Abstract: Techniques to prelink software to improve memory de-duplication in a virtual system are described. An apparatus may comprise a processor circuit, a memory unit coupled to the processor circuit to store private memory pages for multiple virtual machines, and a dynamic linker application operative on the processor circuit to link a binary version of a software program with associated program modules at run-time of the binary version on a virtual machine. The dynamic linker application may comprise a master prelink component operative on the processor circuit to relocate a first set of program modules for a first binary version of the software program for a first virtual machine using a first set of virtual memory addresses from a first private memory page allocated to the first virtual machine, and store relocation information for the first set of program modules in a global prelink layout map for use by a second virtual machine. Other embodiments are described and claimed.

Abstract: Technologies are provided in embodiments to detect malware. The embodiments are configured to receive an entropy rate of a potentially affected system. The embodiments are further configured to compare the entropy rate to an average entropy rate, and to determine a probability that the potentially affected system is infected with malware. The probability is based, at least in part, on a result of the comparison. More specific embodiments can include the received entropy rate being generated, at a least in part, by a genetic program. Additional embodiments can include a configuration to provide the potentially affected system with a specified time-span associated with the genetic program. The specified time-span indicates an amount of time to observe context information on the potentially affected system. In at least some embodiments, the result of the comparison includes an indicator of whether the entropy rate correlates to an infected system or a healthy system.

Abstract: Technologies for reducing connection time to a wireless access point includes recording wireless connection information in a log, computing parameters as a function of past wireless connection information in the log, generating an ordered list of wireless access points most likely to be available for reconnection at a desired time as a function of recent wireless connection information in the log, and directly probing a wireless access point instead of initiating a wireless access point scan. In some embodiments, computing parameters as a function of past wireless connection information in the log comprises performing genetic programming operations to generate prediction programs for later prediction of wireless access points most likely to be available for reconnection at a desired time.

Abstract: Apparatuses and methods for supervisor mode execution protection are disclosed. In one embodiment, a processor includes an interface to access a memory, execution hardware, and control logic. A region in the memory is user memory. The execution hardware is to execute an instruction. The control logic is to prevent the execution hardware from executing the instruction when the instruction is stored in user memory and the processor is in supervisor mode.

Abstract: In one embodiment, the present invention includes a method for generating a list of files accessed during an operating system (OS) boot process to profile the OS boot process, and optimizing the list of files to generate an optimized file list for use in future OS boot processes, where the optimizing is according to a first optimization technique if the files were accessed from a solid state medium and according to a second optimization technique if the files were accessed from a rotating medium. Other embodiments are described and claimed.

Abstract: In one embodiment, the present invention includes a method for generating a list of files accessed during an operating system (OS) boot process to profile the OS boot process, and optimizing the list of files to generate an optimized file list for use in future OS boot processes, where the optimizing is according to a first optimization technique if the files were accessed from a solid state medium and according to a second optimization technique if the files were accessed from a rotating medium. Other embodiments are described and claimed.

Abstract: Techniques for memory de-duplication in a virtual system are described. An apparatus may comprise a first processor circuit coupled to a second processor circuit. A memory unit may be coupled to the first processor circuit and the second processor circuit, the memory unit to store private memory pages and shared memory pages for multiple virtual machines. A memory management application may be operative on the first processor circuit and the second processor circuit in a shared manner to perform memory de-duplication operations on the private memory pages stored in the memory unit to form shared memory pages. The memory management application may perform sequential memory de-duplication operations on the first processor circuit, and parallel memory de-duplication operations on the second processor circuit. Other embodiments are described and claimed.

Abstract: In one embodiment, the present invention includes a method for generating a list of files accessed during an operating system (OS) boot process to profile the OS boot process, and optimizing the list of files to generate an optimized file list for use in future OS boot processes, where the optimizing is according to a first optimization technique if the files were accessed from a solid state medium and according to a second optimization technique if the files were accessed from a rotating medium. Other embodiments are described and claimed.

Abstract: Technologies for reducing connection time to a wireless access point includes recording wireless connection information in a log, computing parameters as a function of past wireless connection information in the log, generating an ordered list of wireless access points most likely to be available for reconnection at a desired time as a function of recent wireless connection information in the log, and directly probing a wireless access point instead of initiating a wireless access point scan. In some embodiments, computing parameters as a function of past wireless connection information in the log comprises performing genetic programming operations to generate prediction programs for later prediction of wireless access points most likely to be available for reconnection at a desired time.

Abstract: Technologies managing cross ring memory accesses by a device driver on a computing device includes configuring a memory page table associated with the device driver to disable cross ring memory accesses by the device driver, trapping attempted cross ring memory accesses by the device driver, and denying the attempted cross ring memory access if the device driver is determined to be malicious. If the device driver is determined not to be malicious, the memory page table is updated to allow the attempted cross ring memory access. The device driver may be analyzed to determine whether the device driver is malicious by comparing the device driver and the attempted cross ring memory access to security data, such as a device driver fingerprint and/or cross ring memory access heuristics, stored on the computing device.

Abstract: Techniques to prelink software to improve memory de-duplication in a virtual system are described. An apparatus may comprise a processor circuit, a memory unit coupled to the processor circuit to store private memory pages for multiple virtual machines, and a dynamic linker application operative on the processor circuit to link a binary version of a software program with associated program modules at run-time of the binary version on a virtual machine. The dynamic linker application may comprise a master prelink component operative on the processor circuit to relocate a first set of program modules for a first binary version of the software program for a first virtual machine using a first set of virtual memory addresses from a first private memory page allocated to the first virtual machine, and store relocation information for the first set of program modules in a global prelink layout map for use by a second virtual machine. Other embodiments are described and claimed.

Abstract: Apparatuses and methods for supervisor mode execution protection are disclosed. In one embodiment, a processor includes an interface to access a memory, execution hardware, and control logic. A region in the memory is user memory. The execution hardware is to execute an instruction. The control logic is to prevent the execution hardware from executing the instruction when the instruction is stored in user memory and the processor is in supervisor mode.

Abstract: In one embodiment, the present invention includes a method for generating a list of files accessed during an operating system (OS) boot process to profile the OS boot process, and optimizing the list of files to generate an optimized file list for use in future OS boot processes, where the optimizing is according to a first optimization technique if the files were accessed from a solid state medium and according to a second optimization technique if the files were accessed from a rotating medium. Other embodiments are described and claimed.

Abstract: Embodiments of techniques and systems for facilitation of performance of predicted actions based on application-provided contexts are described. In embodiments, applications may include a context component that is configured to provide context information, such as in the form of one or more tags, to a prediction engine. In embodiments, the prediction engine may tag one or more observed actions and/or resource utilizations with the received tag, allowing for increased knowledge of application status when making predictions from the observed actions. In embodiments, the tag may also be applied to a current action being used to determine potential actions for early performance. Other embodiments may be described and claimed.

Abstract: A method, system, and device for reducing connection time to a wireless access point includes recording wireless connection information in a log, remotely computing parameters as a function of past wireless connection information in the log, generating an ordered list of wireless access points most likely to be available for reconnection at a desired time as a function of recent wireless connection information in the log, and directly probing a wireless access point instead of initiating a wireless access point scan. In some embodiments, remotely computing parameters as a function of past wireless connection information in the log comprises performing genetic programming operations to generate prediction programs for later prediction of wireless access points most likely to be available for reconnection at a desired time.

Abstract: Technologies are provided in embodiments to detect malware. The embodiments are configured to receive an entropy rate of a potentially affected system. The embodiments are further configured to compare the entropy rate to an average entropy rate, and to determine a probability that the potentially affected system is infected with malware. The probability is based, at least in part, on a result of the comparison. More specific embodiments can include the received entropy rate being generated, at a least in part, by a genetic program. Additional embodiments can include a configuration to provide the potentially affected system with a specified time-span associated with the genetic program. The specified time-span indicates an amount of time to observe context information on the potentially affected system. In at least some embodiments, the result of the comparison includes an indicator of whether the entropy rate correlates to an infected system or a healthy system.

Abstract: Technologies for reducing connection time to a wireless access point includes recording wireless connection information in a log, computing parameters as a function of past wireless connection information in the log, generating an ordered list of wireless access points most likely to be available for reconnection at a desired time as a function of recent wireless connection information in the log, and directly probing a wireless access point instead of initiating a wireless access point scan. In some embodiments, computing parameters as a function of past wireless connection information in the log comprises performing genetic programming operations to generate prediction programs for later prediction of wireless access points most likely to be available for reconnection at a desired time.

Abstract: A method, system, and device for reducing connection time to a wireless access point includes recording wireless connection information in a log, remotely computing parameters as a function of past wireless connection information in the log, generating an ordered list of wireless access points most likely to be available for reconnection at a desired time as a function of recent wireless connection information in the log, and directly probing a wireless access point instead of initiating a wireless access point scan. In some embodiments, remotely computing parameters as a function of past wireless connection information in the log comprises performing genetic programming operations to generate prediction programs for later prediction of wireless access points most likely to be available for reconnection at a desired time.

Abstract: Embodiments of techniques and systems for facilitation of performance of predicted actions based on application-provided contexts are described. In embodiments, applications may include a context component that is configured to provide context information, such as in the form of one or more tags, to a prediction engine. In embodiments, the prediction engine may tag one or more observed actions and/or resource utilizations with the received tag, allowing for increased knowledge of application status when making predictions from the observed actions. In embodiments, the tag may also be applied to a current action being used to determine potential actions for early performance. Other embodiments may be described and claimed.

Abstract: Embodiments of techniques and systems for computation of probabilities of potential actions in a computing device are described. In embodiments, an observation engine (“OE”) may receive indications of one or more actions and/or resource utilizations of a computing device. The OE may, based on these indications, create a flow structure describing steady states and transitions of the computing device during operation. The OE may provide the flow structure to an analysis engine (“AE”) which may compute probabilities of potential actions based on the flow structure and knowledge of a current action. Other embodiments may be described and claimed.