Abstract: A method for detecting a predetermined behavior during a domain name registration or a domain resolution activity includes identifying one or more dimensions to be tracked. One or more metrics for each dimension is/are identified. A first time series for each of the metrics is generated. One or more first outliers in at least one of the first time series is detected. One or more sets of metrics is generated, each set including a combination of two or more of the metrics. A second time series for each of the metrics in the one or more sets of metrics is generated. One or more second outliers in at least one of the second time series is/are detected.

Abstract: Techniques for generating unregistered internet domain names using machine learning are presented. The techniques include parsing terms in an embedding training corpus of computer-readable text produce a tokenized embedding training corpus of text; adding tag(s) to produce a tagged tokenized embedding training corpus of text; vectorizing to produce a vector space embedding model mapping tagged tokenized terms to vectors; parsing domain names of a domain name training corpus of registered domain names to obtain a tokenized domain name training corpus; adding at least one tag to tokens to obtain a tagged tokenized domain name training corpus; vectorizing using the vector space model to produce a vectorized domain name training corpus; training a machine learning algorithm with the vectorized domain name training corpus to produce a trained machine learning model; generating an output domain name by the trained machine learning model; and outputting the output domain name.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for characterizing domain names by determining a name server switching footprint for domain names using a data set corresponding to name server operations for the domain names. The domain names can be clustered into groups based on the name server switching footprints, and intended uses of domain names in a group can be extrapolated to other domain names in the group. Name server switching footprints can also be predicted for new domains names using a prediction model trained using the determined name server switching footprints for the domain names in the data set.

Abstract: A method for detecting a predetermined behavior during a domain name registration or a domain resolution activity includes identifying one or more dimensions to be tracked. One or more metrics for each dimension is/are identified. A first time series for each of the metrics is generated. One or more first outliers in at least one of the first time series is detected. One or more sets of metrics is generated, each set including a combination of two or more of the metrics. A second time series for each of the metrics in the one or more sets of metrics is generated. One or more second outliers in at least one of the second time series is/are detected.

Abstract: Embodiments relate to systems, devices, and computing-implemented methods for providing DoS mitigation using a list of persistent clients generated using network flow data. Daily flow counts can be incremented once per date for unique flow combinations in the network flow data that are associated with at least one network interaction that occurred on that date. A candidate list of persistent clients can be created based on the daily flow counts, and the candidate list of persistent clients can be filtered and ranked, and the list of persistent clients can be selected based on the rankings.

Abstract: Systems, methods, and computer-readable mediums are provided that access a set of data related to a plurality of domain name system (DNS) requests for a plurality of subnets in a network. A subset of the set of data that is a representative sample of the set of data is selected. Latency of the subset of the data is estimated and latency is estimated for the totality of the data. A portion of the network is modified based on the estimated latency of the totality of the data.

Abstract: Systems, methods, and computer-readable mediums are provided that access a set of data related to a plurality of domain name system (DNS) requests for a plurality of subnets in a network. A subset of the set of data that is a representative sample of the set of data is selected. Latency of the subset of the data is estimated and latency is estimated for the totality of the data. A portion of the network is modified based on the estimated latency of the totality of the data.

Abstract: Embodiments relate to systems, devices, and computing-implemented methods for providing DoS mitigation using a list of persistent clients generated using network flow data. Daily flow counts can be incremented once per date for unique flow combinations in the network flow data that are associated with at least one network interaction that occurred on that date. A candidate list of persistent clients can be created based on the daily flow counts, and the candidate list of persistent clients can be filtered and ranked, and the list of persistent clients can be selected based on the rankings.

Abstract: In one embodiment, modeling topics includes accessing a corpus comprising documents that include words. Words of a document are selected as keywords of the document. The documents are clustered according to the keywords to yield clusters, where each cluster corresponds to a topic. A statistical distribution is generated for a cluster from words of the documents of the cluster. A topic is modeled using the statistical distribution generated for the cluster corresponding to the topic.

Abstract: In one embodiment, a set of target search terms for a search is received. Candidate terms are selected, where a candidate term is selected to reduce an ontology space of the search. The candidate terms are sent to a computer to recommend the candidate terms as search terms. In another embodiment, a document stored in one or more tangible media is accessed. A set of target tags for the document is received. Terms are selected, where a term is selected to reduce an ontology space of the document. The terms are sent to a computer to recommend the terms as tags.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for characterizing domain names by determining a name server switching footprint for domain names using a data set corresponding to name server operations for the domain names. The domain names can be clustered into groups based on the name server switching footprints, and intended uses of domain names in a group can be extrapolated to other domain names in the group. Name server switching footprints can also be predicted for new domains names using a prediction model trained using the determined name server switching footprints for the domain names in the data set.

Abstract: Associating a semantic service description (SSD) with a service, wherein the SSD comprises a semantic description of the service, including a semantic description of a parameter of the service, according to a computer interpretable language, and, as a service grounding, a mapping between the computer interpretable language expressing the SSD and an interface, including an interface parameter, of the service. A dynamic composition of a task based upon a user selection of a plurality of known services is supported and a dynamic association of the task with a user interface of an application is supported, based upon associating the task with the user selection of a UI object, a UI display screen, and a UI event for the application.

Abstract: A computer-based system includes task computing enabling users to define tasks by combining available functionality and to execute such tasks. The computer-based system of includes available functionality which originates in devices, computing applications and electronic services available through local and remote procedure calls including Web Services, UPnP, CORBA, RMI, RPC, DCE, DCOM or comprises previously defined tasks. All available functionality is abstracted to the user as a service and each service is expressed in a service description language, and the services have a semantic description associated with them.

Abstract: According to one embodiment, generating a domain corpus includes accessing a knowledge base. The knowledge base comprises a set of articles. Each article corresponds to a particular topic and comprises one or more terms that link to other articles corresponding to other topics. A first set of first articles is selected from the knowledge base for a domain corpus. A second set of second articles related to the first set of first articles is identified. The second set of second articles is selected from the knowledge base for the domain corpus. The domain corpus is made available to access.

Abstract: In one embodiment, generating an ontology includes accessing an inverted index comprising a plurality of inverted index lists. An inverted index list may correspond to a term of a language. Each inverted index list may comprise a term identifier of the term and one or more document identifiers indicating one or more documents of a document set in which the term appears. The embodiment also includes generating a term identifier index according to the inverted index. The term identifier index comprises a plurality of sections and each section corresponds to a document. Each section may comprise one or more term identifiers of one or more terms that appear in the document.

Abstract: A predetermined number of temporary terms are obtained that have the highest differential affinity to each of a number of candidate terms. Each temporary term and the associated differential affinity is placed into a set of temporary terms. An average differential affinity is calculated for each temporary term of the set of temporary terms, the average differential affinity representing an average of differential affinities from the each temporary term to every term of the initial set of terms. One or more terms with an average differential affinity that fails to satisfy a predetermined threshold are removed from the temporary set. One or more terms of the temporary set with differential affinities above the threshold are placed into the set of candidate terms. One or more terms of the set of candidate terms are selected and output to a user.

Abstract: In one embodiment, assigning tags to a document includes accessing the document, where the document comprises text units that include words. The following is performed for each text unit: a subset of words of a text unit is selected as candidate tags, relatedness is established among the candidate tags, and certain candidate tags are selected according to the established relatedness to yield a candidate tag set for the text unit. Relatedness between the candidate tags of each candidate tag set and the candidate tags of other candidate tag sets is determined. At least one candidate tag is assigned to the document according to the determined relatedness.

Abstract: According to one embodiment, generating a dictionary and determining a co-occurrence context includes accessing a domain corpus comprising articles. Each article corresponds to a particular topic and comprises one or more terms that link to one or more other articles corresponding to one or more other topics. Each topic is designated as a term to yield a dictionary. A co-occurrence context is defined for the domain corpus. At least two terms appearing in the co-occurrence context are considered co-occurring. Co-occurrences among the terms are calculated according to the co-occurrence context.

Abstract: In one embodiment, generating an ontology includes accessing an inverted index that comprises inverted index lists for words of a language. An inverted index list corresponding to a word indicates pages that include the word. A word pair comprises a first word and a second word. A first inverted index list and a second inverted index list are searched, where the first inverted index list corresponds to the first word and the second inverted index list corresponds to the second word. An affinity between the first word and the second word is calculated according to the first inverted index list and the second inverted index list. The affinity describes a quantitative relationship between the first word and the second word. The affinity is recorded in an affinity matrix, and the affinity matrix is reported.

Abstract: According to certain embodiments, facilitating display of terms includes facilitating display of a graphical user interface. One or more first input terms entered into a user entry window of the graphical user interface are received. One or more first output terms related to the first input terms are determined. Display of a first graphical cloud comprising the first output terms is facilitated. The first input terms are modified to yield one or more second input terms. One or more second output terms related to the second input terms are determined. Display of a second graphical cloud comprising the second output terms is facilitated.