Abstract: A computer-implemented method is provided for identifying words likely to be used in new combo-squatted domains of a target domain. The method includes selecting the target domain. The method further includes storing, in a memory device, a sequence of previously detected combo-squatted domains from period [t-W, t-1]. The sequence includes a set of words W. The method also includes obtaining trends associated with the target domain at time t. The method additionally includes obtaining, by a hardware processor responsive to the trends, a trend distribution associated with the target domain at time t. The method further includes ranking, by a likelihood, a set of words E that have been extracted from the trend distribution and are expected to be used in the future in the new combo-squatting domains, responsive to the set of words W.

Abstract: A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Abstract: Methods and systems for detecting mutation events include collecting change event pattern counts from one or more processing nodes. Unintended change events are identified based on the collected change event pattern counts. A corrective action is performed for the unintended change events.

Abstract: A method includes, for a first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server, determining that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being associated with a second user ID, and sending a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application.

Abstract: A computer-implemented method includes generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system, performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands, and generating a mutation event report based on the comparison.

Abstract: An inspection method for a pillar-shaped honeycomb filter having a honeycomb-shaped first end face and a honeycomb-shaped second end face, including: allowing gas containing fine particles to flow into the first end face; imaging the entire second end face covered with the sheet-like light using a camera while the gas that has flowed into the first end face flows out of the second end face through the filter, and generating an image of the entire second end face covered with the sheet-like light; selecting an inspection area of the second end face and measuring information concerning a sum of luminance of each pixel in the inspection area; and determining quality of the filter based on at least the information concerning the concentration of the fine particles in the gas before the gas flows into the first end face and the information concerning the sum of luminance.

Abstract: At least one processor device is configured to receive a first authentication request for authenticating a first user, the first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server, determine that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being associated with a second user ID, and send a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application.

Abstract: A voltage compensation device according to an embodiment includes a power converter, series transformers and a controller. The controller includes a first coordinate transformation circuit, a first arithmetic part, a second coordinate transformation circuit and a second arithmetic part. The first coordinate transformation circuit generates a first output and a second output that are mutually-orthogonal by performing a rotating coordinate transformation of the normal-phase components of a three phase alternate current. The first arithmetic part calculates a system voltage based on a direct current component of the first output and generates a first compensation amount corresponding to a compensation voltage set to compensate a shift of the system voltage from a preset target voltage.

Abstract: In an approach to detection of co-location of container services, a method may include monitoring a load on one or more resources accessible by cloud containers located on a first host. The method may further include identifying a bit string from the monitored load of the one or more resources. A high load on the one or more resources for a time period indicates a first bit value, and a low load on the one or more resources for the time period indicates a second alternate bit value. The method may further include receiving a shared key corresponding to a second program in a second cloud container. The method may further include determining the second cloud container is located on the first host based on the shared key matching a key corresponding to the identified bit string.

Abstract: A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method further includes checking, by the hardware processor, if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands.

Abstract: A computer-implemented method includes generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system, performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands, and generating a mutation event report based on the comparison.

Abstract: Methods and systems for detecting mutation events include collecting change event pattern counts from one or more processing nodes. Unintended change events are identified based on the collected change event pattern counts. A corrective action is performed for the unintended change events.

Abstract: Guided word association based domain name detection may be performed by obtaining an original domain name, constructing a feature space from a corpus of text, wherein each word appearing in the corpus is represented as a vector in the feature space, detecting whether a domain name registration exists for each combination of the original domain name and each of a plurality of seed words from the feature space, determining, for each seed word included in an existing domain name registration, a plurality of nearest neighbor candidate words, based on vector distance in the feature space, and repeating, for one or more repetitions, the detecting and the determining, wherein the plurality of nearest neighbor candidate words are utilized as the plurality of seed words.

Abstract: A system prevents divulgation of sensitive data in two snapshots, taken at different times, of one or more systems. The system identifies a set of files from among file pairs. Each file pair is formed from a respective file that includes a difference with respect to each of the two snapshots. The system performs a pattern reducing process that removes, from the set, any file having, as the at least one difference, a predetermined non-sensitive difference between respective executions of a pre-determined system operation. The system performs a commonality reducing process that removes, from the set, any file having, as the at least one difference, a common difference between different system users. The system annotates data in remaining files in the set as potentially being sensitive data. The predetermined non-sensitive difference is determined using a Sandbox host. The common difference is determined using an actual one of the systems.

Abstract: A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Abstract: Computer systems, computer-implemented methods and computer program products that detect a homographic string against defined strings is disclosed. In one embodiment, a computer-implemented method comprises: preparing, by a device operatively coupled to a processor, a mapping function to map a character into an identifier, the mapping function defining a plurality of groups each comprising two or more characters that resemble one another assigned a same identifier, and wherein the plurality of groups are mutually exclusive; preparing, by the device, a list of identifier sequences obtained from defined strings based on the mapping function; applying, by the device, the mapping function to a queried string to obtain a queried identifier sequence; and determining, by the device, whether the queried string is a homographic string by comparing the queried identifier sequence with the list of the identifier sequences.

Abstract: Guided character string alteration can be performed by obtaining an original character string and a plurality of altered character strings, traversing the original character string with a first Long Short Term Memory (LSTM) network to generate, for each character of the original character string, a hidden state of a partial original character string up to that character, and applying, during the traversing, an alteration learning process to each hidden state of a partial original character string to produce an alteration function for relating partial original character strings to partial altered character strings.

Abstract: Guided word association based domain name detection may be performed by obtaining an original domain name, constructing a feature space from a corpus of text, wherein each word appearing in the corpus is represented as a vector in the feature space, detecting whether a domain name registration exists for each combination of the original domain name and each of a plurality of seed words from the feature space, determining, for each seed word included in an existing domain name registration, a plurality of nearest neighbor candidate words, based on vector distance in the feature space, and repeating, for one or more repetitions, the detecting and the determining, wherein the plurality of nearest neighbor candidate words are utilized as the plurality of seed words.

Abstract: A method is provided for preventing divulgation of sensitive data in two snapshots, taken at different times, of one or more same systems in a cloud environment. The method identifies a set of files from among file pairs. Each file pair is formed from a respective file that includes at least one difference with respect to each snapshot. The method performs a pattern reducing process that removes, from the set of files, any of the files having, as the difference, a predetermined non-sensitive difference between respective executions of a pre-determined system operation. The method performs a commonality reducing process that removes, from the set of files, any files having, as the difference, a common difference between different users. The method annotates data in remaining files in the set as potentially being the sensitive data, subsequent to the reducing processes. The two snapshots include at least one Sandbox-based image.

Abstract: A computer readable medium having instructions embodied therewith, the instructions executable by a processor or programmable circuitry of a federation server to cause the processor or programmable circuitry to perform operations including configuring a plurality of identification (ID) federations between the federation server and a plurality of applications such that each of the plurality of ID federations is between the federation server and one of the plurality of applications, receiving a first authentication request for authenticating a user who has been authenticated on a first application of the plurality of applications using an ID federation between the first application and the federation server from among the plurality of ID federations, and sending a second authentication request to a second application of the plurality of applications for authenticating the user using an ID federation between the federation server and the second application from among the plurality of ID federations.