Abstract: A computer-implemented method for distilling a malware program in a system is disclosed. The computer-implemented method includes steps of receiving a known malware program sample; providing a benign program containing a first instruction set associated with a security; extracting the instruction set; tracing a program segment associated with the instruction set from the benign program using a plurality of data flow pathways; slicing the program segment into a plurality of independent data flow elements; identifying a partial program having elements identical to the plurality of independent data flow elements from the known malware program sample; and removing the partial program from the known malware program sample to distill the malware program.

Abstract: A computer system and a method for tracking information flow are provided. The computer system divides an information flow tracking task into two decoupled tasks executed by two procedures. The first procedure emulates execution of instructions and divides the instructions into code blocks according to an instruction executing sequence. The first procedure translates the instructions of the code blocks into information flow codes and transmits them to the second procedure. The first procedure further translates the instructions into dynamic emulation instructions and executes the dynamic emulation instructions to generate addressing results of the dynamic addressing instructions. The second procedure executes the information flow codes according to the addressing results to emulate the instructions of the code blocks. Moreover, the method also tries to reduce the amount of data transmission between the two procedures when the first procedure executes the emulation task.

Abstract: A computer-implemented method for distilling a malware program in a system is disclosed. The computer-implemented method includes steps of receiving a known malware program sample; providing a benign program containing a first instruction set associated with a security; extracting the instruction set; tracing a program segment associated with the instruction set from the benign program using a plurality of data flow pathways; slicing the program segment into a plurality of independent data flow elements; identifying a partial program having elements identical to the plurality of independent data flow elements from the known malware program sample; and removing the partial program from the known malware program sample to distill the malware program.

Abstract: A method for authenticating a message in a network is provided. The method includes a step of generating, in a sink device, a private key and a public key. The private key includes a plurality of sub-private keys. The method further includes a step of generating, in the sink device, a signature for the message. The signature includes a sub-private key and an authentication path associated with the sub-private key in a hash tree. The hash tree is constructed during the generation of the sub-public keys.

Abstract: A computer system and a method for tracking information flow are provided. The computer system divides an information flow tracking task into two decoupled tasks executed by two procedures. The first procedure emulates execution of instructions and divides the instructions into code blocks according to an instruction executing sequence. The first procedure translates the instructions of the code blocks into information flow codes and transmits them to the second procedure. The first procedure further translates the instructions into dynamic emulation instructions and executes the dynamic emulation instructions to generate addressing results of the dynamic addressing instructions. The second procedure executes the information flow codes according to the addressing results to emulate the instructions of the code blocks. Moreover, the method also tries to reduce the amount of data transmission between the two procedures when the first procedure executes the emulation task.

Abstract: A method for transmitting sensed data in a wireless sensor network including multiple sensors, includes: encrypting the sensed data with an encryption key and a verification key to generate encrypted data in each of the multiple sensors that senses data; wirelessly receiving the encrypted data from the multiple sensors; determining that the sensed data from one of the multiple sensors is different from the sensed data from others of the multiple sensors without decrypting the encrypted data; and transmitting the encrypted sensed data determined to be different.

Abstract: A method for authenticating a message in a network is provided. The method includes a step of generating, in a sink device, a private key and a public key. The private key includes a plurality of sub-private keys. The method further includes a step of generating, in the sink device, a signature for the message. The signature includes a sub-private key and an authentication path associated with the sub-private key in a hash tree. The hash tree is constructed during the generation of the sub-public keys.

Abstract: A system and method for synchronously processing a packet are disclosed, which improve the speed of processing the packet by using a load balancing mechanism. The system comprises a switch and a clustered architecture for processing the packet. The switch is for receiving and transmitting the packet. The clustered architecture contains packet processing devices and receives the packet from the switch. All packet processing devices can synchronously process the packet. Each packet processing device has a non-duplicate device number.

Abstract: A method for transmitting sensed data in a wireless sensor network including multiple sensors, includes: encrypting the sensed data with an encryption key and a verification key to generate encrypted data in each of the multiple sensors that senses data; wirelessly receiving the encrypted data from the multiple sensors; determining that the sensed data from one of the multiple sensors is different from the sensed data from others of the multiple sensors without decrypting the encrypted data; and transmitting the encrypted sensed data determined to be different.

Abstract: A system and method for synchronously processing a packet are disclosed, which improve the speed of processing the packet by using a load balancing mechanism. The system comprises a switch and a clustered architecture for processing the packet. The switch is for receiving and transmitting the packet. The clustered architecture contains packet processing devices and receives the packet from the switch. All packet processing devices can synchronously process the packet. Each packet processing device has a non-duplicate device number.