Abstract: Mechanisms are provided for detecting abnormal system call sequences in a monitored computing environment. The mechanisms receive, from a computing system resource of the monitored computing environment, a system call of an observed system call sequence for evaluation. A trained recurrent neural network (RNN), trained to predict system call sequences, processes the system call to generate a prediction of a subsequent system call in a predicted system call sequence. Abnormal call sequence logic compares the subsequent system call in the predicted system call sequence to an observed system call in the observed system call sequence and identifies a difference between the predicted system call sequence and the observed system call sequence based on results of the comparing. The abnormal call sequence logic generates an alert notification in response to identifying the difference.

Abstract: Mechanisms are provided for detecting abnormal system call sequences in a monitored computing environment. The mechanisms receive, from a computing system resource of the monitored computing environment, a system call of an observed system call sequence for evaluation. A trained recurrent neural network (RNN), trained to predict system call sequences, processes the system call to generate a prediction of a subsequent system call in a predicted system call sequence. Abnormal call sequence logic compares the subsequent system call in the predicted system call sequence to an observed system call in the observed system call sequence and identifies a difference between the predicted system call sequence and the observed system call sequence based on results of the comparing. The abnormal call sequence logic generates an alert notification in response to identifying the difference.

Abstract: A method of incorporating a low molecular weight polymer (e.g., polymer strength aid) into an industrial process (e.g., papermaking process) is provided. The method comprises treating an industrial process (e.g., paper sheet precursor) with a powder or wetted powder, wherein the powder comprises a polymer dry polymer (e.g., polymer strength aid), wherein the polymer dry polymer (e.g., polymer strength aid) has a weight average molecular weight of from about 10 kDa to about 2,000 kDa.

Abstract: An automated method for cyberattack detection and prevention in an endpoint. The technique monitors and protects the endpoint by recording inter-process events, creating an inter-process activity graph based on the recorded inter-process events, matching the inter-process activity (as represented in the activity graph) against known malicious or suspicious behavior (as embodied in a set of one or more pattern graphs), and performing a post-detection operation in response to a match between an inter-process activity and a known malicious or suspicious behavior pattern. Preferably, matching involves matching a subgraph in the activity graph with a known malicious or suspicious behavior pattern as represented in the pattern graph. During this processing, preferably both direct and indirect inter-process activities at the endpoint (or across a set of endpoints) are compared to the known behavior patterns.

Abstract: A framework to accurately and quickly verify the ownership of remotely-deployed deep learning models is provided without affecting model accuracy for normal input data. The approach involves generating a watermark, embedding the watermark in a local deep neural network (DNN) model by learning, namely, by training the local DNN model to learn the watermark and a predefined label associated therewith, and later performing a black-box verification against a remote service that is suspected of executing the DNN model without permission. The predefined label is distinct from a true label for a data item in training data for the model that does not include the watermark. Black-box verification includes simply issuing a query that includes a data item with the watermark, and then determining whether the query returns the predefined label.

Abstract: A computer system extracts features of documents that mention malware programs to determine textual features that correspond to individual ones of the malware programs. The computer system performs analysis of samples of malware programs to determine features corresponding to the samples. The computer system performs clustering using the textual features and using the features that correspond to the samples of the malware programs. The clustering creates clusters of data points, each data point corresponding to an individual one of the malware programs. The clusters contain data points considered by the clustering to be similar. The computer system outputs indications of the clusters to allow determination of whether data points in the clusters correspond to individual ones of specific malwares. Apparatus, methods, and computer program products are disclosed.

Abstract: A computer-implemented method, a computer program product, and a computer system. The computer system installs and configures a virtual imitating resource in the computer system, wherein the virtual imitating resource imitates a set of resources in the computer system. Installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, and comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database. The computer system returns a response from an appropriate element of the virtual imitating resource, in response to a call from the evasive malware to a real computing resource, return, by the computer system.

Abstract: A solution including an associative polymer, a cyclodextrin polymer, and a solvent is provided. The associative polymer is a powder in the absence of the solvent. Additionally, a method of making down an associative polymer powder to form a solution is provided. The method includes blending a mixture of the powder, a cyclodextrin polymer, and a solvent to yield the solution, wherein the powder includes particles having been dry-cut to a median particle size of from about 200 microns to about 10,000 microns. Additionally, a powder product is provided. The powder product includes from about 80 wt. % to about 99.9 wt. % associative polymer; and from about 0.1 wt. % to about 20 wt. % of a cyclodextrin polymer.

Abstract: Apparatuses (e.g., systems and devices) and methods to view otherwise hidden connectivity of networking devices. An electronic device such as a network device connected to a variety of different devices, may be observed through a real-time image onto which information about the connectivity and/or connections may be display to show identity, connectivity state and other information associated with ports of the network device(s). These methods may be implemented on a mobile device used to capture images of the network device and present an overlay of virtual objects on the captured images to a user in real time. The virtual objects may dynamically move or change shape in real time depending on the movement of the mobile device. One or more filtering techniques may be used to stabilize the virtual objects with respect to the captured images.

Abstract: The invention provides an associative polymer, a powder, and a process for making a powder comprising, networking one or more associative polymer(s) and one or more optional surfactant(s) to form a wet gel, and forming a powder from the wet gel, wherein the associative polymer(s) have a weight average molecular weight of from about 10 kDa to about 2,000 kDa.

Abstract: The invention provides an associative polymer, a powder, and a process for making a powder including, networking one or more associative polymers and one or more optional surfactants to form a wet gel, and forming a powder from the wet gel, wherein the associative polymer(s) have a weight average molecular weight of from about 10 kDa to about 2,000 kDa.

Abstract: Mechanisms are provided to implement a single input, multi-factor authentication (SIMFA) system. The SIMFA system receives a user input for authenticating a user via a single input channel and provides the user input to first authentication logic of an explicit channel of the SIMFA system, where in the first authentication logic performs a knowledge authentication operation on the user input. The SIMFA system further provides the user input to second authentication logic of one or more side channels of the SIMFA system, where the second authentication logic performs authentication on non-knowledge-based characteristics of the user input. The SIMFA system combines results of the first authentication logic and the second authentication logic to generate a final determination of authenticity of the user. The SIMFA system generates an output indicating whether the user is an authentic user or a non-authentic user based on the final determination of authenticity of the user.

Abstract: Mechanisms are provided for detecting abnormal system call sequences in a monitored computing environment. The mechanisms receive, from a computing system resource of the monitored computing environment, a system call of an observed system call sequence for evaluation. A trained recurrent neural network (RNN), trained to predict system call sequences, processes the system call to generate a prediction of a subsequent system call in a predicted system call sequence. Abnormal call sequence logic compares the subsequent system call in the predicted system call sequence to an observed system call in the observed system call sequence and identifies a difference between the predicted system call sequence and the observed system call sequence based on results of the comparing. The abnormal call sequence logic generates an alert notification in response to identifying the difference.

Abstract: A system for continuously making-down a dry powder material is provided. The system may include a liquid supply system, a material feed system, a vessel, a filter, and an agitator. The vessel may receive a continuous supply of liquid from the liquid supply system and a continuous supply of dry powder from the material feed system. The liquid and material may be discharged continuously from the vessel. A filter may sealingly extend across the outlet to filter the solution exiting the vessel. The filter may include an upstream surface in contact with the inner volume of the vessel. The agitator may be disposed within the vessel and may be configured to agitate the contents of the vessel. The agitator may include a wiping member configured to contact the upstream surface of the filter while agitating the contents.

Abstract: A process for making down a powder is provided. The process comprises making down a powder comprising one or more acrylamide-based polymer(s) to form a made down powder solution, comprising blending a mixture of the powder and a solvent for no more than about 15 minutes to yield the made down powder solution, wherein the powder comprises particles having been dry-cut to a median particle size of from about 200 microns to about 10,000 microns.

Abstract: A method of incorporating a low molecular weight polymer (e.g., polymer strength aid) into an industrial process (e.g., papermaking process) is provided. The method comprises treating an industrial process (e.g., paper sheet precursor) with a powder or wetted powder, wherein the powder comprises a polymer dry polymer (e.g., polymer strength aid), wherein the polymer dry polymer (e.g., polymer strength aid) has a weight average molecular weight of from about 10 kDa to about 2,000 kDa.

Abstract: Advanced persistent threats to a mobile device are detected and prevented by leveraging the built-in mandatory access control (MAC) environment in the mobile operating system in a “stateful” manner. To this end, the MAC mechanism is placed in a permissive mode of operation wherein permission denials are logged but not enforced. The mobile device security environment is augmented to include a monitoring application that is instantiated with system privileges. The application monitors application execution parameters of one or more mobile applications executing on the device. These application execution parameters including, without limitation, the permission denials, are collected and used by the monitoring application to facilitate a stateful monitoring of the operating system security environment. By assembling security-sensitive events over a time period, the system identifies an advanced persistent threat (APT) that otherwise leverages multiple steps using benign components.

Abstract: An automated method for cyberattack detection and prevention in an endpoint. The technique monitors and protects the endpoint by recording inter-process events, creating an inter-process activity graph based on the recorded inter-process events, matching the inter-process activity (as represented in the activity graph) against known malicious or suspicious behavior (as embodied in a set of one or more pattern graphs), and performing a post-detection operation in response to a match between an inter-process activity and a known malicious or suspicious behavior pattern. Preferably, matching involves matching a subgraph in the activity graph with a known malicious or suspicious behavior pattern as represented in the pattern graph. During this processing, preferably both direct and indirect inter-process activities at the endpoint (or across a set of endpoints) are compared to the known behavior patterns.

Abstract: One or more processors mark a set of data fields associated with a first trigger in a first trigger-action pair with a taint, where a trigger event triggers an action event in a trigger-action pair. One or more processors mark a first action associated with the first trigger-action pair with the taint, and detect a second trigger associated with a second trigger-action pair. One or more processors then propagate the taint from the first trigger-action pair to the second trigger, and prevent a second action associated with the second trigger-action pair in response to detecting the taint in the second trigger.

Abstract: A computer-implemented method, a computer program product, and a computer system. The computer system installs and configures a virtual imitating resource in the computer system, wherein the virtual imitating resource imitates a set of resources in the computer system. Installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, and comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database. The computer system returns a response from an appropriate element of the virtual imitating resource, in response to a call from the evasive malware to a real computing resource, return, by the computer system.