Abstract: A computer-implemented method for remediation of a computing device attempting to access a network. The method may include detecting that the computing device is attempting to access the network. The method may also include determining that the computing device does not comply with a network-access-control policy of the network. The method may include using a virtualization layer to bring the computing device into compliance with the network-access-control policy. The method may include permitting the computing device to access the network after the computing device is brought into compliance with the network-access-control policy. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting rootkits is disclosed. The computer-implemented method may include sending periodic security communications from a privileged-processor-mode region of a computing device. The computer-implemented method may also include identifying at least one of the periodic security communications. The computer-implemented method may further include determining, based on the periodic security communications, whether the privileged-processor-mode region of the computing device has been compromised. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The present disclosure presents a method for managing portions of files in multi-tier storage systems. The method may include identifying a file that is managed by an application and stored in a multi-tier storage system. The method may also include determining how the application stores data in the file by identifying data-management information associated with the application. The method may further include using the data-management information to identify a first portion of the file, identifying a data-placement policy, and implementing the data-placement policy by moving the first portion of the file from a first tier of the multi-tier storage system to a second tier of the multi-tier storage system. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems and methods for improving the effectiveness of decision trees are disclosed. In one example, an exemplary method for performing such a task may include: 1) receiving, from at least one computing device, a) a sample, b) a classification assigned to the sample by a decision tree employed by the computing device, and c) identification information for a branch configuration that resulted in the classification, 2) determining that the decision tree incorrectly classified the sample, and then 3) excluding the offending branch configuration from future decision trees. An exemplary method for dynamically adjusting the confidence of decision-tree classifications based on community-supplied data, along with corresponding systems and computer-readable media, are also described.

Abstract: A computer-implemented method for creating text signatures for identifying spam messages may include: 1) identifying a spam message, 2) tokenizing the text of the spam message, 3) identifying at least one incorrectly punctuated token within the tokenized text of the spam message, 4) identifying, within the tokenized text of the spam message, at least one token that is adjacent to the incorrectly punctuated token, and then 5) creating a candidate signature for identifying future instances and/or variations of the spam message that includes both the incorrectly punctuated token and the token that is adjacent to the incorrectly punctuated token. Corresponding systems and configured computer-readable media are also disclosed.

Abstract: A method for contextual evaluation of files for use in file restoration. The method may include receiving a request to replace a damaged file on a computing system with a clean instance of the damaged file and identifying a clean file that corresponds to the damaged file. The method may also include identifying at least one file set that includes the clean file. The method may further include evaluating the suitability of the clean file for use as a replacement for the damaged file by: 1) determining whether the computing system includes an instance of each file in the file set and 2) deciding, based on the determination of whether the computing system includes an instance of each file in the file set, whether to replace the damaged file with the clean file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for hashing executable files may include identifying an executable file comprising non-variable executable content that contributes to the functionality of the executable file and does not vary among instances of the executable file. The method may also include identifying, within the executable file, non-executable content that does not contribute to the functionality of the executable file. The method may further include creating a normalized executable file by normalizing at least a portion of the non-executable content of the executable file without normalizing the non-variable executable content of the executable file. The method may include calculating a hash value that represents the normalized executable file. Various other methods, systems, and computer-readable media are also disclosed herein.

Abstract: This device may include two parallel rollers which work the skin and which are mounted in a casing so as to rotate about their respective axis. To reliably and effectively treat skin by aspiration, without using excessive vacuum levels, at least one of the rollers may be hollow and delimit transverse aspiration passages. These passages may have an outer end, which opens out on the periphery of the roller, and an inner end which, when the outer end is directed towards the skin, is connected to a vacuum source via a control means inside the roller. These passages may be distributed about the periphery of the roller such that, for each position of the roller, at least one passage has its outer end directed towards the skin and its inner end in fluidic communication, via the control means, with the inner end of at least one other of the passages.

Abstract: The disclosure is directed to automatic virtualization based on user-defined criteria. In one example, data representative of user-defined criteria is received, a virtualization heuristic is generated based on the user-defined criteria, the virtualization heuristic is activated, an occurrence of an event defined by the user-defined criteria is detected, and at least one virtualization operation is automatically performed in response to the detected event. In certain embodiments, the virtualization operation is selected based on the user-defined criteria. In certain embodiments, the virtualization operation includes capturing file system and configuration activity associated with the detected event and storing data representative of the captured file system and configuration activity to a virtual layer.

Abstract: A computer-implemented method for reducing redundancies in quality-assurance reviews of graphical user interfaces may include identifying a plurality of screenshots of a graphical user interface. The computer-implemented method may also include creating, for each screenshot within the plurality of screenshots, a fingerprint of the screenshot and a fingerprint of a set of text contained within the screenshot. The computer-implemented method may further include performing a consolidation operation that identifies, by comparing each screenshot fingerprint and comparing each text fingerprint, redundant screenshots and/or redundant sets of text. The computer-implemented method may additionally include displaying non-redundant screenshots and/or non-redundant sets of text. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for using reputation data to detect packed malware may include: 1) identifying a file downloaded from a portal, 2) determining that the file has been packed, 3) obtaining community-based reputation data for the file, 4) determining, by analyzing the reputation data, that instances of the file have been encountered infrequently (or have never been encountered) within the community, and then 5) performing a security operation on the file (by, for example, quarantining or deleting the file).

Abstract: A computer apparatus receives seed characters relating to an object and accesses rules to generate an identifier. The identifier includes a human-readable component that conveys understanding to a non-skilled user. The identifier complies with limitations dictated by the rules and is not based on random generation.

Abstract: A computer-implemented method for defragmenting virtual machine prefetch data. The method may include obtaining prefetch information associated with prefetch data of a virtual machine. The method may also include defragmenting, based on the prefetch information, the prefetch data on physical storage. The prefetch information may include a starting location and length of the prefetch data on a virtual disk. The prefetch information may include a geometry specification of the virtual disk. Defragmenting on physical storage may include placing the prefetch data contiguously on physical storage, placing the prefetch data in a fast-access segment of physical storage, and/or ordering the prefetch data according to the order in which it is accessed at system or application startup.

Abstract: Systems and methods described herein may separate one or more enhancement layers of a multimedia file from a base layer of the multimedia file and treat the base layer and the enhancement layer differently when backing up and/or archiving the multimedia file (e.g., by giving the enhancement layer a lower priority than the base layer). By separating enhancement layers from multimedia files and treating the enhancement layers with a lower priority, these systems and methods may reduce the strain that large multimedia files put on data repositories and associated computing resources (e.g., storage space, network bandwidth, etc.) while still preserving and protecting enough of the multimedia file to keep important information that the multimedia file may contain intact.

Abstract: A computer-implemented method for identifying spam mailing lists may include identifying a plurality of clients that receive e-mail messages. The computer-implemented method may also include, for each client in the plurality of clients, receiving, from the client, information identifying at least one e-mail message received by the client. The computer-implemented method may further include, for each client in the plurality of clients, recording the identifying information in a database. The computer-implemented method may additionally include identifying at least one mailing list by identifying at least one group of clients within the plurality of clients with similar patterns of identifying information. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A drill wrench for driving drill steels, drill bits, and bolts during drilling and bolting operations is disclosed. The drill wrench may include an internal driver for driving a drill steel. The internal driver may be inserted in an internal-drive recess defined within an end of the drill steel. When the drill wrench is rotated, the internal driver may drive the drill steel by engaging at least one surface within the end of the drill steel. The drill wrench may also include an external support member that supports the drill steel during drilling. The external support member may also drive the drill steel by engaging an outer peripheral portion of the drill steel when the drill wrench is rotated.

Abstract: The disclosure is directed to feature based software virtualization. In one example, a first virtual sub-layer associated with a first feature set of a software package is virtually installed to a computing device. The first feature set includes a first subset of features associated with the software package. The first virtual sub-layer is enabled to activate the first feature set. A second virtual sub-layer associated with a second feature set of the software package is virtually installed to the computing device. The second feature set includes a second subset of the features associated with the software package. The second virtual sub-layer is enabled to activate the second feature set. In certain embodiments, a first fee is charged for the first feature set and a second fee is charged for the second feature set.

Abstract: A computer-implemented method includes identifying a file and calculating a first identifier for the file. The method may also include identifying a first malware identifier that is associated with a first malware program. The method may further include comparing the first file identifier with the first malware identifier to determine whether the file comprises the first malware program. The method may include saving the first file identifier in a manner that allows the first file identifier to be retrieved for comparison with a second malware identifier. The second malware identifier may be associated with a second malware program. Various other methods and systems are also disclosed herein.

Abstract: A computer-implemented method for facilitating automatic malware signature generation may comprise providing a byte sequence marked for possible inclusion within one or more malware signatures, determining a context diversity of the byte sequence within malware files each containing the byte sequence in accordance with a diversity-based heuristic, and preventing the byte sequence from being included within the one or more malware signatures in accordance with the determined context diversity. Corresponding systems and computer-readable storage media are also disclosed.

Abstract: The disclosure is directed to systems and methods for patching computer programs. In one example, a patch is virtually installed to a computing device having a base file system and configuration, a computer program, and a patch layering subsystem. The virtual installation may include storing content of the patch to a patch layer, and generating and storing mapping data defining at least one relationship between the content in the patch layer and content in the base file system and configuration. The virtually installed patch may be enabled, including applying the mapping data to the patch layering subsystem such that the patch layering subsystem is configured for selectively redirecting access requests from the base file system and configuration to the patch layer. In certain embodiments, the enabled patch may be disabled by reversing the application of the mapping data to the patch layering subsystem.