Hewlett Packard Enterprise Development LP

Hewlett-packard Development Company, L.p.

Trend Micro Inc.

Miranda Jane Felicity Mowbray

William G Horne

Prasad V Rao

Pratyusa Kumar Manadhata

Stuart Haber

Josiah Dede Hagen

Sandeep N Bhatt

In one example in accordance with the present disclosure, a method for domain classification includes sorting a set of sample domains into leaves based on syntactical features of the domains. Each sample domain belongs to a family of domains. The method also includes identifying, for each leaf, a regular expression for each family with at least one domain in the leaf. The method also includes determining, for each leaf, at least one lobe with a set of domains in the leaf that matches the regular expression for a first family with at least one domain in the leaf, and that does not match the regular expression for the other families with at least one domain in the leaf. The method also includes creating a classifier for the domains in each lobe by using the set of domains from each family in the lobe as training classes for machine learning.

Domain classification

Examples determine a number of hosts, within an enterprise, which are resolving a particular domain. Based on the number of hosts within the enterprise resolving the particular domain, the examples identify whether the particular domain is benign.

Identification of a DNS packet as malicious based on a value

A method for submatch extraction may include receiving an input string, receiving a regular expression, and converting the regular expression with capturing groups into a plurality of finite automata to extract submatches. The method further includes using a first automaton to determine whether the input string is in a language described by the regular expression, and to process the input string, and using states of the first automaton in a second automaton to extract the submatches.

Submatch extraction

According to an example, a method for matching regular expressions including word boundary symbols includes receiving an input string and receiving a regular expression including a word boundary symbol. The method further includes transforming, by a processor, the regular expression into an automaton such that a set of strings accepted by the automaton is the same as a set of strings described by the regular expression. The method also includes processing the input string by the automaton to determine if the input string matches the regular expression.

Growing community of inventors

Bristol, United Kingdom

Miranda Jane Felicity Mowbray