Abstract: A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple initially mutable containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method also includes designating, by the hardware processor, a particular external command, from among external container commands stored in a database, as having a correspondence to an initial process, responsive to the initial process matching at least one respective process resulting from executing the particular external command.

Abstract: Guided character string alteration can be performed by obtaining an original character string and a plurality of altered character strings, traversing the original character string with a first Long Short Term Memory (LSTM) network to generate, for each character of the original character string, a hidden state of a partial original character string up to that character, and applying, during the traversing, an alteration learning process to each hidden state of a partial original character string to produce an alteration function for relating partial original character strings to partial altered character strings.

Abstract: A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple initially mutable containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method also includes designating, by the hardware processor, a particular external command, from among external container commands stored in a database, as having a correspondence to an initial process, responsive to the initial process matching at least one respective process resulting from executing the particular external command.

Abstract: A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method further includes checking, by the hardware processor, if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands.

Abstract: A computer-implemented method is provided for identifying words likely to be used in new combo-squatted domains of a target domain. The method includes selecting the target domain. The method further includes storing, in a memory device, a sequence of previously detected combo-squatted domains from period [t-W, t-1]. The sequence includes a set of words W. The method also includes obtaining trends associated with the target domain at time t. The method additionally includes obtaining, by a hardware processor responsive to the trends, a trend distribution associated with the target domain at time t. The method further includes ranking, by a likelihood, a set of words E that have been extracted from the trend distribution and are expected to be used in the future in the new combo-squatting domains, responsive to the set of words W.

Abstract: A system is provided for automatically closing a server-rack door. A microphone acquires sound data and an acceleration sensor acquires acceleration data. A controller determines at least one time when a volume of the sound data exceeds a threshold. The controller identifies at least one waveform from the acceleration data which matches (i) an opening waveform or (ii) a closing waveform. The controller checks, for each given waveform from among the at least one waveform, if the at least one time is within a time range of the given waveform and, if so, determine that the user is opening or closing the server-rack door by identifying the given waveform as matching the opening or closing waveform. The controller provides a notification of an open status of the server-rack door based on numbers of opening and closing waveforms. The controller automatically closes the server-rack door, responsive to the notification.

Abstract: A computer-implemented method is provided for identifying words likely to be used in new combo-squatted domains of a target domain. The method includes selecting the target domain. The method further includes storing, in a memory device, a sequence of previously detected combo-squatted domains from period [t-W, t-1]. The sequence includes a set of words W. The method also includes obtaining trends associated with the target domain at time t. The method additionally includes obtaining, by a hardware processor responsive to the trends, a trend distribution associated with the target domain at time t. The method further includes ranking, by a likelihood, a set of words E that have been extracted from the trend distribution and are expected to be used in the future in the new combo-squatting domains, responsive to the set of words W.

Abstract: A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Abstract: A computer-implemented method includes generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system, performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands, and generating a mutation event report based on the comparison.

Abstract: A code dependency influenced bug localization apparatus and method receive bug reports and source code changes of a software program. Each source code change includes a syntax component and a location component. Each bug report includes a functional description of an aspect of the software program. The apparatus and method obtain a vectorized feature representation of each bug report, apply a learning process to the source code changes based on a code dependency among the source code changes, obtain a vectorized feature representation of each source code change based on the code dependency, merge the feature representations of the bug reports and the feature representations of the source code changes into a plurality of unified feature representations, and apply a ranking process to the unified feature representations to produce a source code relating function for relating a bug report and a source code change.

Abstract: A system is provided for automatically closing a server-rack door. A microphone acquires sound data and an acceleration sensor acquires acceleration data. A controller determines at least one time when a volume of the sound data exceeds a threshold. The controller identifies at least one waveform from the acceleration data which matches (i) an opening waveform or (ii) a closing waveform. The controller checks, for each given waveform from among the at least one waveform, if the at least one time is within a time range of the given waveform and, if so, determine that the user is opening or closing the server-rack door by identifying the given waveform as matching the opening or closing waveform. The controller provides a notification of an open status of the server-rack door based on numbers of opening and closing waveforms. The controller automatically closes the server-rack door, responsive to the notification.

Abstract: A computer-implemented method is provided for ensuring a particular service level provided by multiple devices. The method includes maintaining, by a database, complementation parameters for a set of device groups. Each of the device groups includes at least two devices such that one of the two devices can complement at least one functionality of another one of the at least two devices in a same one of the device groups. The method further includes monitoring, by a processor operatively coupled to the database, the devices in the device groups to detect device malfunctions. The method also includes, responsive to a detection of a malfunctioning device from among the device groups, ensuring, by the processor, the particular service level by changing complementation parameters of a corresponding one of the devices paired with the malfunctioning device.

Abstract: A computer-implemented method includes generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system, performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands, and generating a mutation event report based on the comparison.

Abstract: A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method further includes checking, by the hardware processor, if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands.

Abstract: Guided word association based domain name detection may be performed by obtaining an original domain name, constructing a feature space from a corpus of text, wherein each word appearing in the corpus is represented as a vector in the feature space, detecting whether a domain name registration exists for each combination of the original domain name and each of a plurality of seed words from the feature space, determining, for each seed word included in an existing domain name registration, a plurality of nearest neighbor candidate words, based on vector distance in the feature space, and repeating, for one or more repetitions, the detecting and the determining, wherein the plurality of nearest neighbor candidate words are utilized as the plurality of seed words.

Abstract: A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Abstract: Computer systems, computer-implemented methods and computer program products that detect a homographic string against defined strings is disclosed. In one embodiment, a computer-implemented method comprises: preparing, by a device operatively coupled to a processor, a mapping function to map a character into an identifier, the mapping function defining a plurality of groups each comprising two or more characters that resemble one another assigned a same identifier, and wherein the plurality of groups are mutually exclusive; preparing, by the device, a list of identifier sequences obtained from defined strings based on the mapping function; applying, by the device, the mapping function to a queried string to obtain a queried identifier sequence; and determining, by the device, whether the queried string is a homographic string by comparing the queried identifier sequence with the list of the identifier sequences.

Abstract: Operation testing without side effects may be enabled by a method including preparing a copy of a directory set of at least a part of a host system disk, creating a link to a file in a first directory in the host system disk, in a second directory of the copy of the directory set, wherein the second directory corresponds in position to the first directory in the directory set, and starting a non-privileged system using a disk image including the copy of the directory set and the created link.

Abstract: Monitoring a process on an Internet of Things (IoT) device is performed by receiving, by the IoT device, a network data transfer from an external device; and receiving, by the IoT device, meta-information of the network data transfer. The meta-information can be generated, based on the network data transfer, by a network monitoring device. Additionally, the IoT device detects a file storing data of the network data transfer based on the meta-information. Further, the IoT device monitors a process relating to the detected file on the IoT device.

Abstract: Guided character string alteration can be performed by obtaining an original character string and a plurality of altered character strings, traversing the original character string with a first Long Short Term Memory (LSTM) network to generate, for each character of the original character string, a hidden state of a partial original character string up to that character, and applying, during the traversing, an alteration learning process to each hidden state of a partial original character string to produce an alteration function for relating partial original character strings to partial altered character strings.