Abstract: A system securing inter-process communication (IPC) based on trust includes a user quota mechanism to provide resource management of IPC's. A single user is allowed to allocate a fixed amount of objects less than a system maximum. A trusted IPC mechanism mediates access to IPC objects by employing signed executables signed by a key and containing a list of trusted keys. A trust relationship is used among a set of subjects connected to an IPC to determine whether communication can be carried out between processes. In order for the processes to communicate via an IPC, either they have to trust each other, or a kernel must trust one process and that process must also trust the other process.

Abstract: An EPG contents collection and recommendation system includes an EPG database of identifications of available programs. A program information acquisition module applies text classification to detailed descriptions of the available programs. An EPG recommendation module recommends an available program to a user based on the text classification. Preferably, EPG contents are collected from publicly available TV websites and parsed into a uniform format. For example, contents are vectorized, and a Maximum Entropy technique is applied. Also, user interaction with the EPG database is used to form a user profile database. Further, classifiers are trained based on contents of the user profile database, and these classifiers are used to recommend EPG contents to the user.

Abstract: Selected system calls are monitored to generate frequency data that is input to a probabilistic intrusion detection analyzer which generates a likelihood score indicative of whether the system calls being monitored were produced by a computer system whose security has been compromised. A first Bayesian network is trained on data from a compromised system and a second Bayesian network is trained on data from a normal system. The probabilistic intrusion detection analyzer considers likelihood data from both Bayesian networks to generate the intrusion detection measure.

Abstract: A system securing inter-process communication (IPC) based on trust includes a user quota mechanism to provide resource management of IPC's. A single user is allowed to allocate a fixed amount of objects less than a system maximum. A trusted IPC mechanism mediates access to IPC objects by employing signed executables signed by a key and containing a list of trusted keys. A trust relationship is used among a set of subjects connected to an IPC to determine whether communication can be carried out between processes. In order for the processes to communicate via an IPC, either they have to trust each other, or a kernel must trust one process and that process must also trust the other process.

Abstract: A method is provided for detecting intrusions to a computing environment. The method includes: monitoring system calls made to an operating system during a defined period of time; evaluating the system calls made during the defined time period in relation to system calls made during known intrusions; and evaluating the temporal sequence in which system calls were made during the defined time period when the system calls made match the system calls made during a known intrusion. If a potential intrusion is detected at this stage, then a more complicated detection scheme may be performed by a second detection scheme. For instance, the second detection scheme may assess the temporal sequence in which the system calls were made and/or the system files accessed by the system calls.

Abstract: An access control method includes dividing a data processing system into multiple zones. Memberships of processes and objects in the zones are identified, and internal relationships between the zones are defined. The relationships between the zones are used to grant or deny processes access to objects based on their memberships in the zones and positions of the processes in the zones.

Abstract: An automatic image cropping system is for use with a portable device having an image capture mechanism and a limited resource for storing or transmitting captured information. The system includes a region of interest suggestion engine defining plural image region candidates by performing image segmentation (20) on an image stored in digital form. The engine also determines if an image region candidate is likely to be more or less interesting to a user than another image region candidate. The engine further selects an image region candidate (28) determined as likely to be of most interest to the user. In some embodiments, the engine further possesses a training module to track user interaction with the portable device and adjust future determination of likelihood of user interest accordingly.

Abstract: A networked mobile EPG system includes an EPG application running on a user device to query and retrieve EPG contents from a home network. A home network gateway uses SIP messaging to allow communication of commands and data on the user device to and from a home networked device through bridging between SIP and a non-SIP protocol of the home network. An EPG service on the home network sends EPG metadata when a query is made from the user device.

Abstract: An EPG contents collection and recommendation system includes an EPG database of identifications of available programs. A program information acquisition module applies text classification to detailed descriptions of the available programs. An EPG recommendation module recommends an available program to a user based on the text classification. Preferably, EPG contents are collected from publicly available TV websites and parsed into a uniform format. For example, contents are vectorized, and a Maximum Entropy technique is applied. Also, user interaction with the EPG database is used to form a user profile database. Further, classifiers are trained based on contents of the user profile database, and these classifiers are used to recommend EPG contents to the user.

Abstract: A method, system, apparatus, and graphical user interface (GUI) for generating structured document files from a document image is disclosed. Structured document files are generated by segmenting the document image into one or more zones containing respective text images, converting the respective text images to digital text, automatically identifying layout information for each of the one or more zones, labeling each of the one or more zones in accordance with a schema, and automatically associating mark-up language tags with the labeled zones to generate the structured document files responsive to the identified layout information and a model file.

Abstract: A security architecture is provided for accessing security components associated with an operating system. The security architecture is generally comprised of: a policy tree storing a plurality of security policies, where each security policy is define as at least one system call which correlates to a security operation and a corresponding security component for executing the security operation; and a policy manager adapted to intercept system calls from the operating system and operable to determine an applicable response based on the policy tree. The policy tree and the policy manager reside in a protected memory space of the execution environment.

Abstract: Access control is mediated by a set of 2-tuple labels or attributes which are associated with subject and object entities, respectively. Subject entitles, such as processes, have separate read and write attributes, while object entities, such as files, have separate integrity and write control attributes. The system implements a set of rules to provide both integrity control and confidentiality protection. Specifically, write operations to an object are inhibited where the subject's write attribute is lower than the write control attribute of the object. Read operations from an object are inhibited where the subject's read attribute is lower than the object's integrity attribute. When a subject reads from an object having a lower integrity level than the subject's read attribute, the subject's read attribute is demoted.

Abstract: A method is provided for replacing a loadable software module in an operating system. The method include: maintaining a reference count for a loadable software module associated with a kernel of the operating system; linking a replacement software module for the loadable software module into the kernel of the operating system; receiving a resource request for the loadable software module after the replacement software module is linked into the kernel; and directing the resource request for the loadable software module to the replacement software module. The method may further include unlinking the loadable software module from the kernel of the operating system when there are no longer any active references to the loadable module.

Abstract: A system and method for identifying and separating handwritten text from machine printed text in a document having a combination of handwritten text and machine printed text. In one embodiment, the present invention is installed as an intelligent printing control interface in a conventional computer and allows any document generated by any application to be selectively processed to remove any handwritten text prior to printing of the document, under the control of the user. In an alternative embodiment, the present invention is installed as an intelligent printing control interface in a conventional digital copy machine, which allows any document being copied to be selectively processed to remove any handwritten text prior to printing of the document, under the control of the user. The present invention employs a handwriting separation method which uses Hidden Markov Models to identify regions as either handwritten text or machine printed text.

Abstract: A method for identifying contours in image data includes expressing pixel-based image data as a grid of columns and rows. A scan order is established over the grid to define a parent-child relationship between contiguous pixels in adjacent rows and to define a sibling relationship among non-contiguous pixels in the same row. A run data structure is established in computer-readable memory that defines a run member by its row position and by its starting and ending column positions. The run data structure further defines parent, child and sibling structures for storing information about the parent-child relationships and sibling relationships of pixels associated with the run member. The run data structure is used to traverse the parent, child and sibling relationships and thereby identify contours within the pixel-based image data.

Abstract: A method of calculating a skew angle for a two-dimensional barcode, in which the horizontal or vertical edges within the barcode are located, preferably using a finite state recognizer, and an edge array identifying the horizontal or vertical edges is generated. Next, the edge lines within the edge array are identified and traced, and any segments of edge lines within the edge array which are perpendicularly connected are separated. The slope for each edge line within the edge array is calculated, preferably using linear regression techniques. In the preferred embodiment, a discrete histogram of the slopes is generated and the skew angle is then set as the highest value within the discrete histogram. In a preferred embodiment, edge lines within the edge array which are located within a first predetermined threshold of each other are merged with each other and edge lines within the edge array having a length less than a second predetermined threshold are eliminated from the edge array to speed processing.

Abstract: The scanned document is analyzed by connected component extraction and by calculating bounding boxes for each connected component. The connected components representing text, halftone images and characters overlapping the user-drawn circled region are eliminated to define candidate objects. The contour of candidate objects are generated and feature points are calculated including junctions of circles with other objects. Then, the user-drawn circled region is reconstructed by defining the contour segments belonging to the same circle. The user-drawn circle is recognized through a series of tests based on the size as well as the area the contour covers. The circle is further defined by removing or disregarding open arcs. After the user-drawn circle is fully identified, the image inside the bounding box of the contour is extracted and optical recognition may be optionally performed on the extracted image.