Abstract: The invention discloses an ultra-long tunnel sewage disposal, separation and drainage structure suitable for cold regions, comprising: a tunnel portal section drainage structure and a tunnel body section drainage structure and an out-tunnel clear water ditch, an out-tunnel deep-buried ditch, an out-tunnel sewage ditch and a clear water tank; the tunnel portal section drainage structure comprises a central ditch and a side sewage ditch A, the central ditch is deeply buried in the position, lower than the freezing depth, of a tunnel portal section of the main tunnel, and the side sewage ditches A are arranged on both sides of the tunnel portal section of the main tunnel; the tunnel body section drainage structure comprises a side clear water ditch and a side sewage ditch B, and the side clear water ditch and the side sewage ditch B are arranged on both sides of the tunnel body section of the main tunnel.

Abstract: A sample is received for analysis. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled. The emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture.

Abstract: A flyback converter is disclosed that includes an auxiliary switch controller that adaptively controls the auxiliary switch for improved zero voltage switching. The auxiliary switch control adaptively adjusts the auxiliary switch on-time period responsive to a transformer reset time for the flyback converter, a resonant oscillation period for a power switch terminal voltage for a power switch transistor, and an on-time period for the power switch transistor to provide the improved zero voltage switching.

Abstract: Techniques for providing a smart proxy for a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a smart proxy for a large scale high-interaction honeypot farm includes receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.

Abstract: A flyback converter control architecture is provided in which primary-only feedback techniques are used to ensure smooth startup and detection of fault conditions. During steady-state operation, secondary-side regulation is employed. In addition, current limits are monitored during steady-state operation using primary-only feedback techniques to obviate the need for a secondary-side current sense resistor.

Abstract: Techniques for providing a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a large scale high-interaction honeypot farm includes sending traffic detected at a sensor to a smart proxy for a honeypot farm that is executed in a honeypot cloud, wherein the traffic is forwarded attack traffic that is sent using a tunneling protocol, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; forwarding the traffic to an instance of the matching type of vulnerable service; and executing a security agent associated with the instance of the matching type of vulnerable service to identify a threat by monitoring behaviors and detecting anomalies or post exploitation activities.

Abstract: Techniques for providing a smart proxy for a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a smart proxy for a large scale high-interaction honeypot farm includes receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.

Abstract: Techniques for providing a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a large scale high-interaction honeypot farm includes sending traffic detected at a sensor to a smart proxy for a honeypot farm that is executed in a honeypot cloud, wherein the traffic is forwarded attack traffic that is sent using a tunneling protocol, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; forwarding the traffic to an instance of the matching type of vulnerable service; and executing a security agent associated with the instance of the matching type of vulnerable service to identify a threat by monitoring behaviors and detecting anomalies or post exploitation activities.

Abstract: Execution of an application in an application-level sandbox is disclosed. A request to launch an application is received by an operating system executing on a device. A determination is made that a stored copy of the application should be executed within an application-level sandbox. The stored copy of the application is executed in the application-level sandbox.

Abstract: Evaluating samples is disclosed. A sample is received. A system component dependency graph is built for the sample. The system component dependency graph includes a plurality of nodes and at least one edge. A first node included in the plurality of nodes is one of: (1) a system component, (2) an indirect call component, or (3) a system event. The edge is an indirect call instruction. A verdict for the sample is determined based at least in part on the system component dependency graph.

Abstract: Network traffic collectively associated with a set of communications made between a client device and a respective first and second resource during a usage of a program executed on the client device is monitored. At least of the monitored traffic associated with the second resource is encrypted. The encrypted traffic is categorized. A respective first and second policy to apply to the respective first and second communications is determined. The second policy is based at least in part on the categorization of the encrypted traffic.

Abstract: Disclosed is a universal primary-only output current regulation for a flyback converter. A controller determines a peak sense resistor voltage responsive to a desired average output current for the flyback converter during a continuous conduction mode of operation. After a power switch transistor is cycled on, the controller monitors a sense resistor voltage to determine when the sense resistor voltage equals the peak sense resistor voltage. The controller switches off the power switch transistor when the sense resistor voltage equals the peak sense resistor voltage to maintain an average output current for the flyback converter equal to the desired average output current.

Abstract: Execution of an application in an application-level sandbox is disclosed. A request to launch an application is received by an operating system executing on a device. A determination is made that a stored copy of the application should be executed within an application-level sandbox. The stored copy of the application is executed in the application-level sandbox.

Abstract: Network traffic associated with a communication between a client device and a resource is monitored. At least of the monitored traffic is encrypted. The encrypted traffic is categorized. One example way to categorize the encrypted traffic includes using Domain Name System (DNS) query information. A policy is applied to the communication based at least in part on the categorization of the encrypted traffic.

Abstract: Evaluating samples is disclosed. A sample is received. A system component dependency graph is built for the sample. In particular: (1) a dependency relation between at least one system event and at least one system component is analyzed; (2) dependency relations between a plurality of system components are analyzed; and (3) a dependency relation between at least one system component and at least one indirect call component is analyzed. A verdict for the sample is determined based at least in part on the system component dependency graph.

Abstract: Disclosed is a universal primary-only output current regulation for a flyback converter. A controller determines a peak sense resistor voltage responsive to a desired average output current for the flyback converter during a continuous conduction mode of operation. After a power switch transistor is cycled on, the controller monitors a sense resistor voltage to determine when the sense resistor voltage equals the peak sense resistor voltage. The controller switches off the power switch transistor when the sense resistor voltage equals the peak sense resistor voltage to maintain an average output current for the flyback converter equal to the desired average output current.

Abstract: A sample is received for analysis by a virtualized environment. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled. The emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture.

Abstract: A system that determines a cell density and cell type in an area corresponding to a location of a user equipment; determines a mobility state of the user equipment based on the determined cell density and the determined cell type; and controls cell reselection for the user equipment based on the determined mobility state of the user equipment.

Abstract: A switching power converter is provided that communicates with a mobile device to receive a value of a load detection current. The switching power converter adjusts the cycling of a power switch until a constant current mode of operation is entered with a known output current driving the mobile device. The switching power converter subtracts the load current from the output current to measure a soft-short circuit current.

Abstract: A virtualized storage for use in performing dynamic analysis on a sample is configured, at least in part by copying the sample to the virtualized storage. A virtual machine emulator is launched using a snapshot of a virtualized platform. The virtualized platform is previously configured to use the virtualized storage, and the snapshot is configured to use a placeholder file to occupy space for later use when installing the sample. A location of the copied sample in an image corresponding to the virtualized storage is determined. The copied sample is installed and dynamic analysis is performed on the sample.