Abstract: According to an example, domain name and IP address approved and disapproved membership inference may include receiving domain names and IP addresses, and mapping the domain names to the IP addresses. Domain names that belong to an approved domain name list or to a disapproved domain name list may be identified. IP addresses that belong to an approved IP address list or to a disapproved IP address list may be identified. For an unknown IP address and domain names that map to the unknown IP address, a determination is made as to whether more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list. Based on the determination, the unknown IP address may be designated as approved and assigned to the approved IP address list, or alternatively, designated as disapproved and assigned to the disapproved IP address list.

Abstract: In one implementation, a resource classification system identifies a plurality of resource requests and generates a plurality of resource access measures based on the plurality of resource requests. Each resource request from the plurality of resource requests is associated with a resource from a plurality of resources by a resource identifier of that resource. Each resource access measure from the plurality of resource access measures is associated with a resource from the plurality of resources. The resource classification system applies a classifier to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure, and assign a security classification to each resource from the plurality of resources based on the classification result for that resource.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression. The method may further include converting the regular expression with capturing groups into ordered binary decision diagrams (OBDDs) to extract submatches.

Abstract: A method for authenticating a user's location in a femtocell-based network is disclosed. A user is associated to a femtocell connected to a connection point in the wireless network. An indication of the user's location is provided to a remote user. A characteristic of a connection between the femtocell and the connection point is monitored. The monitored characteristic is provided to the remote user to verify user's location.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression, and converting the regular expression with capturing groups into a plurality of finite automata to extract submatches. The method further includes using a first automaton to determine whether the input string is in a language described by the regular expression, and to process the input string, and using states of the first automaton in a second automaton to extract the submatches.

Abstract: In one implementation, a security alert prioritization system identifies a host and a domain associated with a security alert that was generated in response to a communication between the host and the domain. The security alert prioritization system accesses a security state associated with the host and a security state associated with the domain, and compute a priority of the security alert based on the security state associated with the host and the security state associated with the domain.

Abstract: An authentication server and corresponding method to authenticate a location of a mobile device at a location system are disclosed. The authentication server includes a data transfer controller to initiate data transfer between the mobile device and the authentication server in response to an indication of communicative coupling of the mobile device to a network via a small cell associated with the location system. The authentication server also includes a network activity monitor to access a location server associated with the location system in response to the indication of the communicative coupling and to monitor an indication of network activity associated with the small cell provided by the location server to authenticate the location of the mobile device at the location system.

Abstract: Systems, computer-readable media storing instructions, and methods can infer a state of behavior. Such a method can include constructing a graph including nodes representing hosts and domains based on an event dataset. The graph can be seeded with information external to the event dataset. A belief whether each of the nodes is in a particular state of behavior can be calculated based on marginal probability estimation.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression, and converting the regular expression with capturing groups into a plurality of finite automata to extract submatches. The method further includes using a first automaton to determine whether the input string is in a language described by the regular expression, and to process the input string, and using states of the first automaton in a second automaton to extract the submatches.

Abstract: A method for authenticating a user's location in a femtocell-based network is disclosed. A user is associated to a femtocell connected to a connection point in the wireless network. An indication of the user's location is provided to a remote user. A characteristic of a connection between the femtocell and the connection point is monitored. The monitored characteristic is provided to the remote user to verify user's location.

Abstract: In one implementation, a security alert prioritization system identifies a host and a domain associated with a security alert that was generated in response to a communication between the host and the domain. The security alert prioritization system accesses a security state associated with the host and a security state associated with the domain, and compute a priority of the security alert based on the security state associated with the host and the security state associated with the domain.

Abstract: An authentication server and corresponding method to authenticate a location of a mobile device at a location system are disclosed. The authentication server includes a data transfer controller to initiate data transfer between the mobile device and the authentication server in response to an indication of communicative coupling of the mobile device to a network via a small cell associated with the location system. The authentication server also includes a network activity monitor to access a location server associated with the location system in response to the indication of the communicative coupling and to monitor an indication of network activity associated with the small cell provided by the location server to authenticate the location of the mobile device at the location system.

Abstract: A method for submatch extraction may include receiving an input string, receiving a regular expression. The method may further include converting the regular expression with capturing groups into ordered binary decision diagrams (OBDDs) to extract submatches.

Abstract: Methods, systems, and computer-readable and executable instructions are provided for assigning an advertisement. Assigning an advertisement can include constructing a graph of events between a number of visitors and a number of domains, iteratively calculating a set of domain scores for the advertisement using a spreading function on the graph, and assigning the advertisement to a domain based on a domain score of the domain, wherein the domain score is among the set of domain scores.

Abstract: Systems, computer-readable media storing instructions, and methods can infer a state of behavior. Such a method can include constructing a graph including nodes representing hosts and domains based on an event dataset. The graph can be seeded with information external to the event dataset. A belief whether each of the nodes is in a particular state of behavior can be calculated based on marginal probability estimation.

Abstract: A uniformity of a cluster of samples is determined, and a corresponding raw confidence value is calculated. A confidence interval weight is calculated using a confidence interval to determine reliability of the uniformity. A trace length weight is calculated, as a function of traces of the samples. An n-gram weight is calculated, as a function of numbers of n-grams generated by the samples. A compactness weight is calculated, as a function of the similarity of the samples. A cluster weight is calculated as a function of the four above-described weights. A cluster confidence measurement is calculated as a function of the cluster weight and the raw confidence value. When a new sample is assigned to the cluster, an assignment confidence measurement is calculated, as a function of the cluster's confidence measurement and the sample's trace length, n-grams and similarity.