Abstract: Systems and methods for organizing data of different local data schemas based on similarity rankings, scoring, and signatures are disclosed. According to an aspect, a system for identifying linkages among entities. The system also includes an entity linkage manager configured to analyze a concept for data schemas to determine similarity scores for entities of local data schemas with respect to entities of a global data schema. The entity linkage manager is also configured to map the entities of the local data schemas to the entities of the global data schema based on the determined similarity scores. Further, the entity linkage manager is configured to associate data within the at least one database based on the mapping for use in accessing related data.

Abstract: Systems and methods for organizing data of different local data schemas based on similarity rankings, scoring, and signatures are disclosed. According to an aspect, a system for identifying linkages among entities. The system also includes an entity linkage manager configured to analyze a concept for data schemas to determine similarity scores for entities of local data schemas with respect to entities of a global data schema. The entity linkage manager is also configured to map the entities of the local data schemas to the entities of the global data schema based on the determined similarity scores. Further, the entity linkage manager is configured to associate data within the at least one database based on the mapping for use in accessing related data.

Abstract: This invention is a computer-implemented method and system of using a secondary classification algorithm after using a primary source code vulnerability scanning tool to more accurately label true and false vulnerabilities in source code. The method and system use machine learning within a 10% dataset to develop a classifier model algorithm. A selection process identifies the most important features utilized in the algorithm to detect and distinguish the true and false positive findings of the static code analysis results. A personal identifier is used as a critical feature for the classification. The model is validated by experimentation and comparison against thirteen existing classifiers.

Abstract: The invention described herein is directed to methods and systems for protecting network trace data. Network traces are used for network management, packet classification, traffic engineering, tracking user behavior, identifying user behavior, analyzing network hierarchy, maintaining network security, and classifying packet flows. In some embodiments, network trace data is protected by subjecting network trace data to data anonymization using an anonymization algorithm that simultaneously provides sufficient privacy to accommodate the organization need of the network trace data owner, provides acceptable data utility to accommodate management and/or network investigative needs, and provides efficient data analysis, at the same time.

Abstract: The invention described herein is directed to methods and systems for protecting network trace data. Network traces are used for network management, packet classification, traffic engineering, tracking user behavior, identifying user behavior, analyzing network hierarchy, maintaining network security, and classifying packet flows. In some embodiments, network trace data is protected by subjecting network trace data to data anonymization using an anonymization algorithm that simultaneously provides sufficient privacy to accommodate the organization need of the network trace data owner, provides acceptable data utility to accommodate management and/or network investigative needs, and provides efficient data analysis, at the same time.

Abstract: This invention is a computer-implemented method and system of using a secondary classification algorithm after using a primary source code vulnerability scanning tool to more accurately label true and false vulnerabilities in source code. The method and system use machine learning within a 10% dataset to develop a classifier model algorithm. A selection process identifies the most important features utilized in the algorithm to detect and distinguish the true and false positive findings of the static code analysis results. A personal identifier is used as a critical feature for the classification. The model is validated by experimentation and comparison against thirteen existing classifiers.

Abstract: A flow-based detection system and method for detection of cyber-attacks is provided that utilizes contextual information to provide improved detection accuracy over existing flow-based systems. Contextual information is utilized to semantically reveal cyber-attacks from IP flows. Time, location, and other contextual information mined from network flow data is utilized to create semantic links among alerts raised in response to suspicious IP flows. The semantic links are identified through an inference process on probabilistic semantic link networks. The resulting links are used at run-time to retrieve relevant suspicious activities that represent a possible attack or possible steps in multi-step attacks.