Abstract: Systems, computer-readable media storing instructions, and methods can infer a state of behavior. Such a method can include constructing a graph including nodes representing hosts and domains based on an event dataset. The graph can be seeded with information external to the event dataset. A belief whether each of the nodes is in a particular state of behavior can be calculated based on marginal probability estimation.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression, and converting the regular expression with capturing groups into a plurality of finite automata to extract submatches. The method further includes using a first automaton to determine whether the input string is in a language described by the regular expression, and to process the input string, and using states of the first automaton in a second automaton to extract the submatches.

Abstract: A method for authenticating a user's location in a femtocell-based network is disclosed. A user is associated to a femtocell connected to a connection point in the wireless network. An indication of the user's location is provided to a remote user. A characteristic of a connection between the femtocell and the connection point is monitored. The monitored characteristic is provided to the remote user to verify user's location.

Abstract: Threat exchange information protection can include receiving security information from a number of participants of a threat exchange community, wherein a portion of the received security information is encoded with pseudonyms by each of the number of participants, analyzing the security information collectively from the number of participants, wherein the portion of the received security information remains encoded, and sending analysis results to each of the number of participants, wherein the analysis results include information relating to the portion.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression, and converting the regular expression with capturing groups into a plurality of finite automata to extract submatches. The method further includes using a first automaton to determine whether the input string is in a language described by the regular expression, and to process the input string, and using states of the first automaton in a second automaton to extract the submatches. In addition, input partitioning and automaton minimization techniques may be employed to reduce the storage area consumed by the plurality of finite automata.

Abstract: In one implementation, a security alert prioritization system identifies a host and a domain associated with a security alert that was generated in response to a communication between the host and the domain. The security alert prioritization system accesses a security state associated with the host and a security state associated with the domain, and compute a priority of the security alert based on the security state associated with the host and the security state associated with the domain.

Abstract: A questionnaire generation process presents a first subset from a set of questions of the questionnaire and receives first answers from a user. The first answers are used to determine whether the first answers are sufficient to give definite values to conditions of first rules, wherein the first rules have conditions for providing output. When the first answers are not sufficient, the conditions of the first rules can be used to identify a second subset of the questions, wherein the second subset of questions has second answers such that a combination of the first and second answers is sufficient to give definite values to the respective conditions of the first rules, and the second subset of questions can be presented to the user.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression, and converting the regular expression with capturing groups into a plurality of finite automata to extract submatches. The method further includes using a first automaton to determine whether the input string is in a language described by the regular expression, and to process the input string, and using states of the first automaton in a second automaton to extract the submatches. In addition, input partitioning and automaton minimization techniques may be employed to reduce the storage area consumed by the plurality of finite automata.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression. The method may further include converting the regular expression with capturing groups into ordered binary decision diagrams (OBDDs) to extract submatches.

Abstract: In one implementation, a physical version of a document is converted to a digital representation of the physical version and a new certificate is computed for the digital representation of the physical version. The new certificate is computed based on the digital representation of the physical version, at least one processing step performed on the digital representation, and a prior certificate computed for a prior digital representation indicative of the physical version. In another implementation, a document is validated.

Abstract: Systems, computer-readable media storing instructions, and methods can infer a state of behavior. Such a method can include constructing a graph including nodes representing hosts and domains based on an event dataset. The graph can be seeded with information external to the event dataset. A belief whether each of the nodes is in a particular state of behavior can be calculated based on marginal probability estimation.

Abstract: A customized security model template is created that is customized for a specific organization's security related procedures. The customized security model template is instantiated with parameters associated with the organization to create an instantiated security model, and a report is produced based on simulations of the instantiated security model that specifies metrics of the organization's security implementation.

Abstract: Policy-based, delegated limited network access management places day-to-day control of network access in the hands of authorized users, referred to as resource access administrators, selected for their business knowledge and ability to respond quickly to business events. Resource access administrators have the ability to respond, in the form of access decisions proposed by individuals with knowledge or, or responsibility for business processes and business partner relationships and shaped and pre-approved by network security specialists, referred to as network access administrators. This approach, therefore, reduces the cost, complexity, and delay (latency) associated with managing external network access without compromising network security.

Abstract: Compliance of a project is assessed by generating a graph including nodes representing attributes of the project, and populating a subset of nodes in the graph with attribute values of the project. A rule applicable to the subset of nodes is identified and applied to determine whether the attribute values comply with the rule.

Abstract: Instances of router models and filter models respectively are populated with configuration data from routers and filters in a network (20). A route advertising graph is derived from the router model instances (21). The route advertising graph indicates propagation of routes between the ones of the real-world devices serving as routers according to routing protocols implemented by the ones of the real-world devices serving as routers. Consolidated routing data is determined for the ones of the real-world devices serving as routers (21). In this process, the propagation of routes indicated by the route advertising graph is iterated to stability. For a destination node in the network, a respective route graph indicating available paths to the destination node from each source node in the network is constructed from the consolidated routing data (22). Services between each source node and the destination node are classified based on a full traversal of the route advertising graph (23).

Abstract: A questionnaire generation process presents a first subset from a set of questions of the questionnaire and receives first answers from a user. The first answers are used to determine whether the first answers are sufficient to give definite values to conditions of first rules, wherein the first rules have conditions for providing output. When the first answers are not sufficient, the conditions of the first rules can be used to identify a second subset of the questions, wherein the second subset of questions has second answers such that a combination of the first and second answers is sufficient to give definite values to the respective conditions of the first rules, and the second subset of questions can be presented to the user.

Abstract: Policy-based, delegated limited network access management places day-to-day control of network access in the hands of authorized users, referred to as resource access administrators, selected for their business knowledge and ability to respond quickly to business events. Resource access administrators have the ability to respond, in the form of access decisions proposed by individuals with knowledge or, or responsibility for business processes and business partner relationships and shaped and pre-approved by network security specialists, referred to as network access administrators. This approach, therefore, reduces the cost, complexity, and delay (latency) associated with managing external network access without compromising network security.