Abstract: Systems, methods, and software can be used to cluster software codes in a scalable manner. In some aspects, a computer-implemented method comprises: obtaining a plurality of software samples; computing one or more first hash results for each of the plurality of software samples; computing one or more second hash results for each of the plurality of software samples based on the one or more first hash results, wherein an amount of the one or more second hash results is less than an amount of the one or more first hash results; determining a similarity output based on the one or more second hash results of two of the plurality of software samples; and clustering the plurality of software samples based on the similarity output to generate one or more software sample clusters.

Abstract: Methods and systems for training a neural network. In a first stage of training, a coarse machine learning one-class classifier is trained using a first training set including a signal and noise and a noise machine learning one-class classifier is trained using a second training set excluding the signal. An assembly of models including the noise machine learning one-class classifier and the coarse machine learning one-class classifier is applied to the first training set to create a third training set representing the signal for a second stage of training. A final machine learning one-class classifier is trained in the second stage of training using the third training set representing the signal.

Abstract: Methods and systems for fingerprinting a malicious behavior. In a first stage of training, a coarse machine learning one-class classifier is trained to detect a first dataset of events, the first dataset of events including a dataset of events representing a malicious behavior and a dataset of events representing non-malicious behavior and a benign machine learning one-class classifier is trained to detect a second dataset of events, the second dataset of events excluding the dataset of events representing malicious activity. An ensemble of models including the benign and coarse machine learning one-class classifiers is applied to the first dataset of events to create a third training set representing the malicious behavior for a second stage of training. A final machine learning one-class classifier is trained in the second stage of training using the third training set. The final machine learning one-class classifier represents a fingerprint of the malicious behavior.

Abstract: Systems, methods, and software can be used to cluster software codes in a scalable manner. In some aspects, a computer-implemented method comprises: obtaining a plurality of software samples; computing one or more first hash results for each of the plurality of software samples; computing one or more second hash results for each of the plurality of software samples based on the one or more first hash results, wherein an amount of the one or more second hash results is less than an amount of the one or more first hash results; determining a similarity output based on the one or more second hash results of two of the plurality of software samples; and clustering the plurality of software samples based on the similarity output to generate one or more software sample clusters.

Abstract: A system, method, and computer program product are provided for conditionally preventing the transfer of data. In use, a request to transfer data is identified. In addition, a location of the data is determined. Further, the transfer of the data is conditionally prevented based on the location.

Abstract: A system, method, and computer program product are provided for conditionally preventing the transfer of data. In use, a request to transfer data is identified. In addition, a location of the data is determined. Further, the transfer of the data is conditionally prevented based on the location.

Abstract: A system, method, and computer program product are provided for determining a hop count between network devices utilizing a binary search. In use, a hop count range is identified based on a maximum hop count value. Furthermore, a plurality of packets are sent from a source device to a destination device for determining a hop count between the source device and the destination device, each of the packets having a different hop count threshold configured based on a binary search applied to the hop count range.