Detection of abnormal entities based on syntactic grouping of strings

A computing device configured to detect outlying strings in a computing environment, the computing device comprising:

• a processor;
• a storage device coupled to the processor;
• an application stored in the storage device, wherein execution of the application by the processor configures the computing device to perform acts comprising:
• accessing data indicative of text strings being used to access resources in a network;
• determining regex models for the text strings;
• determining groupings of the regex models based on an optimization of a cumulative weighted function;
• based on the determined groupings, identifying a regex model having a cumulative weighted function that exceeds a predetermined threshold;
• and
• generating an alert when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.

A computer-readable medium having stored thereon a plurality of sequences of instructions which, when executed by a processor, cause the processor to perform a method comprising:

• accessing data indicative of text strings being used to access resources in a network;
• determining regex models for the text strings;
• determining groupings of the regex models based on an optimization of a cumulative weighted function;
• based on the determined groupings, identifying a regex model having a cumulative weighted function that exceeds a predetermined threshold;
• and
• generating an alert when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.