Abstract: Deriving malware signatures by training a binary decision tree using known malware and benign software samples, each tree node representing a different software feature set and having one descending edge representing samples that are characterized by the node's software feature set and another descending edge representing samples that are not characterized thusly, selecting multiple continuous descending paths for multiple subsets of nodes, each path traversing a selected one of the edges descending from each of the nodes in its corresponding subset, deriving, based on the nodes and edges in any of the paths, a malware-associated software feature signature where the malware samples represented by leaves that directly or indirectly descend from an end of the continuous descending path meets a minimum percentage of the total number of samples represented by the leaves, and providing the malware signatures for use by a computer-based security tool configured to identify malware.

Abstract: Deriving malware signatures by training a binary decision tree using known malware and benign software samples, each tree node representing a different software feature set and having one descending edge representing samples that are characterized by the node's software feature set and another descending edge representing samples that are not characterized thusly, selecting multiple continuous descending paths for multiple subsets of nodes, each path traversing a selected one of the edges descending from each of the nodes in its corresponding subset, deriving, based on the nodes and edges in any of the paths, a malware-associated software feature signature where the malware samples represented by leaves that directly or indirectly descend from an end of the continuous descending path meets a minimum percentage of the total number of samples represented by the leaves, and providing the malware signatures for use by a computer-based security tool configured to identify malware.

Abstract: In some examples, a system for authenticating transactions can include a processor to detect metadata corresponding to a user of a mobile device, wherein the metadata comprises a call history from the mobile device. The processor can also detect transaction information corresponding to the user of the mobile device from a remote server, wherein the transaction information corresponds to a transaction initiated at a remote service provider and wherein the transaction information indicates a transaction type and transaction initiator information. The processor can also generate an authentication score of the transaction based on the metadata and the transaction information. The processor can also authorize the transaction based on the authentication score.

Abstract: In some examples, a system for authenticating transactions can include a processor to detect metadata corresponding to a user of a mobile device, wherein the metadata comprises a call history from the mobile device. The processor can also detect transaction information corresponding to the user of the mobile device from a remote server, wherein the transaction information corresponds to a transaction initiated at a remote service provider and wherein the transaction information indicates a transaction type and transaction initiator information. The processor can also generate an authentication score of the transaction based on the metadata and the transaction information. The processor can also authorize the transaction based on the authentication score.

Abstract: A method and device for optimizing a compiler involves cooperation between the global and local register allocators in assigning symbolic registers to hardware registers. A large procedure may have many associated symbolic registers; the invention involves partitioning the symbolic registers into at least two portions, and allowing the global register allocator to assign one portion and the local register allocator to assign another portion. The registers may be partitioned based on different criteria, such as local vs. global registers, or spill costs, or shallow vs. nested regions.

Abstract: A method and apparatus for coloring an interference graph yields a higher number of colored nodes by taking into consideration the colors of neighbors of a node's uncolored constrained neighbors. By assigning a color to a node that is also the color of a neighbor of an uncolored constrained neighbor, one color constraint is removed, increasing the probability of coloring the uncolored constrained neighbor. If more than one of the neighbors of the uncolored constrained neighbors are colored, one of the colors may be selected over the others using an appropriate heuristic.