Abstract: A method for ransomware detection and prevention includes receiving an event stream associated with one or more computer system events, generating user-added-value knowledge data for one or more digital assets by modeling digital asset interactions based on the event stream, including accumulating user-added-values of each of the one or more digital assets, and detecting ransomware behavior based at least in part on the user-added-value knowledge, including analyzing destruction of the user-added values for the one or more digital assets.

Abstract: A method of stabilizing a video in real time using a single pass including receiving consecutive video frames, where the consecutive video frames include a current video frame and previous video frames, storing the consecutive video frames in a buffer, estimating a global motion for the current video frame by describing a camera's relative motion between the current video frame and one of the previous video frames adjacent to the current video frame, estimating a long-term camera motion for the current video frame by determining a geometric mean of an accumulation of the estimate of the global motion for the current video frame and an estimate of global motion for each of the previous video frames, and displaying the current video frame on a display of an electronic device, the current video frame stabilized based on the estimate of the long-term camera motion.

Abstract: A computer-implemented method for analyzing operations of privilege changes is presented. The computer-implemented method includes inputting a program and performing source code analysis on the program by generating a privilege control flow graph (PCFG), generating a privilege data flow graph (PDFG), and generating a privilege call context graph (PCCG). The computer-implemented method further includes, based on the source code analysis results, instrumenting the program to perform inspections on execution states at privilege change operations, and performing runtime inspection and anomaly prevention.

Abstract: This patent is a combined non-invasive method of monitoring glucose level. Monitoring the concentration of glucose level in human blood and tissue was developed by a combined non-invasive technique. This combined method includes skin temperature and pulse wave measurement. All these measurements are used to calculate the blood glucose level. This method also can be used to measure the diabetes related damage of micro arterial.

Abstract: A cleaning robot includes a housing including a cover, a base and a pair of lateral plates, a cleaning device and a driver. The cleaning device is mounted on the base to form a tilt angle with ground and includes a connecting member and a cleaning member connected to the connecting member. The cleaning member includes a water storage room mounted on the connecting member and a cleaning portion connected to the water storage room. The driver is mounted on the base and tightly fixed with the connecting member for driving the connecting member to rotate so that the cleaning member is following rotating with the connecting member. The cleaning portion can clean water marks or grease marks on the ground during the cleaning member rotation. Thus, users are not required to clean water marks or grease marks on the ground, thereby the convenience of users is improved.

Abstract: A method includes obtaining two consecutive video frames at a global motion estimation function for execution on a processor, wherein the video frames comprise a current video frame and a previous video frame, and estimating motion between the two consecutive video frames by matching a set of feature points common to both video frames. The set of feature points is maintained by tracking a number of feature points in the current video frame, refreshing the feature points if the number of feature points falls below a refresh threshold, and replenishing the feature points if the number of feature points falls below a replenish threshold. Motion filtering may be performed by buffering a homogenous transformation of the global motion estimation, calculating a geometric mean of the buffered motions, and estimating intentional camera trajectory based on the geometric mean.

Abstract: Systems and methods for identifying similarities in program binaries, including extracting program binary features from one or more input program binaries to generate corresponding hybrid features. The hybrid features include a reference feature, a resource feature, an abstract control flow feature, and a structural feature. Combinations of a plurality of pairs of binaries are generated from the extracted hybrid features, and a similarity score is determined for each of the pairs of binaries. A hybrid difference score is generated based on the similarity score for each of the binaries combined with input hybrid feature parameters. A likelihood of malware in the input program is identified based on the hybrid difference score.

Abstract: A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, and employing an alert interpretation module to interpret the alerts in real-time, the alert interpretation module including a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models and an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert.

Abstract: A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, automatically analyzing the alerts, in real-time, by using a graph-based alert interpretation engine employing process-star graph models, retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation, and integrating the cause of the alerts, the aftermath of the alerts, and the baselines to output an alert interpretation graph to a user interface of a user device.

Abstract: A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, employing an alert interpretation module to interpret the alerts in real-time, matching problematic entities to the streaming data, retrieving following events, and generating an aftermath graph on a visualization component.

Abstract: Systems and methods for an automotive security gateway include an in-gateway security system that monitors local host behaviors in vehicle devices to identify anomalous local host behaviors using a blueprint model trained to recognize secure local host behaviors. An out-of-gateway security system monitors network traffic across remote hosts, local devices, hotspot network, and in-car network to identify anomalous behaviors using deep packet inspection to inspect packets of the network. A threat mitigation system issues threat mitigation instructions corresponding to the identified anomalous local host behaviors and the anomalous remote host behaviors to secure the vehicle devices by removing the identified anomalous local host behaviors and the anomalous remote host behaviors. Automotive security gateway services and vehicle electronic control units operate the vehicle devices according to the threat mitigation instructions.

Abstract: Systems and methods are disclosed for securing an enterprise environment by detecting suspicious software. A global program lineage graph is constructed. Construction of the global program lineage graph includes creating a node for each version of a program having been installed on a set of user machines. Additionally, at least two nodes are linked with a directional edge. For each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed is determined; and the prevalence number is recorded to the metadata associated with the respective node. Anomalous behavior is identified based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph. An alarm is displayed on a graphical user interface for each suspicious software based on the identified anomalous behavior.

Abstract: Systems and methods are disclosed for enhancing cybersecurity in a computer system by detecting safeness levels of executables. An installation lineage of an executable is identified in which entities forming the installation lineage include at least an installer of the monitored executable, and a network address from which the executable is retrieved. Each entity of the entities forming the installation lineage is individually analyzed using at least one safeness analysis. Results of the at least one safeness analysis of each entity are inherited by other entities in the lineage of the executable. A backtrace result for the executable is determined based on the inherited safeness evaluation of the executable. A total safeness of the executable, based on at least the backtrace result, is evaluated against a set of thresholds to detect a safeness level of the executable. The safeness level of the executable is output on a display screen.

Abstract: Systems and methods for data reduction including organizing data of an event stream into a file access table concurrently with receiving the event stream, the data including independent features and dependent features. A frequent pattern tree (FP-Tree) is built including nodes corresponding to the dependent features according to a frequency of occurrence of the dependent features relative to the independent features. Each single path in the FP-Tree is merged into a special node corresponding to segments of dependent features to produce a reduced FP-Tree. All path combinations in the reduced FP-Tree are identified. A compressible file access template (CFAT) is generated corresponding to each of the path combinations. The data of the event stream is compressed with the CFATs to reduce the dependent features to special events representing the dependent features.

Abstract: Systems and methods for mining and compressing commercial data including a network of point of sale devices to log commercial activity data including independent commercial events and corresponding dependent features. A middleware system is in communication with the network of point of sale devices to continuously collect and compress a stream of the commercial activity data and concurrently store the compressed commercial activity data. Compressing the stream includes a file access table corresponding to the commercial activity data, producing compressible file access templates (CFATs) according to frequent patterns of commercial activity data using the file access table, and replacing dependent feature sequences with a matching compressible file access template. A database is in communication with the middleware system to store the compressed commercial data.

Abstract: A method and system are provided for causality analysis of Operating System-level (OS-level) events in heterogeneous enterprise hosts. The method includes storing, by the processor, the OS-level events in a priority queue in a prioritized order based on priority scores determined from event rareness scores and event fanout scores for the OS-level events. The method includes processing, by the processor, the OS-level events stored in the priority queue in the prioritized order to provide a set of potentially anomalous ones of the OS-level events within a set amount of time. The method includes generating, by the processor, a dependency graph showing causal dependencies of at least the set of potentially anomalous ones of the OS-level events, based on results of the causality dependency analysis. The method includes initiating, by the processor, an action to improve a functioning of the hosts responsive to the dependency graph or information derived therefrom.

Abstract: A computer program product comprising computer executable instructions stored on a non-transitory computer readable medium such that when executed by a processor, causes the processor to identify an object of interest in a visual media element, analyze the object of interest according to a defined set of rules to form a recommendation for improvement of the visual media element, and recommend the improvement to the visual media element to a user. A method comprising receiving a visual media element as an input, determining a relevant object of interest within the visual media element, analyzing an aesthetic appearance of the relevant object of interest according to a guideline, and recommending a change to the visual media element for conforming to the guideline.

Abstract: The present disclosure involves systems, software, and computer implemented methods for increasing spatial resolution of panoramic video captured by a camera array. In one example, a method may include identifying a captured image from each camera in a camera array associated with a capture of a panoramic video. The captured images are stitched together to generate at least one combined image and image mode homographies are calculated between the plurality of cameras in the camera array based on the stitching results. A plurality of captured video frames from each camera in the camera array are identified and video mode homographies of the plurality of cameras are determined based on the calculated image mode homographies. The determined video mode homographies are applied to stitch the plurality of captured video frames.