Abstract: Methods, systems, and techniques for producing and using enhanced machine learning models and computer-implemented tools to investigate cybersecurity related data and threat intelligence data are provided. Example embodiments provide an Enhanced Predictive Security System, for building, deploying, and managing applications for evaluating threat intelligence data that can predict malicious domains associated with bad actors before the domains are known to be malicious. In one example, the EPSS comprises one or more components that work together to provide an architecture and a framework for building and deploying cybersecurity threat analysis application, including machine learning algorithms, feature class engines, tuning systems, ensemble classifier engines, and validation and testing engines.

Abstract: Methods, systems, and techniques for producing and using enhanced machine learning models and computer-implemented tools to investigate cybersecurity related data and threat intelligence data are provided. Example embodiments provide an Enhanced Predictive Security System, for building, deploying, and managing applications for evaluating threat intelligence data that can predict malicious domains associated with bad actors before the domains are known to be malicious. In one example, the EPSS comprises one or more components that work together to provide an architecture and a framework for building and deploying cybersecurity threat analysis application, including machine learning algorithms, feature class engines, tuning systems, ensemble classifier engines, and validation and testing engines.

Abstract: Methods, systems, and techniques for producing and using enhanced machine learning models and computer-implemented tools to investigate cybersecurity related data and threat intelligence data are provided. Example embodiments provide an Enhanced Predictive Security System, for building, deploying, and managing applications for evaluating threat intelligence data that can predict malicious domains associated with bad actors before the domains are known to be malicious. In one example, the EPSS comprises one or more components that work together to provide an architecture and a framework for building and deploying cybersecurity threat analysis application, including machine learning algorithms, feature class engines, tuning systems, ensemble classifier engines, and validation and testing engines.

Abstract: A computer-implemented system and method for providing classification suggestions via concept injection is provided. Clusters of uncoded concepts are accessed. Each uncoded concept represents one or more documents including that concept. One or more uncoded concepts in one of the clusters is compared to a set of reference concepts. Each reference concept is associated with a classification code. One or more of the reference concepts most similar to the one or more uncoded concepts is placed into the cluster. A neighborhood is generated for one of the uncoded concepts in the cluster. The neighborhood includes at least one of the reference concepts placed in the cluster. One of the classification codes representative of the neighborhood of reference concepts is determined and provided as a suggestion for classification of the uncoded concept.

Abstract: A system and method for displaying relationships between concepts to provide classification suggestions via injection is provided. A reference set of concepts each associated with a classification code is designated. Clusters of uncoded concepts are designated. One or more of the uncoded concepts from at least one cluster are compared to the reference set. At least one of the concepts in the reference set that is similar to the one or more uncoded concepts is identified. The similar concepts are injected into the at least one cluster. Relationships between the uncoded concepts and the similar concepts in the at least one cluster are visually depicted as suggestions for classifying the uncoded concepts.

Abstract: A computer-implemented system and method for providing visual classification suggestions for inclusion-based concept clusters are provided. Reference concepts each associated with a classification code are designated. One or more of the reference concepts are grouped with a plurality of uncoded concepts into a grouped concept set. Clusters are generated, each including a portion of the uncoded concepts and the reference concepts of the grouped concept set. A visual suggestion for assigning one of the classification codes to one of the clusters including visually representing each of the reference concepts in that cluster is provided.

Abstract: A computer-implemented system and method for providing concept classification suggestions based on concept similarity are provided. One or more uncoded concepts and a plurality of reference concepts, each reference concept associated with a classification code, are obtained. At least one of the uncoded concepts is compared to the reference concepts and reference concepts similar to the at least one uncoded concept are identified based on the comparison. One of the classification codes is suggested for the at least one uncoded concept, which includes providing a number of the classification codes associated with the similar reference concepts and a number of the similar reference concepts for each of the classification codes.

Abstract: A system and for displaying relationships between concepts to provide classification suggestions via inclusion is provided. A set of reference concepts each associated with a classification code is designated. One or more of the reference concepts are combined with a set of uncoded concepts. Clusters of the uncoded concepts and the one or more reference concepts are generated. Relationships between the uncoded concepts and the one or more reference concepts in at least one cluster are visually depicted as suggestions for classifying the uncoded concepts in that cluster.

Abstract: A system and method for displaying relationships between concepts to provide classification suggestions via nearest neighbor is provided. Reference concepts previously classified and a set of uncoded concepts are provided. At least one uncoded concept is compared with the reference concepts. One or more of the reference concepts that are similar to the at least one uncoded concept are identified. Relationships between the at least one uncoded concept and the similar reference concept are depicted on a display for classifying the at least one uncoded concept.

Abstract: A system and for displaying relationships between concepts to provide classification suggestions via inclusion is provided. A set of reference concepts each associated with a classification code is designated. One or more of the reference concepts are combined with a set of uncoded concepts. Clusters of the uncoded concepts and the one or more reference concepts are generated. Relationships between the uncoded concepts and the one or more reference concepts in at least one cluster are visually depicted as suggestions for classifying the uncoded concepts in that cluster.

Abstract: A system and method for displaying relationships between concepts to provide classification suggestions via nearest neighbor is provided. Reference concepts previously classified and a set of uncoded concepts are provided. At least one uncoded concept is compared with the reference concepts. One or more of the reference concepts that are similar to the at least one uncoded concept are identified. Relationships between the at least one uncoded concept and the similar reference concept are depicted on a display for classifying the at least one uncoded concept.

Abstract: A system and method for displaying relationships between concepts to provide classification suggestions via injection is provided. A reference set of concepts each associated with a classification code is designated. Clusters of uncoded concepts are designated. One or more of the uncoded concepts from at least one cluster are compared to the reference set. At least one of the concepts in the reference set that is similar to the one or more uncoded concepts is identified. The similar concepts are injected into the at least one cluster. Relationships between the uncoded concepts and the similar concepts in the at least one cluster are visually depicted as suggestions for classifying the uncoded concepts.