Abstract: A system for training transfer models that includes a memory and a processor coupling to each other. The memory stores instructions. The processor accesses the instructions to retrieve raw datasets from a first-type device and train a feature extraction model, a transfer feature and a preliminary classify model based on the raw datasets. The processor further transfers the feature extraction model, the transfer feature and the preliminary classify model to a host of a manufacturer so that the host directly applies the feature extraction model and the transfer feature, and retrains the preliminary classify model as an adapted classify model based on practical datasets.

Abstract: A system for training transfer models that includes a memory and a processor coupling to each other. The memory stores instructions. The processor accesses the instructions to retrieve raw datasets from a first-type device and train a feature extraction model, a transfer feature and a preliminary classify model based on the raw datasets. The processor further transfers the feature extraction model, the transfer feature and the preliminary classify model to a host of a manufacturer so that the host directly applies the feature extraction model and the transfer feature, and retrains the preliminary classify model as an adapted classify model based on practical datasets.

Abstract: A computer device and a method of identifying whether container behavior thereof is abnormal are provided. The computer device detects container behavior of a container in a time interval, and identifies whether the container behavior of the container is abnormal according to a container behavior identification module, thereby determining whether there is an intrusion. In addition, a decoy container can be installed in the computer device to attract attacking or invading from a third party so as to reduce the risk of the container being attacked, and the container behavior identification module can be updated according to the container behavior of the decoy container.

Abstract: A detection system and method thereof are provided. The detection method comprises the following steps: decompiling a first application package file to generate a plurality of first decompiled files, and the first decompiled files comprising a first decompiled code; comparing the first decompiled code with a second decompiled code of a second application package file to analyze a different code segment between the first decompiled code and the second decompiled code; classifying a changed code type corresponding to the different code segment according to a function call flow of the first decompiled code; loading a correspondence table and selecting at least one detection rule corresponding to the changed code type in the correspondence table; confirming a detection region of the first decompiled code according to the at least one detection rule; and detecting the detection region to generate a security detection result.

Abstract: A computer device and a method of identifying whether container behavior thereof is abnormal are provided. The computer device detects container behavior of a container in a time interval, and identifies whether the container behavior of the container is abnormal according to a container behavior identification module, thereby determining whether there is an intrusion. In addition, a decoy container can be installed in the computer device to attract attacking or invading from a third party so as to reduce the risk of the container being attacked, and the container behavior identification module can be updated according to the container behavior of the decoy container.

Abstract: A detection system and method thereof are provided. The detection method comprises the following steps: decompiling a first application package file to generate a plurality of first decompiled files, and the first decompiled files comprising a first decompiled code; comparing the first decompiled code with a second decompiled code of a second application package file to analyze a different code segment between the first decompiled code and the second decompiled code; classifying a changed code type corresponding to the different code segment according to a function call flow of the first decompiled code; loading a correspondence table and selecting at least one detection rule corresponding to the changed code type in the correspondence table; confirming a detection region of the first decompiled code according to the at least one detection rule; and detecting the detection region to generate a security detection result.