Palo Alto Networks, Inc.

Microsoft Technology Licensing, LLC

Seokkyung Chung

Lin Xu

William Redington Hewlett, Ii

Wei Xu

Lei Zhang

Zhi Xu

Jun Wang

Martin Walter

Shadi Rostami-Hesarsorkh

Daiping Liu

Lei Duan

Farshad Rostamabadi

Lee Klarich

Fan Fei

Suquan Li

Ben Hua

Xunhua Tong

Lei Guo

Guenther Schmuelling

William Hewlett

Will Chin

Ki Yeun Kim

Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.

In-line detection of algorithmically generated domains

An identification of an item that was misclassified by a classification model constructed in accordance with a machine learning technique is received. One example of such a machine learning technique is a random forest. A subset of training data, previously used to construct the model, and that is associated with the item is identified. At least a portion of the identified subset is provided as output.

Data blaming

A website misclassification report is received. A determination is made that a current classification model correctly classifies a website. The current classification model is different from a model that was previously used to classify the website. In response to a determination that the website is correctly classified by the current classification model, a reclassification operation is performed, using the current classification model, on a second website.

Focused URL recrawl

A copy of a model comprising a plurality of trees is received, as is a copy of training set data comprising a plurality of training set examples. For each tree included in the plurality of trees, the training set data is used to determine which training set examples are classified as a given leaf. A blame forest is generated at least in part by mapping each training set item to the respective leaves at which it arrives.

An identification of an item that was misclassified by a classification model constructed in accordance with a machine learning technique is received. One example of such a machine learning technique is a random forest. A subset of training data, previously used to construct the model, and that is associated with the misclassified item is identified. At least a portion of the identified subset is provided as output.

A website misclassification report is received, indicating that a website has been misclassified. A determination is made that a current classification model correctly classifies the reported website. The current classification model is different from a model that was previously used to classify the website. In response to a determination that the reported website should be reclassified using the current classification model, a reclassification operation is performed, using the current classification model, on a set of websites determined to be similar to the reported website.

Techniques for categorizing mobile uniform resource locators (URLs) that are used by mobile applications are disclosed. A URL is extracted from a mobile application. A category for the URL is determined based on a categorization of the mobile application. The URL and its determined category are then generated as output.

Mobile URL categorization

Categorizing mobile uniform resource locators (URLs) used by a mobile application is disclosed. A plurality of URLs is extracted from the mobile application. A category is assigned to at least one URL included in the plurality of URLs. The category is assigned to the URL based on a categorization of the mobile application.

A plurality of web documents that include indicators corresponding to one or more selectable like objects may be obtained. A corresponding web domain associated with each of the plurality of obtained web documents may be determined. A domain total like object count of the indicators corresponding to the one or more selectable like objects may be determined for each one of the obtained plurality of web documents, for each determined corresponding web domain. A candidate group of the corresponding web domains may be determined based on a comparison of a predetermined first threshold value with one or more of the domain total like object counts. A likefarm domain confidence score may be determined for each one of a second group of the corresponding web domains based on a decision tree function that is based on a plurality of domain attributes.

Likefarm determination

Unsupervised clustering can be used for organization of micro-blog or other short length messages into message clusters. Messages can be compared with existing clusters to determine a similarity score. If at least one similarity score is greater than a threshold value, a message can be added to an existing message cluster. If a message is not similar to an existing cluster, the message can be compared against criteria for starting a new message cluster.

Growing community of inventors

San Jose, CA, United States of America

Seokkyung Chung