Abstract: A copy of a model comprising a plurality of trees is received, as is a copy of training set data comprising a plurality of training set examples. For each tree included in the plurality of trees, the training set data is used to determine which training set examples are classified as a given leaf. A blame forest is generated at least in part by mapping each training set item to the respective leaves at which it arrives.

Abstract: An inline and offline machine learning pipeline for detection of phishing attacks with a holistic, easily upgradeable framework is presented herein. A packet analyzer records capture logs of network traffic between an endpoint device and a firewall. A parser extracts inputs from the capture logs inline that it communicates to one of an inline model and an offline model for phishing detection. The inline model and offline model are neural networks with parallelizable network architectures that do not depend on handcrafted inputs. The inline model operates inline with the packet analyzer and parser and makes fast phishing attack classifications based on inputs generated from capture logs. The offline model uses additional inputs such as inputs generated from network logs to make phishing attack classifications.

Abstract: Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.

Abstract: Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.

Abstract: A copy of a model comprising a plurality of trees is received, as is a copy of training set data comprising a plurality of training set examples. For each tree included in the plurality of trees, the training set data is used to determine which training set examples are classified as a given leaf. A blame forest is generated at least in part by mapping each training set item to the respective leaves at which it arrives.

Abstract: An identification of an item that was misclassified by a classification model constructed in accordance with a machine learning technique is received. One example of such a machine learning technique is a random forest. A subset of training data, previously used to construct the model, and that is associated with the misclassified item is identified. At least a portion of the identified subset is provided as output.

Abstract: A website misclassification report is received, indicating that a website has been misclassified. A determination is made that a current classification model correctly classifies the reported website. The current classification model is different from a model that was previously used to classify the website. In response to a determination that the reported website should be reclassified using the current classification model, a reclassification operation is performed, using the current classification model, on a set of websites determined to be similar to the reported website.

Abstract: A website misclassification report is received. A determination is made that a current classification model correctly classifies a website. The current classification model is different from a model that was previously used to classify the website. In response to a determination that the website is correctly classified by the current classification model, a reclassification operation is performed, using the current classification model, on a second website.

Abstract: Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.

Abstract: Techniques for categorizing mobile uniform resource locators (URLs) that are used by mobile applications are disclosed. A URL is extracted from a mobile application. A category for the URL is determined based on a categorization of the mobile application. The URL and its determined category are then generated as output.

Abstract: An identification of an item that was misclassified by a classification model constructed in accordance with a machine learning technique is received. One example of such a machine learning technique is a random forest. A subset of training data, previously used to construct the model, and that is associated with the misclassified item is identified. At least a portion of the identified subset is provided as output.

Abstract: An identification of an item that was misclassified by a classification model constructed in accordance with a machine learning technique is received. One example of such a machine learning technique is a random forest. A subset of training data, previously used to construct the model, and that is associated with the item is identified. At least a portion of the identified subset is provided as output.

Abstract: Techniques for categorizing mobile uniform resource locators (URLs) that are used by mobile applications are disclosed. A URL is extracted from a mobile application. A category for the URL is determined based on a categorization of the mobile application. The URL and its determined category are then generated as output.

Abstract: Categorizing mobile uniform resource locators (URLs) used by a mobile application is disclosed. A plurality of URLs is extracted from the mobile application. A category is assigned to at least one URL included in the plurality of URLs. The category is assigned to the URL based on a categorization of the mobile application.

Abstract: A plurality of web documents that include indicators corresponding to one or more selectable like objects may be obtained. A corresponding web domain associated with each of the plurality of obtained web documents may be determined. A domain total like object count of the indicators corresponding to the one or more selectable like objects may be determined for each one of the obtained plurality of web documents, for each determined corresponding web domain. A candidate group of the corresponding web domains may be determined based on a comparison of a predetermined first threshold value with one or more of the domain total like object counts. A likefarm domain confidence score may be determined for each one of a second group of the corresponding web domains based on a decision tree function that is based on a plurality of domain attributes.

Abstract: Unsupervised clustering can be used for organization of micro-blog or other short length messages into message clusters. Messages can be compared with existing clusters to determine a similarity score. If at least one similarity score is greater than a threshold value, a message can be added to an existing message cluster. If a message is not similar to an existing cluster, the message can be compared against criteria for starting a new message cluster.

Abstract: A plurality of web documents that include indicators corresponding to one or more selectable like objects may be obtained. A corresponding web domain associated with each of the plurality of obtained web documents may be determined. A domain total like object count of the indicators corresponding to the one or more selectable like objects may be determined for each one of the obtained plurality of web documents, for each determined corresponding web domain. A candidate group of the corresponding web domains may be determined based on a comparison of a predetermined first threshold value with one or more of the domain total like object counts. A likefarm domain confidence score may be determined for each one of a second group of the corresponding web domains based on a decision tree function that is based on a plurality of domain attributes.

Abstract: Unsupervised clustering can be used for organization of micro-blog or other short length messages into message clusters. Messages can be compared with existing clusters to determine a similarity score. If at least one similarity score is greater than a threshold value, a message can be added to an existing message cluster. If a message is not similar to an existing cluster, the message can be compared against criteria for starting a new message cluster.