Abstract: One embodiment relates to an apparatus for in-the-cloud identification of spam and/or malware. The apparatus includes computer-readable code configured to be executed by the processor so as to receive queries, the queries including hash values embedded therein. The apparatus further includes computer-readable code configured to be executed by the processor so as to detect a group of hash codes which are similar and to identify the group as corresponding to an undesirable network outbreak. Another embodiment relates to an apparatus for in-the-cloud detection of spam and/or malware. The apparatus includes computer-readable code configured to be executed by the processor so as to receive an electronic message, calculate a locality-sensitive hash based on the message, embed the locality-sensitive hash into a query, and send the query to a central analysis system via a network interface. Other embodiments, aspects and features are also disclosed.

Abstract: Network system provides a real-time adaptive recommendation set of documents with a high statistical measure of relevancy to the requestor device. The recommendation set is optimized based on analyzing text of documents of the interest set, categorizing these documents into clusters, extracting keywords representing the themes or concepts of documents in the clusters, and filtering a population of eligible documents accessible to the system utilizing site and or Internet-wide search engines. The system is either automatically or manually invoked and it develops and presents the recommendation set in real-time. The recommendation set may be presented as a greeting, notification, alert, HTML fragment, fax, voicemail, or automatic classification or routing of customer e-mail, personal e-mail, job postings, and offers for sale or exchange.

Abstract: One embodiment relates to an apparatus for remote classification of malware. Computer-readable code is configured to be executed by the processor so as to receive a locality-sensitive hash (LSH) value associated with a file from a host computer via the network interface, determine whether the LSH value associated with the file is similar to a LSH value in an entry in an LSH data structure, and indicate that the file is a variant of known malware associated with the entry if the LSH value associated with the file is similar to the LSH value in the entry. Another embodiment relates to a method for remote classification of malware. Another embodiment relates to an apparatus configured to determine whether a file includes malware. Another embodiment relates to a method for detecting malware within an institutional network. Other embodiments, aspects and features are also disclosed.

Abstract: Network system provides a real-time adaptive recommendation set of documents with a high statistical measure of relevancy to the requestor device. The recommendation set is optimized based on analyzing the text of documents of the interest set, categorizing these documents into clusters, extracting keywords representing the themes or concepts of documents in the clusters, and filtering a population of eligible documents accessible to the system utilizing site and or Internet-wide search engines. The system is either automatically or manually invoked and it develops and presents the recommendation set in real-time; for example, upon logging onto a web site or as the client views additional documents or pages of a website. The recommendation set may be presented as a greeting, notification, alert, HTML fragment, fax, voicemail, or automatic classification or routing of customer e-mail, personal e-mail, job postings, and offers for sale or exchange.

Abstract: Botnet attacks may be detected by collecting samples of spam messages, forming clusters of related spam messages, and identifying the source or sources of the related spam messages. The related spam messages may be identified as those generated using the same template. For example, spam messages generated using the same image template, text template, or both may be deemed as related. To find related spam messages, images of spam messages may be extracted and compressed using a lossy compression algorithm. The compressed images may then be compared to one another to identify those generated using the same image template. The lossy compression algorithm may involve dividing an image into several blocks and then computing a value for each block for comparison.

Abstract: A training model for malware detection is developed using common substrings extracted from known malware samples. The probability of each substring occurring within a malware family is determined and a decision tree is constructed using the substrings. An enterprise server receives indications from client machines that a particular file is suspected of being malware. The suspect file is retrieved and the decision tree is walked using the suspect file. A leaf node is reached that identifies a particular common substring, a byte offset within the suspect file at which it is likely that the common substring begins, and a probability distribution that the common substring appears in a number of malware families. A hash value of the common substring is compared (exact or approximate) against the corresponding substring in the suspect file. If positive, a result is returned to the enterprise server indicating the probability that the suspect file is a member of a particular malware family.

Abstract: A method for matching an image-form textual string in an image to a regular expression is disclosed. The method includes constructing a representation of the regular expression and generating a candidate string of characters from the image-form textual string. The method further includes ascertaining whether there exists a match between the image-form textual string and the regular expression, the match is deemed achieved if a probability value associated with the match is above a predetermined matching threshold.

Abstract: An adversarial approach in detecting inappropriate text content in images. An expression from a listing of expressions may be selected. The listing of expressions may include words, phrases, or other textual content indicative of a particular type of message. Using the selected expression as a reference, the image is searched for a section that could be similar to the selected expression. The similarity between the selected expression and the section of the image may be in terms of shape. The section may be scored against the selected expression to determine how well the selected expression matches the section. The score may be used to determine whether or not the selected expression is present in the image.

Abstract: A pure adversarial optical character recognition (OCR) approach in identifying text content in images. An image and a search term are input to a pure adversarial OCR module, which searches the image for presence of the search term. The image may be extracted from an email by an email processing engine. The OCR module may split the image into several character-blocks that each has a reasonable probability of containing a character (e.g., an ASCII character). The OCR module may form a sequence of blocks that represent a candidate match to the search term and calculate the similarity of the candidate sequence to the search term. The OCR module may be configured to output whether or not the search term is found in the image and, if applicable, the location of the search term in the image.

Abstract: The invention relates generally to methods, systems, and devices for measuring the concentration of target analytes present in a biological system using a series of measurements obtained from a monitoring system and a Mixtures of Experts (MOE) algorithm. In one embodiment, the present invention describes a method for measuring blood glucose in a subject.

Abstract: A method for detecting indicators of misleading content in a markup language coded document is provided. The method includes extracting a set of tags from the markup language coded document. The method also includes combining tags to create a tag structure signature. The tag structure signature is configured to include a set of n-grams. Each of the set of n-grams includes at least two tags from the set of tags. The method further includes comparing the tag structure signature against a set of known bad tag structure signatures to determine similarity.

Abstract: A method for matching an image-form textual string in an image to a regular expression is disclosed. The method includes constructing a representation of the regular expression and generating a candidate string of characters from the image-form textual string. The method further includes ascertaining whether there exists a match between the image-form textual string and the regular expression, the match is deemed achieved if a probability value associated with the match is above a predetermined matching threshold.

Abstract: Network system provides a real-time adaptive recommendation set of documents with a high statistical measure of relevancy to the requestor device. The recommendation set is optimized based on analyzing the text of documents of the interest set, categorizing these documents into clusters, extracting keywords representing the themes or concepts of documents in the clusters, and filtering a population of eligible documents accessible to the system utilizing site and or Internet-wide search engines. The system is either automatically or manually invoked and it develops and presents the recommendation set in real-time; for example, upon logging onto a web site or as the client views additional documents or pages of a website. The recommendation set may be presented as a greeting, notification, alert, HTML fragment, fax, voicemail, or automatic classification or routing of customer e-mail, personal e-mail, job postings, and offers for sale or exchange.

Abstract: The invention relates generally to methods, systems, and devices for measuring the concentration of target analytes present in a biological system using a series of measurements obtained from a monitoring system and a Mixtures of Experts (MOE) algorithm. In one embodiment, the present invention describes a method for measuring blood glucose in a subject.

Abstract: The invention relates generally to methods, systems, and devices for measuring the concentration of target analytes present in a biological system using a series of measurements obtained from a monitoring system and a Mixtures of Experts (MOE) algorithm. In one embodiment, the present invention describes a method for measuring blood glucose in a subject.

Abstract: The invention relates generally to methods, systems, and devices for measuring the concentration of target analytes present in a biological system using a series of measurements obtained from a monitoring system and a Mixtures of Experts (MOE) algorithm. In one embodiment, the present invention describes a method for measuring blood glucose in a subject.

Abstract: The invention relates generally to methods, systems, and devices for measuring the concentration of target analytes present in a biological system using a series of measurements obtained from a monitoring system and a Mixtures of Experts (MOE) algorithm. In one embodiment, the present invention describes a method for measuring blood glucose in a subject.

Abstract: Network system provides a real-time adaptive recommendation set of documents with a high statistical measure of relevancy to the requestor device. The recommendation set is optimized based on analyzing text of documents of the interest set, categorizing these documents into clusters, extracting keywords representing the themes or concepts of documents in the clusters, and filtering a population of eligible documents accessible to the system utilizing site and or Internet-wide search engines. The system is either automatically or manually invoked and it develops and presents the recommendation set in real-time. The recommendation set may be presented as a greeting, notification, alert, HTML fragment, fax, voicemail, or automatic classification or routing of customer e-mail, personal e-mail, job postings, and offers for sale or exchange.

Abstract: The invention relates generally to methods, systems, and devices for measuring the concentration of target analytes present in a biological system using a series of measurements obtained from a monitoring system and a Mixtures of Experts (MOE) algorithm. In one embodiment, the present invention describes a method for measuring blood glucose in a subject.

Abstract: A method for designating a given image as similar/dissimilar with respect to a reference image is provided. The method includes normalizing the image. Normalizing includes performing pre-processing and a lossy compression on the given image to obtain a lossy representation. The pre-processing includes at least one of cropping, fundamental extracting, gray scale converting and lower color bit converting. The method also includes comparing the lossy representation of the given image with a reference representation, which is a version of a reference spam image after the reference spam image has undergone a similar normalizing process as normalizing. The method further includes, if the lossy representation of the given image matches the reference representation, designating the given image similar to the reference image. The method yet also includes, if the lossy representation of the given image does not match the reference representation, designating the given image dissimilar to the reference image.