach is provided for controlling access to internal knowledge in a language model (LM). Data from one or more of data sources on which the LM is trained is stored in a vector store. Data segments in the stored data are tagged to indicate origin data sources. A user prompt is received for an information retrieval system that uses the LM to generate answers to user prompts. The user prompt is provided by a user having a document access privilege. Documents are retrieved from the vector store by using the user prompt, an answer to the user prompt, or a combination of the user prompt and the answer. Access requirements for the retrieved documents are identified based on the tagged data segments. Based on the retrieved documents, the identified access requirements, and the privilege, it is determined whether to present the answer to the user.

Abstract: Entity-wide database asset index generation is provided. An entity-wide database asset index corresponding to an entity is generated identifying all observed database instances across a plurality of database servers by each respective security monitoring system of a plurality of different security monitoring systems corresponding to the entity and one or more linked sets of same database instances observed by more than one security monitoring system of the plurality of different security monitoring systems. Security analytics are performed on the entity-wide database asset index that identifies all of the observed database instances across the plurality of database servers by each respective security monitoring system of the plurality of different security monitoring systems corresponding to the entity and the one or more linked sets of same database instances observed by more than one security monitoring system of the plurality of different security monitoring systems to detect any database security threats.

Abstract: Apparatus, systems, and/or methods may involve reporting a road hazard. Road hazard data may be collected for an object on a road, which may include automatically generated data from a device associated with the object causing a hazard. The road hazard data may be provided to a service, an application, a device, a client, and so on. For example, the road hazard data may be merged with a map and provided to a map services client, a navigation client, and so on. An alert may be generated based on the road hazard data to warn of the hazard caused by the object. The alert may include a visual and/or audio representation of the hazard data. The alert may be used to automatically and/or manually avoid the hazard.

Abstract: Entity-wide database asset index generation is provided. An entity-wide database asset index corresponding to an entity is generated identifying all observed database instances across a plurality of database servers by each respective security monitoring system of a plurality of different security monitoring systems corresponding to the entity and one or more linked sets of same database instances observed by more than one security monitoring system of the plurality of different security monitoring systems. Security analytics are performed on the entity-wide database asset index that identifies all of the observed database instances across the plurality of database servers by each respective security monitoring system of the plurality of different security monitoring systems corresponding to the entity and the one or more linked sets of same database instances observed by more than one security monitoring system of the plurality of different security monitoring systems to detect any database security threats.

Abstract: Apparatus, systems, and/or methods may involve reporting a road hazard. Road hazard data may be collected for an object on a road, which may include automatically generated data from a device associated with the object causing a hazard. The road hazard data may be provided to a service, an application, a device, a client, and so on. For example, the road hazard data may be merged with a map and provided to a map services client, a navigation client, and so on. An alert may be generated based on the road hazard data to warn of the hazard caused by the object. The alert may include a visual and/or audio representation of the hazard data. The alert may be used to automatically and/or manually avoid the hazard.

Abstract: Described are techniques for automated labeling of cybersecurity incidents. The techniques include generating a set of labels for a received cybersecurity incident based on features of the received cybersecurity incident. The techniques further include prioritizing the set of labels to generate a subset of labels, and associating the subset of labels to the received cybersecurity incident.

Abstract: Techniques are provided for generating security response recommendations. In one embodiment, the techniques involve receiving scoring functions, a logical operator selection, a security graph, and external threat intelligence, generating a search pattern based on the scoring functions and the logical operator selection, evaluating the search pattern against a selected node of the security graph to identify a potential security threat represented by the security graph at the selected node, and generating a recommendation based on the evaluation and the external threat intelligence.

Abstract: Techniques are provided for generating security response recommendations. In one embodiment, the techniques involve receiving scoring functions, a logical operator selection, a security graph, and external threat intelligence, generating a search pattern based on the scoring functions and the logical operator selection, evaluating the search pattern against a selected node of the security graph to identify a potential security threat represented by the security graph at the selected node, and generating a recommendation based on the evaluation and the external threat intelligence.

Abstract: Described are techniques for automated labeling of cybersecurity incidents. The techniques include generating a set of labels for a received cybersecurity incident based on features of the received cybersecurity incident. The techniques further include prioritizing the set of labels to generate a subset of labels, and associating the subset of labels to the received cybersecurity incident.

Abstract: A method for classifying domains to malware families includes identifying a corpus of malicious domains, identifying one or more suspicious domains, extracting a timeframe corresponding to the one or more suspicious domains, calculating a rank coefficient between the one or more suspicious domains and a current seed domain of the corpus of malicious domains, determining whether the rank correlation coefficient exceeds a rank threshold for the one or more suspicious domains, comparing a number of suspicious domains whose correlation coefficients exceed the rank threshold to a relation threshold, and responsive to determining the number of suspicious domains whose correlation coefficients exceed the rank threshold exceeds the relation threshold, applying a tag to the suspicious domains indicating that the one or more suspicious domains correspond to a same malware family as the current seed domain.

Abstract: Apparatus, systems, and/or methods may involve reporting a road hazard. Road hazard data may be collected for an object on a road, which may include automatically generated data from a device associated with the object causing a hazard. The road hazard data may be provided to a service, an application, a device, a client, and so on. For example, the road hazard data may be merged with a map and provided to a map services client, a navigation client, and so on. An alert may be generated based on the road hazard data to warn of the hazard caused by the object. The alert may include a visual and/or audio representation of the hazard data. The alert may be used to automatically and/or manually avoid the hazard.

Abstract: Apparatus, systems, and/or methods may involve reporting a road hazard. Road hazard data may be collected for an object on a road, which may include automatically generated data from a device associated with the object causing a hazard. The road hazard data may be provided to a service, an application, a device, a client, and so on. For example, the road hazard data may be merged with a map and provided to a map services client, a navigation client, and so on. An alert may be generated based on the road hazard data to warn of the hazard caused by the object. The alert may include a visual and/or audio representation of the hazard data. The alert may be used to automatically and/or manually avoid the hazard.

Abstract: A method for classifying domains to malware families includes identifying a corpus of malicious domains, identifying one or more suspicious domains, extracting a timeframe corresponding to the one or more suspicious domains, calculating a rank coefficient between the one or more suspicious domains and a current seed domain of the corpus of malicious domains, determining whether the rank correlation coefficient exceeds a rank threshold for the one or more suspicious domains, comparing a number of suspicious domains whose correlation coefficients exceed the rank threshold to a relation threshold, and responsive to determining the number of suspicious domains whose correlation coefficients exceed the rank threshold exceeds the relation threshold, applying a tag to the suspicious domains indicating that the one or more suspicious domains correspond to a same malware family as the current seed domain.

Abstract: Apparatus, systems, and/or methods may involve reporting a road hazard. Road hazard data may be collected for an object on a road, which may include automatically generated data from a device associated with the object causing a hazard. The road hazard data may be provided to a service, an application, a device, a client, and so on. For example, the road hazard data may be merged with a map and provided to a map services client, a navigation client, and so on. An alert may be generated based on the road hazard data to warn of the hazard caused by the object. The alert may include a visual and/or audio representation of the hazard data. The alert may be used to automatically and/or manually avoid the hazard.

Abstract: Apparatus, systems, and/or methods may involve reporting a road hazard. Road hazard data may be collected for an object on a road, which may include automatically generated data from a device associated with the object causing a hazard. The road hazard data may be provided to a service, an application, a device, a client, and so on. For example, the road hazard data may be merged with a map and provided to a map services client, a navigation client, and so on. An alert may be generated based on the road hazard data to warn of the hazard caused by the object. The alert may include a visual and/or audio representation of the hazard data. The alert may be used to automatically and/or manually avoid the hazard.

Abstract: An example operation may include one or more of identifying a page of a website for phishing testing, attempting each of a Hypertext Transfer Protocol (HTTP) GET request and a HTTP Secure (HTTPS) GET request via the identified page of the website, attempting each of a HTTP POST request and a HTTPS POST request via the identified page of the website, determining if the website is a phishing website based on server responses to the attempted HTTP and HTTPS GET requests and the attempted HTTP and HTTPS POST requests received from the website, and in response to determining the website is a phishing website, outputting an indication of the determination for display on a display device.

Abstract: A method for producing a list of network domains comprising: producing a graph comprising a plurality of nodes, each associated with one of a plurality of domain names extracted from data captured from a digital communication network, and a plurality of edges, each associated with one or more syntactic correlations, identified in the data, between two of the plurality of domain names, where the one or more syntactic correlations indicate a possible network structure relationship between the two of the plurality of domain names; producing a list of associated domain names according to a plurality of statistical values each assigned to one of the plurality of edges or one of the plurality of nodes according to an amount of respective one or more syntactic correlations; and providing the list of associated domain names to at least one software object to perform a domain-oriented task.

Abstract: A method for producing a list of network domains comprising: producing a graph comprising a plurality of nodes, each associated with one of a plurality of domain names extracted from data captured from a digital communication network, and a plurality of edges, each associated with one or more syntactic correlations, identified in the data, between two of the plurality of domain names, where the one or more syntactic correlations indicate a possible network structure relationship between the two of the plurality of domain names; producing a list of associated domain names according to a plurality of statistical values each assigned to one of the plurality of edges or one of the plurality of nodes according to an amount of respective one or more syntactic correlations; and providing the list of associated domain names to at least one software object to perform a domain-oriented task.

Abstract: Aspects of the present invention disclose a method, computer program product, and system for updating a whitelist. The method includes one or more processors identifying candidates for a whitelist based on correlations between candidates and web domains in the whitelist. The method further includes one or more processors extracting textual information and image information from the whitelist candidates. The method further includes one or more processors classifying the candidates for the whitelist into groups of candidates based on a comparison of the extracted information from the whitelist candidates and information associated with the web domains existing in the whitelist. The method further includes one or more processors determining candidates to add to the whitelist based upon a similarity measure ranking between the web domains existing in the whitelist and the candidates for a whitelist. The method further includes one or more processors updating the whitelist to include the determined candidates.