Abstract: Various techniques for malicious pattern extraction via fuzzing are disclosed. In some embodiments, a system/process/computer program product for malicious pattern extraction via fuzzing includes receiving a malicious sample (e.g., the malicious sample can be an executable file, such as a binary, script, etc., or a file that includes content for inputting into an application, such as for an office productivity suite or another application); mutating the malicious sample using fuzzing; and generating a signature based on a critical path (e.g., a malware signature can be automatically generated by a cloud security service for detection of the malicious sample, and the cloud security service can distribute the malware signature to a plurality of firewalls and/or other security entities to subscribers of a security service).

Abstract: Vulnerable program code generated by a language model is detected inline. A detection service monitors for and intercepts network traffic of a language model. For responses from the language model that include generated program code, the detection service extracts the program code and determines a programming language to which the program code corresponds. The detection service employs machine learning-based and/or rule-based vulnerability detection techniques to determine whether the program code comprises any vulnerabilities. If the program code is determined to comprise a vulnerability, the detection service can block transmission of the response comprising the program code to its destination or communicate an alert with the response indicating that the program code is vulnerable to prevent inclusion of the vulnerable program code in a software project.

Abstract: Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

Abstract: Various techniques for malicious pattern extraction via fuzzing are disclosed. In some embodiments, a system/process/computer program product for malicious pattern extraction via fuzzing includes receiving a malicious sample (e.g., the malicious sample can be an executable file, such as a binary, script, etc., or a file that includes content for inputting into an application, such as for an office productivity suite or another application); mutating the malicious sample using fuzzing; and generating a signature based on a critical path (e.g., a malware signature can be automatically generated by a cloud security service for detection of the malicious sample, and the cloud security service can distribute the malware signature to a plurality of firewalls and/or other security entities to subscribers of a security service).

Abstract: The application relates to the field of integrated circuit design and discloses a digital phase interpolator, comprising: a first delay unit, a pre-interpolating unit, a second delay unit, and a phase interpolating unit; wherein each interpolation branch comprises a pre-interpolating unit and a re-interpolating unit. For two input signals with preset phase differences, the digital phase interpolator performs two interpolation processes, one at the pre-interpolating unit and the other at the phase interpolating unit. This distributed quadratic interpolation reduces the task of the phase interpolation unit, helps to reduce the number of stages of the phase interpolating unit, reduces the input load, reduces the overall power consumption and the overall area, ensures the rationality of its own power consumption, and improves the linearity of phase interpolation to some extent.

Abstract: Vulnerable program code generated by a language model is detected inline. A detection service monitors for and intercepts network traffic of a language model. For responses from the language model that include generated program code, the detection service extracts the program code and determines a programming language to which the program code corresponds. The detection service employs machine learning-based and/or rule-based vulnerability detection techniques to determine whether the program code comprises any vulnerabilities. If the program code is determined to comprise a vulnerability, the detection service can block transmission of the response comprising the program code to its destination or communicate an alert with the response indicating that the program code is vulnerable to prevent inclusion of the vulnerable program code in a software project.

Abstract: Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

Abstract: Vulnerable program code generated by a language model is detected inline. A detection service monitors for and intercepts network traffic of a language model. For responses from the language model that include generated program code, the detection service extracts the program code and determines a programming language to which the program code corresponds. The detection service employs machine learning-based and/or rule-based vulnerability detection techniques to determine whether the program code comprises any vulnerabilities. If the program code is determined to comprise a vulnerability, the detection service can block transmission of the response comprising the program code to its destination or communicate an alert with the response indicating that the program code is vulnerable to prevent inclusion of the vulnerable program code in a software project.

Abstract: The technology described herein relates to systems, methods, and computer storage media, among other things, for determining whether an electronic transmission (e.g., associated with an electronic payment transaction) should be blocked (e.g., based on being a fraudulent transaction). In embodiments, a policy-based reinforcement learning risk decision agent is used to make these determinations for a plurality of stages associated with the electronic payment transaction (e.g., a pre-authorization stage, a post-authorization stage, and a delay-captured stage). The policy-based reinforcement learning risk decision agent can be trained using previous electronic payment transaction data for previous electronic payment transactions. For example, this particular agent can be trained using pre-authorization electronic payment transaction data, post-authorization electronic payment transaction data, and delay-captured electronic payment transaction data for each of the previous electronic payment transactions.

Abstract: A prompt injection attack can be used for data exfiltration. A security appliance can be programmed to monitor responses from an application that uses a generative AI model for uniform resource locators (URLs) that indicate a remote server. When a response is detected with a URL indicating a remote server, the security appliance determines whether the remote server is a suspicious server, which is a server not known to be benign and not known to be malicious. If deemed suspicious, the security appliance can block or hold the response to prevent possible data exfiltration.

Abstract: Some aspects of the present technology relate to technologies for performing fraud detection on online transaction platforms through user behavior sequence data. In accordance with some configurations, a multi-task convolutional neural network (MTCNN) model is used to predict, in real-time, whether user behavior sequence data is indicative of fraudulent activity. To perform fraud detection in such configurations, a one-layer convolutional neural network architecture with multi-range kernels is employed. The MTCNN model receives a sequence of page browsing signals corresponding to a buyer. Each page browsing signal corresponds to a position in the sequence. One or more portions of the page browsing signals are selected. Each of the one or more portions of the page browsing signals and the corresponding position are embedded in one or more sequence embeddings. A fraud risk for each of the one or more sequence embeddings is predicted utilizing the MTCNN model.

Abstract: Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.

Abstract: Various examples described herein support or provide operations including providing a prompt to a large language model (LLM) for generating reward functions. The prompt can include a set of instructions for generating a set of reward functions associated with training a reinforcement learning (RL) agent to predict an objective. The set of reward functions is obtained from the LLM and used to train one or more instances of an RL agent to predict the objective. A score representing accuracy of the predicted objective for the one or more instances of the RL agent is generated and an individual instance of the one or more instances of the RL agent is selected to predict the objective based on the generated score.

Abstract: A malicious instructions detection model (“detector”) intercepts augmented prompts destined for a large language model (“LLM”). Each augmented prompt was augmented with data from potentially compromised data sources susceptible to indirect prompt injection attacks. The detector tokenizes/preprocesses sentences in the augmented prompts and is invoked on the tokenized/preprocessed sentences to obtain confidence scores that each sentence comprises malicious instructions. If one or more of the confidence scores is above a threshold, the detector blocks the augmented prompt and generates an alert indicating the blocking and the malicious instructions. Otherwise, the detector communicates the augmented prompt to its intended LLM.

Abstract: The present application discloses a method, system, and computer system for detecting malicious SQL or command injection strings. The method includes obtaining an SQL or command injection string and determining whether the command injection string is malicious based at least in part on a machine learning model.

Abstract: Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.

Abstract: Various embodiments described herein support or provide operations including identifying a machine-learning (ML) model associated with an omni-view knowledge graph; generating an embedding vector that represents the omni-view knowledge graph; identifying a ML model associated with a temporal-view knowledge graph; generating an embedding vector that represents the temporal-view knowledge graph; and training a ML model based on the generated embedding vectors.

Abstract: An encoding method and an encoder are provided to improve image compression performance. An embodiment of the encoding method determines an encoding quantization parameter, QP, and precodes a to-be-encoded block using the encoding QP to obtain encoding result information. The encoding QP is then adjusted based on the encoding result information, and then real encoding is performed on the to-be-encoded block by using an adjusted encoding QP. An embodiment of the encoder includes a bit rate control module to determine a first QP, and a precoding module to precode a to-be-encoded block using the QP to obtain precoding result information. The encoder further includes another bit rate control module to adjust the QP based on the precoding result information to obtain a second QP, and a real encoding module to encode the to-be-encoded block using the second QP.

Abstract: The present application discloses a method, system, and computer system for detecting malicious SQL or command injection strings. The method includes obtaining an SQL or command injection string and determining whether the command injection string is malicious based at least in part on a machine learning model.

Abstract: The present application discloses a method, system, and computer system for detecting Return Oriented Programming (ROP) exploits. The method includes (i) intercepting, by one or more processors, a memory attribute change function for a sample; (ii) determining if a return address is associated with a shellcode address, and (iii) in response to determining that the return address is associated with the shellcode address, determining that the sample is an ROP exploit.