Abstract: Provided are systems, methods, and computer-program products for classifying an email as malicious. In some implementations, a malicious detection engine may configure a decoy email address. The decoy email address may include a username that is associated with the malicious email detection engine. Email directed to the decoy email address may be received by the malicious email detection engine. The malicious email detection engine may further make the decoy email address publicly available, and may receive a suspect email addressed to the decoy email address. The suspect email may include a header and content. The malicious email detection engine may analyze the header using a header analysis engine, and the content using a high-interaction network. The malicious email detection engine may determine a status for the suspect email, determination using the header and content analysis, wherein the status indicates whether the suspect email was malicious.

Abstract: Provided are systems, methods, and computer-program products for a targeted threat intelligence engine, implemented in a network device. The network device may receive incident data, which may include information derived starting at detection of an attack on the network until detection of an event. The network device may include analytic engines that run in a predetermined order. An analytic engine can analyze incident data of a certain data type, and can produce a result indicating whether a piece of data is associated with the attack. The network device may produce a report of the attack, which may include correlating the results from the analytic engines. The report may provide information about a sequence of events that occurred in the course of the attack. The network device may use the record of the attack to generate indicators, which may describe the attack, and may facilitate configuring security for a network.

Abstract: Provided are methods, network devices, and computer-program products for targeted threat intelligence using a high-interaction network. In some implementations, a network device in a network may receive suspect network traffic. The suspect network traffic may include network traffic identified as potentially causing harm to the network. The network device may determine that the suspect traffic is associated with an unknown threat. The network device may further analyze the suspect network traffic using a high-interaction network. In various implementations, the high-interaction network may be configured to emulate at least a part of the network. In various implementations, analyzing the suspect network traffic may include determining a behavior of the suspect network traffic in the high-interaction network. The network device may further generate indicators, where the indicators may describe the suspect network traffic.

Abstract: A microelectronic short circuit detection module is disclosed that locates and distinguishes among different types of short circuits in touch screen panels. Individual short circuit detection circuits are coupled to force and sense lines throughout a wire matrix within the touch screen. If the line is shorted to a neighboring line or any other line carrying an opposite logic state, its logic state will be corrupted by the short and will be held at a value opposite that of the intended input signal. Comparing the input and the output therefore provides an indicator of a short circuit to another force or sense line in the wire matrix. A pair of pull up/down stages is engaged to detect whether the short is coupled to power or ground. A threshold resistor can be varied to adjust detection sensitivity. By conducting a serial test, matrix coordinates of the short circuit can be identified.

Abstract: According to one embodiment, an apparatus comprises a detection engine and a classification engine. The detection engine is responsible for analyzing an object to determine if the object is malicious. The classification engine is configured to (i) receive results of the analysis of the object conducted by the detection engine and (ii) analyze, based at least in part on the results from the detection engine, whether the object is malicious in accordance with a predictive model. Responsive to the detection engine and the classification engine differing in determinations as to whether the object is malicious, information associated with at least a portion of the results of the analysis of the object by at least one of the detection engine and the classification engine is uploaded for determining whether an update of the predictive model is to occur. An update of the predictive model is subsequently received by the classification engine.

Abstract: A malware detection system configured to detect suspiciousness in obfuscated content. A multi-stage static detection logic is utilized to detect obfuscation, make the obfuscated content accessible, identify suspiciousness in the accessible content and filter non-suspicious non-obfuscated content from further analysis. The system is configured to identify obfuscated content, de-obfuscate obfuscated content, identify suspicious characteristics in the de-obfuscated content, execute a virtual machine to process the suspicious network content and detect malicious network content while removing from further analysis non-suspicious network content.

Abstract: A pick and place machine includes a frame to adjustably mount, in three dimensions, a plurality of vacuum nozzles over a component to be picked according to a first embodiment a multi-head PnP mechanism may be simple and flexible to train for a wide variety of component and package shapes and sizes. Multiple PnP nozzles are staggered independently in three axes. According to a second embodiment, a PnP mechanism uses an array of self-learning nozzles that adapt by adjusting the z height of individual nozzles to the shape of the object to be picked.

Abstract: The disclosure concerns an antenna subsystem that can be used in various repeater systems to optimize gain of the repeater by increasing isolation between donor and server antennas, wherein at least one of the donor and server antennas is an active multi-mode antenna.

Abstract: A system and method for visualizing and updating a data analytics model using Graphical User Interface (GUI) is disclosed. The system is configured to receive an input file, from a user, storing a data analytics model. Based upon the input file, the system identifies the standard template, from a set of template, corresponding to a data analytics module of the input file. Further, the system is configured to display a graphical representation corresponding to the data analytics model based upon the standard template of the data analytics model, wherein the graphical representation comprises a set of elements corresponding to the data analytics model. Further, the system enables editing one or more elements from the set of elements of the graphical representation. Upon modification of the elements of graphical representation, the system enables updating the input file, thereby update the data analytics model using the GUI.

Abstract: An active antenna system developed to beam steer at multiple frequency bands provides improved performance for fixed and mobile communication systems. Methods of altering the current mode on a single radiator are described wherein the radiation pattern of the antenna is varied as the antenna modes are altered. Techniques to restrict or expand the frequency bandwidth of the beam steering technique are described to provide the capability to beam steer at receive frequencies or transmit frequencies only, and techniques are described where beam steering can occur at both transmit and receive frequency bands from a single active antenna system.

Abstract: A modal antenna is proposed that provides for dynamic tuning and optimization of antenna system parameters for SAR (Specific Absorption Rate) management in mobile wireless devices. A modular approach is described where the radiator and active components are integrated into a module, allowing the fixed radiator to be used across multiple wireless products and form factors. Multiple radiation modes can be generated by a single antenna structure with one or several of the modes designed to minimize SAR while maintaining efficient communication link performance. Proximity sensors or other sensors provide indicators to determine when mode selection is necessary.

Abstract: A circularly polarized isolated magnetic dipole (CP-IMD) antenna includes: a first isolated magnetic dipole (IMD) element; a second IMD element positioned adjacent to the first IMD element; a third IMD element positioned adjacent to the second IMD element and configured to oppose the first IMD element; a fourth IMD element disposed positioned adjacent to each of the first and third IMD elements and configured to oppose the second IMD element; and a feed network configured to supply signals to the first thru fourth IMD elements at a phase difference of ninety degrees in a clockwise or counterclockwise direction.

Abstract: According to one embodiment of the disclosure, a computerized method is described to detect a malicious object through its attempt to utilize reflection. The computerized method comprises receiving, by a network device, an object for analysis. Thereafter, the network device conducts a first analysis within a sandboxed environment. The first analysis determines whether the object is configured to utilize reflection. According to one embodiment, the first analysis involves analysis of the content of the object by a static analysis engine. Alternatively, or in addition to this analysis, the behavior of the object by an attempt to access a reflection API may determine that the object is utilizing reflection. Responsive to the network device determining that the object utilizes reflection, a second analysis is conducted to determine whether the object is malicious.

Abstract: The disclosure concerns active antenna systems, including active multi-input multi-output (MIMO) antenna systems, and radiofrequency integrated circuit modules for controlling such active antenna systems.

Abstract: A method, in one embodiment, can include modeling and calibrating two types of sensors that are part of a semiconductor device. In addition, the method can include determining a temperature and voltage based on data received from the two sensors.

Abstract: The disclosure concerns a beam steering antenna system that can be integrated into a portion of a mobile device, such as a ring conductor that encompasses the device or traverses a portion of the periphery of the mobile device. The single port antenna is capable of generating multiple radiation modes which possess different radiation pattern characteristics. An offset parasitic is implemented to couple to the main radiating element and alter the current distribution to affect a change in radiation mode. The coupling typically occurs at a coupling region designed into the conductive ring used as the antenna in a wireless device.

Abstract: A microelectronic short circuit detection module is disclosed that locates and distinguishes among different types of short circuits in touch screen panels. Individual short circuit detection circuits are coupled to force and sense lines throughout a wire matrix within the touch screen. If the line is shorted to a neighboring line or any other line carrying an opposite logic state, its logic state will be corrupted by the short and will be held at a value opposite that of the intended input signal. Comparing the input and the output therefore provides an indicator of a short circuit to another force or sense line in the wire matrix. A pair of pull up/down stages is engaged to detect whether the short is coupled to power or ground. A threshold resistor can be varied to adjust detection sensitivity. By conducting a serial test, matrix coordinates of the short circuit can be identified.

Abstract: Various methods and systems are provided for classification using correntropy. In one embodiment, a classifying device includes a processing unit and memory storing instructions in modules that when executed by the processing unit cause the classifying device to adaptively classify a data value using a correntropy loss function. In another embodiment, a method includes adjusting a weight of a classifier based at least in part on a change in a correntropy loss function signal and classifying a data value using the classifier. In another embodiment, a method includes classifying a data value by predicting a label for the data value using a discriminant function, determining a correntopy statistical similarity between the predicted label and an actual label based at least in part on a correntropy loss function, and minimizing an expected risk associated with the predicted label based at least in part on a correntropy statistical similarity.

Abstract: Various methods and systems are provided for related to adaptive systems using correntropy. In one embodiment, a signal processing device includes a processing unit and a memory storing an adaptive system executable in the at least one processing unit. The adaptive system includes modules that, when executed by the processing unit, cause the signal processing device to adaptively filter a desired signal using a correntropy cost function. In another embodiment, a method includes adjusting a coefficient of an adaptive filter based at least in part on a correntropy cost function signal, providing an adaptive filter output signal based at least in part on the adjusted coefficient and a reference signal, and determining an error signal based at least in part on a received signal and the adaptive filter output signal.

Abstract: Techniques detect bootkits resident on a computer by detecting a change or attempted change to contents of boot locations (e.g., the master boot record) of persistent storage, which may evidence a resident bootkit. Some embodiments may monitor computer operations seeking to change the content of boot locations of persistent storage, where the monitored operations may include API calls performing, for example, WRITE, READ or APPEND operations with respect to the contents of the boot locations. Other embodiments may generate a baseline hash of the contents of the boot locations at a first point of time and a hash snapshot of the boot locations at a second point of time, and compare the baseline hash and hash snapshot where any difference between the two hash values constitutes evidence of a resident bootkit.