Abstract: Disclosed is a universal input voltage detection system for a flyback converter having a transformer coupled between an input and an output of the flyback converter. The transformer includes a primary winding coupled to the input of the flyback converter to receive an input voltage and a secondary winding coupled to the output of the flyback converter. The universal input voltage detection system comprises a controller, coupled to a switch, at a primary winding side of the transformer. The switch is coupled to the primary winding of the transformer and a current through the primary winding is generated when the switch is turned on. The controller is configured to operate in either continuous conduction mode (CCM) or discontinuous conduction mode (DCM) and indirectly detect the input voltage to the flyback converter based on the current through the primary winding generated while the switch is turned on.

Abstract: A sample is received for analysis by a virtualized environment. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled.

Abstract: Techniques for providing a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a large scale high-interaction honeypot farm includes sending traffic detected at a sensor to a smart proxy for a honeypot farm that is executed in a honeypot cloud, wherein the traffic is forwarded attack traffic that is sent using a tunneling protocol, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; forwarding the traffic to an instance of the matching type of vulnerable service; and executing a security agent associated with the instance of the matching type of vulnerable service to identify a threat by monitoring behaviors and detecting anomalies or post exploitation activities.

Abstract: Techniques for providing a smart proxy for a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a smart proxy for a large scale high-interaction honeypot farm includes receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.

Abstract: A switching power converter is provided that communicates with a mobile device to receive a value of a load detection current. The switching power converter adjusts the cycling of a power switch until a constant current mode of operation is entered with a known output current driving the mobile device. The switching power converter subtracts the load current from the output current to measure a soft-short circuit current.

Abstract: A sample is analyzed to determine a set of events that should be selected for performing by a dynamic analyzer executing the sample in an instrumented, emulated environment. In some cases, analyzing the sample includes extracting the sample's user interface layout into a tree hierarchy of user interface elements. The set of selected events is performed. In some cases, at least one emulator detection resistance action is performed. A maliciousness verdict is determined for the sample based at least in part on one or more responses taken by the sample in response to the set of selected events being performed by the dynamic analyzer.

Abstract: A virtualized storage for use in performing dynamic analysis of a sample is configured, at least in part by copying the sample to the virtualized storage. A virtual machine emulator is launched using a snapshot of a virtualized platform. A location of the copied sample in an image corresponding to the virtualized storage is determined, at least in part by identifying an offset. The copied sample is installed and dynamic analysis is performed on the sample.

Abstract: A virtualized storage for use in performing dynamic analysis of a sample is configured, at least in part by copying the sample to the virtualized storage. A virtual machine emulator is launched using a snapshot of a virtualized platform. A location of the copied sample in an image corresponding to the virtualized storage is determined, at least in part by identifying an offset. The copied sample is installed and dynamic analysis is performed on the sample.

Abstract: A sample is analyzed to determine a set of events that should be selected for performing by a dynamic analyzer executing the sample in an instrumented, emulated environment. The set of selected events is performed. A maliciousness verdict is determined for the sample based at least in part on one or more responses taken by the sample in response to the set of selected events being performed by the dynamic analyzer.

Abstract: A flyback converter control architecture is provided in which primary-only feedback techniques are used to ensure smooth startup and detection of fault conditions. During steady-state operation, secondary-side regulation is employed. In addition, current limits are monitored during steady-state operation using primary-only feedback techniques to obviate the need for a secondary-side current sense resistor.

Abstract: A sample is received for analysis by a virtualized environment. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled.

Abstract: A flyback converter is disclosed that includes an auxiliary switch controller that adaptively controls the auxiliary switch for improved zero voltage switching.

Abstract: A flyback converter control architecture is provided in which primary-only feedback techniques are used to ensure smooth startup and detection of fault conditions. During steady-state operation, secondary-side regulation is employed. In addition, current limits are monitored during steady-state operation using primary-only feedback techniques to obviate the need for a secondary-side current sense resistor.

Abstract: An adaptive pulse width modulation threshold is provided for a flyback converter that controls the transition between the pulse frequency mode of operation and the pulse width modulation mode of operation. The adaptive pulse width modulation mode is adapted responsive to an output voltage for the flyback converter.

Abstract: The profiling and fingerprinting of communication and control (C&C) infrastructure is disclosed herein. An initial C&C profile is transmitted to a first network monitoring system. The initial C&C profile includes a domain corresponding to a C&C channel, and a pattern corresponding to the C&C channel. At least in part in response to information received from a second network monitoring system, the initial C&C profile is revised. An updated C&C profile is transmitted to the first network monitoring system.

Abstract: A first charging path is provided for the charging of an a bootstrap capacitor that stores a driver power supply voltage for driving an active clamp switch transistor in a flyback converter. The first charging path couples charge from an active clamp capacitor to charge the bootstrap capacitor. A power supply capacitor stores a power supply voltage for a controller of a power switch for the flyback converter. A second charging path couples charge from the power supply capacitor to charge the bootstrap capacitor.

Abstract: Execution of an application in an application-level sandbox is disclosed. A request to launch an application is received by an operating system executing on a device. A determination is made that a stored copy of the application should be executed within an application-level sandbox. The stored copy of the application is executed in the application-level sandbox.

Abstract: A switching power converter is provided that adaptively changes the on-time period for an auxiliary switch transistor to locate a boundary between sufficient and insufficient energy.

Abstract: A virtualized storage for use in performing dynamic analysis of a sample is configured, at least in part by copying the sample to the virtualized storage. A virtual machine emulator is launched using a snapshot of a virtualized platform. A location of the copied sample in an image corresponding to the virtualized storage is determined, at least in part by identifying an offset. The copied sample is installed and dynamic analysis is performed on the sample.

Abstract: Evaluating samples is disclosed. A sample is received. A system component dependency graph is built for the sample. In particular: (1) a dependency relation between at least one system event and at least one system component is analyzed; (2) dependency relations between a plurality of system components are analyzed; and (3) a dependency relation between at least one system component and at least one indirect call component is analyzed. A verdict for the sample is determined based at least in part on the system component dependency graph.