Abstract: Known malicious Android applications are collected and their functions are extracted. Similarity values are calculated between pairs of functions and those functions with a low similarity value are grouped together and assigned a unique similarity identifier. A common set of functions or common set of similarity identifiers are identified within the applications. If at least one function in the common set is determined to be malicious then the common set is added to a blacklist database either by adding functions or by adding similarity identifiers. To classify an unknown Android application, first the functions in the application are extracted. These functions are then compared to the set of functions identified in the blacklist database. If each function in the set of functions is present (either by matching or by similarity) in the group of extracted functions from the unknown application then the unknown application is classified as malicious.

Abstract: A method for encrypting a file using a combination of an electronic device and a protection communication-enabled (PCE) wireless device is provided. The method includes using an encryption/decryption engine executing on the electronic device to encrypt a first flag string, which is a binary string stored in a header of the file, with a digest value to create an encrypted flag string. The digest value is associated with the PCE wireless device, which is a device having a transmission application program installed thereon for enabling interaction between the PCE wireless device and the encryption/decryption engine. The method also includes encrypting at least a portion of the file using the digest value and a first password provided by a user, thereby generating an encrypted file that includes an encrypted version of at least a portion of the file, the encrypted flag string, and the first flag string.

Abstract: Techniques for replacing ROM-based (Read-Only Memory) DLLs (Dynamic Link Libraries) in a Windows CE type embedded operating system such that the target DLL is replaceable by the hook DLL, and the target DLL is callable by the hook DLL but not callable directly by any other applications after loading of the hook DLL. The techniques enable replacement irrespective whether the hook DLL and the target DLL have the same name and irrespective of which DLL is loaded first. The techniques change the file name of the target DLL in a list of loaded DLL modules by a trusted program that executes in the full kernel mode.

Abstract: An ANDROID application package (APK) file for an application is repackaged into a secured APK file to protect a Dalvik executable (DEX) file of the application. The DEX file is encrypted to generate an encrypted DEX file that is included in the secured APK file along with a stub DEX file. The secured APK file is received in a mobile computing device where the stub DEX file is started to start a wrapper Activity. The wrapper Activity replaces an APK class loader of a mobile operating system of the mobile computing device with a decryptor class loader. The decryptor class loader decrypts the encrypted DEX file to recover the DEX file, and loads classes of the DEX file into a Dalvik virtual machine. The original Activity of the application is then started to provide the functionality of the application in the mobile computing device.

Abstract: A computer network includes endpoint computers and a file history server with a file history database. An endpoint agent in an endpoint computer detects file access events in the endpoint computer and generates file activity data for storage in the file history database. The file activity data may include file access event information of file access events and file information of files involved in the file access events. The endpoint agent may consult the file history database to locate a duplicate of a damaged file in another endpoint computer, and restore the damaged file using the duplicate. A backup and restore program may also consult the file history database to determine whether or not to make a backup copy of a file involved in a file access event.

Abstract: A mobile telephone includes an application processor, internal memory, an external memory card, a backup software module and a restore software module. User data is stored in the internal memory. The backup software module detects changes in the user data, resulting in modified user data. The modified user data is stored onto the external memory card. When the user data is erased from the internal drive or the wireless device needs to be reset the restore software module reads the modified user data from the external memory card and writes the modified user data back onto the internal memory. In this fashion, any modified user data is not lost when the wireless device is reset.