Symantec Corporation

Damballa, Inc.

Predictix LLC

Nikolaos Vasiloglou

Wenke Lee

Roberto Perdisci

Manos Antonakakis

Kevin Alejandro Roundy

Christopher Gates

Andrew B Gardner

Yining Wang

Michael Andrew Hart

Jugal Parikh

Loren Williams

Emir Pasalic

A computer-implemented method for selecting features for classification may include (1) generating a matrix X, a column vector Y, and a matrix Z from a training dataset that includes a plurality of samples with a plurality of features, (2) generating an augmented matrix from the matrix X, the column vector Y, and the matrix Z, (3) identifying one or more most-relevant features from the plurality of features by iteratively applying a sweep operation to the augmented matrix, and (4) training a classification model using the most-relevant features from the plurality of features rather than all of the plurality of features. Various other methods, systems, and computer-readable media may have similar features.

Systems and methods for selecting features for classification

A computer implemented method is provided for processing sparse data. A sparse data set is received. A modified sparse data set is calculated by replacing all nonzero values in the sparse data set with a common positive integer. The modified sparse data set is transposed to create a transposed data set. A covariance matrix is calculated by multiplying the transposed data set by the modified sparse data set. A tree of a predefined depth is generated by assigning columns of the sparse data set to right and left nodes based on co-occurrence with a first anchor column and a second anchor column. The first anchor column and the second anchor column are determined based on the covariance matrix.

Sparse data set processing

A computer-implemented method for predicting security threats may include (1) predicting that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation, (2) predicting that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation, (3) filtering, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation, and (4) notifying the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for predicting security threats

A computer-implemented method for predicting security threat attacks may include (1) identifying candidate security threat targets with latent attributes that describe features of the candidate security threat targets, (2) identifying historical attack data that describes which of the candidate security threat targets experienced an actual security threat attack, (3) determining a similarity relationship between latent attributes of at least one specific candidate security threat target and latent attributes of the candidate security threat targets that experienced an actual security threat attack according to the historical attack data, (4) predicting, based on the determined similarity relationship, that the specific candidate security threat target will experience a future security threat attack, and (5) performing at least one remedial action to protect the specific candidate security threat target in response to predicting the future security threat attack. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for predicting security threat attacks

System and method for detecting a domain generation algorithm (DGA), comprising: performing processing associated with clustering, utilizing a name-based features clustering module accessing information from an electronic database of NX domain information, the randomly generated domain names based on the similarity in the make-up of the randomly generated domain names; performing processing associated with clustering, utilizing a graph clustering module, the randomly generated domain names based on the groups of assets that queried the randomly generated domain names; performing processing associated with determining, utilizing a daily clustering correlation module and a temporal clustering correlation module, which clustered randomly generated domain names are highly correlated in daily use and in time; and performing processing associated with determining the DGA that generated the clustered randomly generated domain names.

Method and system for detecting DGA-based malware

A method and system for detecting a malicious domain name, comprising: collecting domain name statistical information from a non-recursive domain name system name server (RDNS NS); and utilizing the collected domain name statistical information to determine if a domain name is malicious or benign.

Method and system for detecting malicious domain names at an upper DNS hierarchy

Embodiments of the present invention relate to systems and methods for determining sets of products which are similar to each other in terms of consumers' wants and needs. Queries are performed on a particular product. Documents relating to the query are received and stored. A dictionary is created from the received documents, whereby the documents, which are text files, are scrubbed of certain data to create a scrubbed text file. Topic modeling is then performed on the cleansed text file. Various methods can be used to perform topic modeling, including, but not limited to, latent semantic analysis, nonnegative matrix factorization, and singular value decomposition.

Growing community of inventors

Atlanta, GA, United States of America

Nikolaos Vasiloglou