Abstract: Methods and systems for safe execution of guest code in virtual machine context are presented. A method for running a virtual machine in a computing system includes (a) launching a virtual machine monitor (VMM) that uses a software debugger; (b) launching a virtual machine (VM) that can natively run safe instructions; (c) determining, at runtime, if the instruction is safe or potentially unsafe; (d) executing safe instructions in a native mode; and (e) activating control logic to process potentially unsafe instructions in the software debugger. The software debugger can bypass at least one of the potentially unsafe instructions. The potentially unsafe instructions include instructions that cannot be safely executed in the context of the VM, and instructions that can cause unpredictable results in the context of the VM.

Abstract: A vibrational gyroscope includes a piezoelectric ring having a central opening, and a hemispherical resonator having a central opening and mounted over the opening of the central opening of the piezoelectric ring. A plurality of electrodes delivers a voltage to the piezoelectric ring. A plurality of electrodes provides signal readout that corresponds to angular velocity. The hemispherical resonator can be glued to the piezoelectric ring. The hemispherical resonator preferably vibrates in the third vibration mode. A plurality of capacitive electrodes can be located at nodes and at antinodes of the vibration of the hemispherical resonator, and provide a signal readout that corresponds to the angular velocity. The piezoelectric ring is segmented, non-segmented, or includes an outer segmented portion and an inner non-segmented portion.

Abstract: A system, method and computer program product for detection of false positives occurring during execution of anti-malware applications. The detection and correction of the false positives is implemented in two phases, before creation of new anti-virus databases (i.e., malware black lists) or before creation of new white lists, and after the anti-virus databases or new white lists are created and new false positives are detected. The system calculates a probability of detection of a certain potential malware object. Based on this probability, the system decides to either correct a white list (i.e., a collection of known clean objects) or update a black list (i.e., a collection of known malware objects). A process is separated into a several steps: creation and update (or correction) of white lists; creation and update of black lists; detection of collisions between these lists and correction of black lists or white lists based on the detected collisions.

Abstract: A method, system and computer program product for data backup such that: for each block of a storage device to be backed up to an image, generating a hash function value corresponding to contents of that block; generating a map of links between blocks in the image and corresponding blocks the storage device; using the hash function values to identify blocks of the storage device with identical contents, such that links for the blocks in the storage device with identical contents point to a single block in the image; and modifying the link in the map when a block in the storage is moved (for example, due to defragmentation) but its contents is not altered, so that the link points to the same backed up block.

Abstract: A system, method and computer program product for visualization of search results includes a map displayed to a user on a screen. The map shows search query terms and optionally other terms related to the search query terms. The display of the terms corresponds to relationship between the terms. A graphical image is displayed next to at least one of the search query terms. The graphical image is associated with a URL that corresponds to a search result. The graphical image is a favorite icon that is derived from the HTML script associated with a webpage at the URL, or an animated image, or a video, or a cycling GIF. A plurality of graphical images can be displayed in proximity to the search query term. The graphical image can be a logo or a paid advertisement.

Abstract: A system for generating annotations of a document, including a plurality of neurons connected as a neural network, the neurons being associated with words, sentences and documents. An activity regulator regulates a minimum and/or maximum number of neurons of the neural network that are excited at any given time. The neurons are displayed to a user and identify the neurons that correspond to sentences containing a predetermined percentage of document meaning. The annotations can be also based on a context of the user's search query. The query can include keywords, documents considered relevant by the user, or both. Positions of the neurons relative to each other can be changed on a display device, based on input from the user, with the change in position of one neuron changing the resulting annotations. The input from the user can also include changing a relevance of neurons relative to each other, or indicating relevance or irrelevance of a document or sentence.

Abstract: A method and system for providing a Web service by a plurality of Web domains hosted by a computer, through a single IP address, is disclosed. A server having a unique domain name and the same IP address is allocated for each of the domains, while a software module intermediates between a client of the service and each of the servers. Upon receiving a request for connecting the client to one of the servers in order to provide the service, the target domain name of the request is identified by interacting between the client and the software module via standard communication protocol. The software module communicates with the server providing the service associated with the target domain name also by the standard protocol. A communication channel is then established between the server and the client, so that the server is allowed to provide the desired service to the client.

Abstract: A system, method and computer program product for navigating categorized information, including (a) a two-dimensional map displayed to a user on a screen, the map showing search terms relating to a subject matter, where the display of the search terms corresponds to relationship between the terms, and wherein a manner of display of the terms corresponds to their relative importance to the subject matter; and (b) a neural network underlying the map, wherein the manner of display and a selection of the search terms is derived from the neural network. The manner of display includes font color, font size, font transparency, distance between search terms and positioning of the search terms within the map. Positioning of a cursor over one of the search terms rearranges the search terms on the map to correspond to an increased relevance of the one of the search terms, while the cursor is over the one of the search terms.

Abstract: A method of and system for protecting a disk drive or other data storage includes mounting a virtual storage that combines a full access temporary storage and a READ-only portion of a main storage, wherein the READ-only portion represents a protected area of the main storage; generating a bitmap for blocks of the virtual storage; redirecting virtual storage write requests to the temporary storage; marking, in the bitmap, blocks of the virtual storage corresponding to blocks of the temporary storage that are being written to; redirecting, to the READ-only portion, read requests for unmarked blocks; redirecting, to the temporary storage, read requests for marked blocks; upon an acceptance of a state of the virtual storage, merging the temporary storage with unmarked blocks of the READ-only portion of the main storage, to form an integral storage; and upon a rejection of a state of the virtual storage, terminating the redirecting. Optionally, data in the temporary storage can be archived.

Abstract: A method and system for accelerating malware emulator by using an accelerator. The accelerator allows for a potentially malicious component (i.e., process) containing dummy processes to be executed in a real CPU of a computer system using its operating memory. A special memory area is allocated for the process based on the memory requested by the process in the emulator. The state of the CPU and the memory is loaded in the emulator prior to executing the suspicious process. The system can be restored to its initial state in case of malicious actions performed by the process. The dummy instructions of the process are processed by the CPU at its own speed and as soon as the process performs a malicious instruction it is stopped by the emulator. The emulation process is accelerated to a speed of a regular CPU.

Abstract: A system, method and computer program product for recovering a key used to produce a ciphertext document from a plaintext document, including, in the ciphertext document encrypted using an N-bit key, identifying location of an M-bit control value; converting the control value to an M-bit portion of a gamma that corresponds to (a) the ciphertext document and (b) the N-bit key; accessing a file that corresponds to the M-bit portion of the gamma, wherein the file includes approximately 2N-M keys that correspond to the M-bit portion of the gamma out of the 2N keys; testing the 2N-M keys using a cryptographic key validity function, until a valid key is found; and decrypting the ciphertext document using the valid key to produce the plaintext document. The keys in the file can be tested sequentially. The file can be requested from a server prior to accessing it, or can be local. The name of the file can include the M-bit portion of the gamma.

Abstract: A system, method and computer program product for virtualizing a processor include a virtualization system running on a computer system and controlling memory paging through hardware support for maintaining real paging structures. A Virtual Machine (VM) is running guest code and has at least one set of guest paging structures that correspond to guest physical pages in guest virtualized linear address space. At least some of the guest paging structures are mapped to the real paging structures. For each guest physical page that is mapped to the real paging structures, paging means for handling a connection structure between the guest physical page and a real physical address of the guest physical page. A cache of connection structures represents cached paths to the real paging structures. Each path is described by guest paging structure descriptors and by tie descriptors. Each path includes a plurality of nodes connected by the tie descriptors.

Abstract: A method, system and computer program product for modifying a standard Windows image viewer, including loading an image editing module into an address space of the standard image viewer that does not support plug-ins with added toolbars; integrating the image editing module into the standard image viewer; and displaying a toolbar of the image editing module to a user. The toolbar can include any of the following functions: red eye remover, color correction, caricature effects, lighting effects, retouching, re-sizing, cropping, removal of artifacts. An instance of the image editing module can be loaded for each instance of the standard image viewer. The image editing module maintains modality with the standard image viewer. A file name and file extension corresponding to an image being viewed can be displayed based on a file properties dialog window, or based on a current folder of the image being viewed. The standard Windows image editor can be forced to display the most current edited version of the image.

Abstract: A system and method for optimizing a process of synchronization of a database of files checked by an anti-virus (AV) application implemented as a special AV driver. The database is updated by a special interface application using a log file and the AV driver cache. The AV driver monitors modifications of the files and records modification-related information in the context of the modified files. The AV driver creates and maintains a log of modified files. The AV driver supports a circular cache containing minimal required information about the modified files. This information is used for identification of the modified files by an application providing an interface between the AV driver and the database of checked files.

Abstract: A method of making a hotel reservation includes receiving a reservation request from a booking source, wherein the reservation request is based on an allocation to the booking source from a hotel and wherein the reservation request is price-blind; transmitting the reservation request to the hotel; receiving a confirmation from the hotel; and transmitting the confirmation to the booking source. The booking source can be a consolidator, a travel agent, a tour operator, a Global Distribution System or a wholesaler. The method also includes connecting to the hotel using a web service to transmit the reservation to the hotel. If the reservation request exceeds the allocation, the hotel has an option of accepting the reservation request or declining the reservation request. The method also includes receiving polling inquiries from the booking source prior to transmitting the hotel's confirmation to the booking source. The confirmation from the hotel can be received using a web service.

Abstract: A method and system for managing files in a server environment includes launching a plurality of Virtual Private Servers (VPSs) in a computing system; copying a content of a file of a VPS to a shared space; providing access to the file copy in the shared space when the VPS attempts to access the file; detecting files with the same content in other VPSs; and providing access to the file copy in the shared space from the other VPSs when they attempt to access their files with the identical content.

Abstract: A method and system for handling of potential unsafe instructions and/or for handling transfers of control in a Virtual Machine, that includes generating a frame composed of pages of analyzed code based on original guest code; identifying instructions within the frame that transfer control (or are otherwise unsafe); replacing instructions that transfer the control with an interrupt that transfers control to a stub in non-privileged code; wherein the stub checks whether the control transfer (or instruction) is safe or unsafe, and (i) for unsafe control transfers/unsafe instructions, switches the context to Virtual Machine Monitor; and (ii) for safe control transfers, executes the control transfer in non-privileged mode. The instructions that transfer control can include any of JMP, CALL, RET and RET(n). The instructions that transfer control can also include interrupts.

Abstract: A system for distributed file storage includes a plurality of servers providing, to a plurality of clients, file access services for accessing files stored on the plurality of servers. A list of neighbor servers is maintained by each server. The neighbor servers are a subset of the plurality of servers. At least one server of the plurality of servers is switched into a neighbor group of servers based on network distance. Each file is stored in the form of a plurality of N pieces on N servers, the pieces being generated from the file. The list is used to obtain information for reconstructing files stored on the neighbor servers, such that any K out of the N pieces can be used to reconstruct any file.

Abstract: A method and system for a Radio Frequency (RF)-based identification, tracking and locating of objects. The method and system use a narrow bandwidth signal in VHF of lower frequency range, which minimizes propagation loss and loss of accuracy of the RF locating signals. The signal is sent from a Master Unit(s) to a Tag. The signal traveling time is recorded and the distance between the Master(s) and the Tag is calculated. The method and system allow achieving a longer distance of the RF signal penetration and an increased accuracy by using VHF bands. The techniques of Digital Signal Processing and Software-Defined Radio are used. The actual waveforms transmitted and received by the radios are defined by the software. The roles of the Master Unit(s) and the Tag can be reversed.

Abstract: A system, method and computer program product for optimizing handling of guest code in a Virtual Machine include code for identifying, in the guest code, a predetermined pattern that includes privileged but unsafe instructions and an instruction that raises an exception; code for executing the guest code in a native mode; code for, upon encountering the instruction that raise the exception, transferring control to a Virtual Machine Monitor; code for emulating the pattern in the Virtual Machine Monitor; and code for rolling back the effects of privileged but unsafe instructions and any intervening instructions to ensure correct Virtual Machine Monitor context. The pattern can include, for example, a privileged but unsafe instruction, followed by safe instructions, followed by an exception raising instruction, followed by safe instructions, followed by a privileged but unsafe instruction.