Abstract: Disclosed are a method and system for static behavior-predictive malware detection. The method and system use a transfer learning model from behavior prediction to malware detection based on static features. In accordance with an embodiment, machine learning is used to capture the relations between static features, behavior features, and other context information. For example, the machine learning may be implemented with a deep learning network model with multiple embedded layers pre-trained with metadata gathered from various resources, including sandbox logs, simulator logs and context information. Synthesized behavior-related static features are generated by projecting the original static features to the behavior features. A final static model may then be trained using the combination of the original static features and the synthesized features as the training data. The detection stage may be performed in real time with static analysis because only static features are needed.

Abstract: Disclosed is a method and system for static behavior-predictive malware detection. The method and system uses a transfer learning model from behavior prediction to malware detection based on static features. In accordance with an embodiment of the invention, machine learning is used to capture the relations between static features, behavior features, and other context information. For example, the machine learning may be implemented with a deep learning network model with multiple embedded layers is pre-trained with metadata gathered from various resources, including sandbox logs, simulator logs and context information. Synthesized behavior-related static features are generated by projecting the original static features to the behavior features. A final static model may then be trained using the combination of the original static features and the synthesized features as the training data. The detection stage may be performed in real time with static analysis because only static features are needed.

Abstract: A training data set for training a machine learning module is prepared by dividing normal files and malicious files into sections. Each section of a normal file is labeled as normal. Each section of a malicious file is labeled as malicious regardless of whether or not the section is malicious. The sections of the normal files and malicious files are used to train the machine learning module. The trained machine learning module is packaged as a machine learning model, which is provided to an endpoint computer. In the endpoint computer, an unknown file is divided into sections, which are input to the machine learning model to identify a malicious section of the unknown file, if any is present in the unknown file.

Abstract: A training data set for training a machine learning module is prepared by dividing normal files and malicious files into sections. Each section of a normal file is labeled as normal. Each section of a malicious file is labeled as malicious regardless of whether or not the section is malicious. The sections of the normal files and malicious files are used to train the machine learning module. The trained machine learning module is packaged as a machine learning model, which is provided to an endpoint computer. In the endpoint computer, an unknown file is divided into sections, which are input to the machine learning model to identify a malicious section of the unknown file, if any is present in the unknown file.

Abstract: An image sensor device includes a top substrate and a subassembly. The top substrate includes a plurality of connection pillars, and the subassembly includes a plurality of connection pads. The connection pillars on the top substrate are bonded to the connection pads in the subassembly. The connection pillars are formed of a first metal and the connection pads are formed of a second metal.

Abstract: An image sensor device includes a top substrate and a subassembly. The top substrate includes a plurality of connection pillars, and the subassembly includes a plurality of connection pads. The connection pillars on the top substrate are bonded to the connection pads in the subassembly. The connection pillars are formed of a first metal and the connection pads are formed of a second metal.

Abstract: An MEMS device and a method for forming the same are provided. The MEMS device comprises a first interlayer dielectric layer on a semiconductor substrate; a cavity in the first interlayer dielectric layer; first openings in the first interlayer dielectric layer over the cavity and connected with the cavity, each first opening comprising a lower portion and an upper portion having non-aligned sidewalls, convex sections are formed in the first interlayer dielectric layer between the lower and upper portions; an electrode being suspended in the cavity and movable relative to the substrate; a second interlayer dielectric layer on the first interlayer dielectric layer; second openings in the second interlayer dielectric layer and connected with the first openings, each second opening is disposed at a location that does not extend past the convex section; a third interlayer dielectric layer fully filling at least the second openings to seal the cavity.