Abstract: Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.

Abstract: Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.

Abstract: Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.

Abstract: Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.

Abstract: A system is disclosed for obtaining and aggregating opinions generated by multiple sources with respect to one or more objects. The disclosed system uses observed variables associated with an opinion and a probabilistic model to estimate latent properties of that opinion. With those latent properties, the disclosed system may enable publishers to reliably and comprehensively present object information to interested users.

Abstract: Methods and systems are provided that may be utilized to extract hyper-local event information from one or more web pages.

Abstract: Methods, systems and computer readable mediums are provided for indexing network resources. One method includes accessing, using one or more computer systems, a data store of menu items. The method further includes accessing identification information associated with one or more food providers from one or more data sources. One or more network resources are crawled based on the identification information to search for one or more menu items in the data store of menu items associated with corresponding ones of the food providers. Using the one or more computing systems, an index feed is generated, the index feed comprising the identification information of one or more of the food providers, and one or more menu items associated with the identification information of corresponding food providers based on the crawl and search.

Abstract: A classifier development process seamlessly and intelligently integrates different forms of human feedback on instances and features into the data preparation, learning and evaluation stages. A query utility based active learning approach is applicable to different types of editorial feedback. A bi-clustering based technique may be used to further speed up the active learning process.

Abstract: Techniques are provided for the efficient location, processing, and retrieval of local product information derived from web pages generally locatable through form queries submitted to web pages often referred to as the “deep” or “hidden” web. In an embodiment, information such as product information and dealer-location information is located on a web page form such as a dealer-locator form. After location of a suitable web page form, editorial wrapping is performed to create an automated information extraction process. Using the automated information extractor, deep-web crawling is performed. A grid-based extraction of individual business records is performed, and matching and ingestion are performed in conjunction with a business listing database. Finally, metadata tags are added to entries in the business listing database. Metadata tags also may be added to entries in other databases.

Abstract: An improved system and method for generating a maximum utility slate of advertisements for online advertisement auctions is provided. Various utility factors for each advertisement that may be a candidate in a slate of advertisements may be applied within a framework in order to generate a maximum utility slate of advertisements. Either backward or forward dynamic programming may be applied to recursively evaluate the utility of subslates of advertisements in order to generate a maximum utility slate of advertisements. In an embodiment, a network with directed edges and associated costs may be defined, and the longest path may be found in the directed network for constructing a maximum utility slate of advertisements. Various utility factors may be applied for different objectives of an auctioneer and the framework presented may be extended for revenue ordering, exclusion of bidders, ordering slates according to first and second price utilities, and so forth.

Abstract: Methods and apparatus for performing computer-implemented extraction of temporal information for business entities and events are disclosed. In one embodiment, a sequence of text is obtained. A label is assigned to one or more of a plurality of segments of the text such that each of the one or more of the plurality of segments of the text is classified as temporal data in one of a plurality of classes of temporal data. One or more rules are applied to the one or more segments of the text that have been classified as temporal data to generate a structured representation of the temporal data, where the rules include one or more schematic rules. Each of the schematic rules pertains to one or more of the plurality of classes of temporal data and indicates a structure in which temporal data in the corresponding one or more of the plurality of classes is to be stored.

Abstract: In one embodiment, training a ranking model comprises: accessing the ranking model and an objective function of the ranking model; accessing one or more preference pairs of objects, wherein for each of the preference pairs of objects comprising a first object and a second object, there is a preference between the first object and the second object with respect to the particular reference, and the first object and the second object each has a feature vector comprising one or more feature values; and training the ranking model by minimizing the objective function using the preference pairs of objects, wherein for each of the preference pairs of objects, a difference between the first feature vector of the first object and the second feature vector of the second object is not calculated.

Abstract: The present invention provides methods and systems for binary classification of items. Methods and systems are provided for constructing a machine learning-based and pairwise ranking method-based classification model for binary classification of items as positive or negative with regard to a single class, based on training using a training set of examples including positive examples and unlabelled examples. The model includes only one hyperparameter and only one threshold parameter, which are selected to optimize the model with regard to constraining positive items to be classified as positive while minimizing a number of unlabelled items classified as positive.

Abstract: Methods and apparatus for performing computer-implemented extraction of temporal information for business entities and events are disclosed. In one embodiment, a sequence of text is obtained. A label is assigned to one or more of a plurality of segments of the text such that each of the one or more of the plurality of segments of the text is classified as temporal data in one of a plurality of classes of temporal data. One or more rules are applied to the one or more segments of the text that have been classified as temporal data to generate a structured representation of the temporal data, where the rules include one or more schematic rules. Each of the schematic rules pertains to one or more of the plurality of classes of temporal data and indicates a structure in which temporal data in the corresponding one or more of the plurality of classes is to be stored.

Abstract: Methods, systems and computer readable mediums are provided for indexing network resources. One method includes accessing, using one or more computer systems, a data store of menu items. The method further includes accessing identification information associated with one or more food providers from one or more data sources. One or more network resources are crawled based on the identification information to search for one or more menu items in the data store of menu items associated with corresponding ones of the food providers. Using the one or more computing systems, an index feed is generated, the index feed comprising the identification information of one or more of the food providers, and one or more menu items associated with the identification information of corresponding food providers based on the crawl and search.

Abstract: A system is disclosed for obtaining and aggregating opinions generated by multiple sources with respect to one or more objects. The disclosed system uses observed variables associated with an opinion and a probabilistic model to estimate latent properties of that opinion. With those latent properties, the disclosed system may enable publishers to reliably and comprehensively present object information to interested users.

Abstract: Generally, the present invention provides a method and computerized system for generating a classifier model, wherein the classifier model is operative to classify web content. The method and computerized system includes a first step of defining a plurality of predictive performance measures based on a leave one out (LOO) cross validation in terms of selectable model parameters. Exemplary predictive performance measures includes smoothened predictive measures such as F-measure, weighted error rate measure, area under curve measure, by way of example. The method and computerized system further includes deriving efficient analytical expressions for predictive performance measures to compute the LOO predictive performance and their derivatives. The next step is thereupon selecting a classifier model based on the LOO predictive performance.

Abstract: A method for identifying a brand name is described herein. The method involves obtaining category keywords associated with a category, designating a subgroup of the category keywords as brand name keywords for a particular brand name, receiving a search term, determining that the search term is a brand name keyword, and identifying the particular brand name corresponding to the brand name keyword.

Abstract: The present invention provides methods and systems for binary classification of items. Methods and systems are provided for constructing a machine learning-based and pairwise ranking method-based classification model for binary classification of items as positive or negative with regard to a single class, based on training using a training set of examples including positive examples and unlabelled examples. The model includes only one hyperparameter and only one threshold parameter, which are selected to optimize the model with regard to constraining positive items to be classified as positive while minimizing a number of unlabelled items classified as positive.

Abstract: Techniques are provided for the efficient location, processing, and retrieval of local product information derived from web pages generally locatable through form queries submitted to web pages often referred to as the “deep” or “hidden” web. In an embodiment, information such as product information and dealer-location information is located on a web page form such as a dealer-locator form. After location of a suitable web page form, editorial wrapping is performed to create an automated information extraction process. Using the automated information extractor, deep-web crawling is performed. A grid-based extraction of individual business records is performed, and matching and ingestion are performed in conjunction with a business listing database. Finally, metadata tags are added to entries in the business listing database. Metadata tags also may be added to entries in other databases.