Abstract: Behavior report generation monitors the behavior of unknown sample files executing in a sandbox. Behaviors are encoded and feature vectors created based upon a q-gram for each sample. Prototypes extraction includes extracting prototypes from the training set of feature vectors using a clustering algorithm. Once prototypes are identified in this training process, the prototypes with unknown labels are reviewed by domain experts who add a label to each prototype. A K-Nearest Neighbor Graph is used to merge prototypes into fewer prototypes without using a fixed distance threshold and then assigning a malware family name to each remaining prototype. An input unknown sample can be classified using the remaining prototypes and using a fixed distance. For the case that no such prototype is close enough, the behavior report of a sample is rejected and tagged as an unknown sample or that of an emerging malware family.

Abstract: Behavior report generation monitors the behavior of unknown sample files executing in a sandbox. Behaviors are encoded and feature vectors created based upon a q-gram for each sample. Prototypes extraction includes extracting prototypes from the training set of feature vectors using a clustering algorithm. Once prototypes are identified in this training process, the prototypes with unknown labels are reviewed by domain experts who add a label to each prototype. A K-Nearest Neighbor Graph is used to merge prototypes into fewer prototypes without using a fixed distance threshold and then assigning a malware family name to each remaining prototype. An input unknown sample can be classified using the remaining prototypes and using a fixed distance. For the case that no such prototype is close enough, the behavior report of a sample is rejected and tagged as an unknown sample or that of an emerging malware family.

Abstract: A device and a method for vacuum-sealing cooling medium is to allow a work piece being vacuumed for the cooling medium being introduced into the work piece. The device provides a first passage, a second passage, a sucking unit, a cooling medium supply unit and a sealing passage. The first passage and the second passage each have an end being connected to the sucking unit and the cooling medium supply unit respectively. The sealing passage communicates with another end of the first passage and another end of the second passage respectively and provides a sealing component, wherein a conveying passage is provided at the sealing component for the work piece being vacuumed or introduced with the cooling medium via said first passage or said second passage.

Abstract: A device and a method for vacuum-sealing cooling medium is to allow a work piece being vacuumed for the cooling medium being introduced into the work piece. The device provides a first passage, a second passage, a sucking unit, a cooling medium supply unit and a sealing passage. The first passage and the second passage each have an end being connected to the sucking unit and the cooing medium supply unit respectively. The sealing passage communicates with another end of the first passage and another end of the second passage respectively and provides a sealing component, wherein a conveying passage is provided at the sealing component for the work piece being vacuumed or introduced with the cooling medium via said first passage or said second passage.