Abstract: A method for detecting malware may include 1) receiving a request to determine whether a connection from a client device to a server is being blocked, 2) attempting to connect to the server from a kernel mode of the client device, 3) determining that the client device successfully connected to the server from the kernel mode, 4) attempting to connect to the server from a user mode of the client device, 5) determining that the client device did not successfully connect to the server from the user mode, 6) determining, based on the client device successfully connecting to the server from the kernel mode and failing to connect to the server from the user mode, that malware is blocking the connection from the client device to the server, and 7) in response to determining that the malware is blocking the connection, performing at least one security action.

Abstract: The invention in some embodiments features a contextual content delivery system (CCDS) for enhancing conventional web content with pop-up bubbles that display information when a cursor hovers over a word, link, or icon. The CCDS is configured to identify words or links in a document, determine their context, select the appropriate bubble from a plural of bubble types for each of the words or links, select content for each bubble based, in part, on the context in which the words and hyperlinks are used. The context can be determined from various sources including the resource in which the word or link appears and the target resource to which the link points. Thereafter, the CCDS enhances the words or links so that bubbles are automatically invoked in response to the appropriate trigger.

Abstract: A hook is set for one or more downloading functions. Subsequently, code is executed within an application process. Responsive to the executed code calling one of the hooked functions to download code, a return address of the called function is examined. If the return address is within a memory area not marked executable, the code is permitted to be downloaded and the downloaded code is submitted to a security server for analysis.

Abstract: The prevalence rate of a file to be subject to behavior based heuristics analysis is determined, and the aggressiveness level to use in the analysis is adjusted, responsive to the prevalence rate. The aggressiveness is set to higher levels for lower prevalence files and to lower levels for higher prevalence files. Behavior based heuristics analysis is applied to the file, using the set aggressiveness level. In addition to setting the aggressiveness level, the heuristic analysis can also comprise dynamically weighing lower prevalence files as being more likely to be malicious and higher prevalence files as being less likely. Based on the applied behavior based heuristics analysis, it is determined whether or not the file comprises malware. If it is determined that the file comprises malware, appropriate steps can be taken, such as blocking, deleting, quarantining and/or disinfecting the file.

Abstract: A computer-implemented method for using property tables to perform non-iterative malware scans may include (1) obtaining at least one malware signature from a security software provider that identifies at least one property value for an item of malware, (2) accessing a property table for a computing device that identifies property values shared by one or more application packages installed on the computing device and, for each property value, each application package that shares the property value in question, and (3) determining, by comparing each property value identified in the malware signature with the property table, whether any of the application packages match the malware signature without having to iterate through the individual property values of each application package. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for tracing attacks. The method may include identifying a first website and determining that the first website loads an attack remotely through a second website. The method may also include determining that the second website hosts the attack. The method may include performing a security action, such as blocking downloads from the second website, with respect to the second website. The attack may be a drive-by download. Corresponding systems and computer-readable media are also disclosed.

Abstract: The invention in some embodiments features a contextual content delivery system (CCDS) for enhancing conventional web content with pop-up bubbles that display information when a cursor hovers over a word, link, or icon. The CCDS is configured to identify words or links in a document, determine their context, select the appropriate bubble from a plural of bubble types for each of the words or links, select content for each bubble based, in part, on the context in which the words and hyperlinks are used. The context can be determined from various sources including the resource in which the word or link appears and the target resource to which the link points. Thereafter, the CCDS enhances the words or links so that bubbles are automatically invoked in response to the appropriate trigger.

Abstract: To evade heuristic detection, malware is often designed to trick users into installing the malware by being packaged in a standard installer known to the user's computer for typically installing legitimate software. To prevent removal of the malware, the malware modifies or removes its uninstaller. A security module manages this type of evasion technique by monitoring and detecting installations performed on a computer. The module detects attempts to remove or modify the uninstaller for the application to render the uninstaller incapable of uninstalling the application. The module can intercept and block such attempts, and then analyze the application for malicious code. Where the application is determined to be malware, the module prevents malicious activity. The module can also use the malware's own uninstaller to uninstall the malware from the computer.

Abstract: A computer-implemented method for creating customized confidence bands for use in malware detection may include 1) identifying a portal for receiving executable content, 2) identifying metadata relating to the portal, 3) analyzing the metadata to determine what risk executable content received via the portal poses, and then 4) creating, based on the analysis, a confidence band to apply during at least one disposition of executable content received via the portal. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: An event planning process is provided for execution by a server system in a computer network including a plurality of user terminals communicatively coupled with the server system via the network. The process includes the steps of: providing an event planning graphical user interface at a user terminal, the interface enabling a user to plan an event; receiving event information input by the user, the event information indicating a scheduled event, at least one invitee to be invited to the scheduled event, and information indicative of RSVP fees required to attend the scheduled event; providing an invitation to the invitee, the invitation indicating the scheduled event and the RSVP fees, and soliciting a response to the invitation, wherein an affirmative response to the invitation requires a payment as defined by the RSVP fees; receiving RSVP status information including payment information from the invitee; and verifying the payment information.

Abstract: A method for generating an operating status at a defined time for an operating entity, comprising the steps of: generating one or more time rules for hours of operation of the operating entity; determining an operating status value by comparing the time with the time rules; and matching an operating status to said operating status value.

Abstract: A method and system for controlling an output signal power level of a wireless transmitter can be created by detecting the signal power level of the transmitter with a detector, selectively attenuating the output signal power level with an attenuator having variable attenuation levels, and monitoring the output signal power level and comparing the output signal power level, as determined by the detector, to a predetermined threshold with a processor. The processor preferably controls the attenuator in accordance with the comparison of the output signal power level and the predetermined threshold.

Abstract: A handheld tool includes a first handle with a first driving portion and the second handle with a second driving portion. The second handle, which is located under the first handle, is connected to f the first handle for turning relative to the first handle between a retracted position and an unretracted position and is positioned at the retracted position and the unretracted position respectively. The second driving portion of the second handle is adjacent to the first driving portion of the first handle when the second handle is turned to the retracted position, and the second driving portion keeps a longest distance from the first driving portion when the second handle is turned to the unretracted position.

Abstract: A plausible neural network (PLANN) is an artificial neural network with weight connection given by mutual information, which has the capability of inference and learning, and yet retains many characteristics of a biological neural network. The learning algorithm is based on statistical estimation, which is faster than the gradient decent approach currently used. The network after training becomes a fuzzy/belief network; the inference and weight are exchangeable, and as a result, knowledge extraction becomes simple. PLANN performs associative memory, supervised, semi-supervised, unsupervised learning and function/relation approximation in a single network architecture. This network architecture can easily be implemented by analog VLSI circuit design.

Abstract: The present invention provides key disclosures in three aspects, geo-location information exploration, interaction over geo-locations, and geo-location information sharing. In one aspect, the present invention provides for geo-strolling, a concept of a user navigating to a geographical location on a computer graphically displayed map or environment. The user can be represented by a geo-stroller icon that is visible and programmed for interaction with other geo-strollers present at the same graphically mapped location. This concept is a powerful one because while virtual geo-strollers are not physically located at a place of interest, we can see where their minds are. By tracking the browsing intentions of users, embodiments of the present invention gather information of their interests, making them context compatible for social or business networking as well as other applications.

Abstract: A battery management system for managing a plurality of subsystem circuits and functions of a mobile communication device powered by a battery is disclosed. The battery management system includes a battery monitoring circuit a user interface, and a battery management module. The battery monitoring circuit is operable to monitor a present battery capacity and generate a battery capacity signal based on the present battery capacity. The user interface is operable to receive a user-input allocation of battery capacity among the subsystem circuits and functions. The battery management module is operable to receive the user-input allocation and the battery capacity signal, and to selectively disable each subsystem circuit or function when each subsystem circuit or function has depleted its allocation of battery capacity.

Abstract: A multi-speed transmission includes first and second output gear sets having co-planar intermeshing gears axially-spaced from one another. Each has a first gear intermeshing with a second gear, one of which is connected for common rotation with an output shaft or a first countershaft and the other of which is connected for rotation about and selectively engagable with the other of the output shaft and first countershaft by a respective output torque-transmitting mechanism. A direct drive torque-transmitting mechanism is selectively engageable for transferring torque from the input shaft to the output shaft when neither of the output torque-transmitting mechanisms is engaged. The first output torque-transmitting mechanism is engaged during underdrive gear ratios and the second output torque-transmitting mechanism is engaged during overdrive gear ratios. The order of engagement of torque-transmitting mechanisms during the underdrive gear ratios may be repeated during the overdrive gear ratios.

Abstract: A remote controller device includes a wireless user-operated module and a multi-function module. The wireless user-operated module is operable so as to generate control signals for controlling operation of an electrical appliance, and includes a signal receiver, a sound generator, and a signal processor coupled to the signal receiver and the sound generator. The multi-function module is operable so as to transmit a paging signal for wireless reception by the signal receiver of the user-operated module. The signal processor responds to the paging signal received by the signal receiver of the user-operated module by activating the sound generator to generate an audible sound output.

Abstract: A Virtual Communication Environment to support virtual switching engines for layer 2 switches is described. The virtual layer 2 switching engines allow many virtual switches to be created in a CPU or across multiple CPUs in switching hardware. The virtual switch engines reduce the inter-communication costs in memory, CPU, inter-process bandwidth, and fabric bandwidth. This reduction in the cost per Virtual Switch device allows either more virtual switches to be contained within a control plane or more applications per switch control plane.

Abstract: A method and system for controlling an output signal power level of a wireless transmitter can be created by detecting the signal power level of the transmitter with a detector, selectively attenuating the output signal power level with an attenuator having variable attenuation levels, and monitoring the output signal power level and comparing the output signal power level, as determined by the detector, to a predetermined threshold with a processor. The processor preferably controls the attenuator in accordance with the comparison of the output signal power level and the predetermined threshold.