Abstract: Techniques for providing malicious script detection using transformer-based deep learning are disclosed. In some embodiments, a system/process/computer program product for providing malicious script detection using transformer-based deep learning includes receiving a sample for automated malicious script detection using a computing environment; processing the sample using a transformer model to generate a plurality of embeddings; processing the plurality of embeddings using an attention-based classifier; and generating an output vector to determine that the sample is a malicious script.

Abstract: The present application discloses a method, system, and computer system for identifying function signatures that are used to detect certain types of malware. The method includes: (a) performing disassembly of a plurality of input binaries to generate a set of function signatures, (b) determining a ranking of function signatures for the set of function signatures, and (c) automatically selecting a subset of function signatures for detecting a type of file, wherein the subset of function signatures is selected based at least in part on the ranking of function signatures.

Abstract: Assessments of guardrails of LLMs, whether used by an application or within an AI/LM stack, must be dynamic to protect against the ongoing engineering of jailbreaking prompts. An assessment framework has been created that facilitates assessment of language model guardrails. The assessment framework includes a prompt generator and has access to sensitive data (e.g., source code, trade secret, confidential documents, etc.) that occurs in training data of a model being assessed. The framework provides the prompt generator jailbreaking strategies and categories of the sensitive data (e.g., program code, trade secret, confidential document.). With the data categories and the strategies, the prompt generator generates different prompts and submits them to the AI-powered application or LM stack being assessed. The assessment framework then analyzes the outputs/responses from the AI-powered application or LM stack to determine whether guardrails have been subverted and any of the sensitive data has been exfiltrated.

Abstract: Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.

Abstract: Techniques for identifying vulnerabilities in binary files using a code signature are disclosed. In some embodiments, a system, a process, and/or a computer program product for identifying vulnerabilities in binary files using a code signature includes collecting a plurality of binary files associated with a vulnerability (e.g., a known vulnerability); determining a function in the plurality of binary files that includes the vulnerability; and automatically generating a code signature (e.g., including wildcarding one or more instructions of the function) for detecting the vulnerability in the plurality of binary files.

Abstract: Files are classified by file type based on reduced-size representations of the file contents (e.g., truncated versions of files) using a trained convolutional neural network (CNN). The CNN architecture includes a hidden layer comprising a Kolmogorov-Arnold Network (KAN) layer in lieu of a traditional fully connected layer. Training of the CNN employs a cost function that combines cross-entropy loss and contrastive loss for evaluating CNN performance. Training of the CNN is also incremental-when training a CNN for the task of classifying reduced-size files, the CNN is first trained on a training dataset comprising files of their original sizes. Once this initial phase of training is complete, the trained CNN is fine-tuned as a result of one or more additional phases of training, where each additional training phase uses a training dataset comprising reduced-size (e.g., truncated) versions of the files.

Abstract: An antenna pattern selection method includes a first communication device sending a plurality of packets to a second communication device. Then, the first communication device measures, in each of a plurality of antenna patterns, signal quality of a plurality of acknowledgment frames with which the second communication device separately responds to the plurality of packets, and finally selects a dominant antenna pattern from the plurality of antenna patterns based on signal quality corresponding to each of the plurality of antenna patterns. According to the antenna pattern selection method, when normal communication is not affected, the first communication device may determine, based on signal quality of an acknowledgment frame, whether an antenna pattern used by the first communication device is proper.

Abstract: Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.

Abstract: A system has been created that represents a binary file with a combination of signatures that account for both structure as expressed by control flow and an abstraction of functionality as expressed by import behavior. The system analyses intra-subroutine control flow and calls to import code units. The system generates structure signatures for the subroutines based on the intra-subroutine control flows. The system also generates an import behavior signature based on calls to import code units and caller-callee relationships between the subroutines and the import code units. The system uses the structure signatures to identify the caller subroutines in generating the import behavior signature. The combination of structure signatures and import behavior signature allows for accurate determination of code similarity without the noise of superficial variations in code organization and other mutations or alterations that facilitate avoiding malware detection.

Abstract: Techniques for identifying vulnerabilities in binary files using a code signature are disclosed. In some embodiments, a system, a process, and/or a computer program product for identifying vulnerabilities in binary files using a code signature includes collecting a plurality of binary files associated with a vulnerability (e.g., a known vulnerability); determining a function in the plurality of binary files that includes the vulnerability; and automatically generating a code signature (e.g., including wildcarding one or more instructions of the function) for detecting the vulnerability in the plurality of binary files.

Abstract: A system has been created that represents a binary file with a combination of signatures that account for both structure as expressed by control flow and an abstraction of functionality as expressed by import behavior. The system analyses intra-subroutine control flow and calls to import code units. The system generates structure signatures for the subroutines based on the intra-subroutine control flows. The system also generates an import behavior signature based on calls to import code units and caller-callee relationships between the subroutines and the import code units. The system uses the structure signatures to identify the caller subroutines in generating the import behavior signature. The combination of structure signatures and import behavior signature allows for accurate determination of code similarity without the noise of superficial variations in code organization and other mutations or alterations that facilitate avoiding malware detection.

Abstract: Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.

Abstract: Automatic generation of a malware signature is disclosed. Code of a sample including packages and function names is parsed. Standard type packages and vendor type packages are filtered from the code of the sample to obtain main type packages. A signature using a fuzzy hash for the sample is generated based on the main type packages. A determination of whether the sample is malware is performed using the signature and a similarity score threshold.

Abstract: Scan time in diffusion-relaxation magnetic resonance imaging (“MRI”) is reduced by implementing time-division multiplexing (“TDM”). In general, time-shifted radio frequency (“RF”) pulses are used to excite two or more imaging volumes. These RF pulses are applied to induce separate echoes for each slice. Diffusion MRI data can thus be acquired with different echo times, or alternatively with the same echo time, in significantly reduced overall scan time. Multidimensional correlations between diffusion and relaxation parameters can be estimated from the resulting data.

Abstract: An in-kernel virtual machine (“VM”) instantiated in the kernel space of a physical or virtual machine (“machine”) attaches code hooks at a network interface of the machine. The code hooks redirect network traffic from the network interface to a module that generates feature values at the kernel space from protocol data units of network traffic received by the network interface. The machine passes the feature values from kernel space to user space via zero-copy shared memory and a machine learning model in the user space obtains network traffic verdicts as outputs from inputting the feature values. The machine passes the verdicts from user space to kernel space via the zero-copy shared memory and the in-kernel VM performs corrective action based on malicious verdicts.

Abstract: Automatic generation of a malware signature is disclosed. Code of a sample including packages and function names is parsed. Standard type packages and vendor type packages are filtered from the code of the sample to obtain main type packages. A signature using a fuzzy hash for the sample is generated based on the main type packages. A determination of whether the sample is malware is performed using the signature and a similarity score threshold.

Abstract: Automated fuzzy hash based signature collection is disclosed. A set of candidate fuzzy hashes corresponding to a set of false negative samples is received. A false positive reduction analysis is performed on the received set of candidate fuzzy hashes to generate a reduced set of fuzzy hashes. At least a portion of the reduced set of fuzzy hashes is clustered into a fuzzy hash cluster. A signature for a family of malware is generated based at least in part on the fuzzy hash cluster.

Abstract: A pickup is provided. The pickup is configured to be mounted to a bone conduction organ in the mouth, the pickup includes a detection module, and the detection module is configured to detect a vibration signal of the bone conduction organ. A communication device and a communication apparatus are also provided. The communication device includes a signal receiving module, a control module, and a communication module.

Abstract: A hearing aid intra-oral device, configured as an intra-orally placed bone conduction sound-transmitting device. The hearing aid intraoral device comprises a vibration apparatus and a detection apparatus, the vibration apparatus being configured to drive the bone conduction sound-transmitting device to vibrate, and the detection apparatus being configured to detect a vibration signal of the bone conduction sound-transmitting device.

Abstract: Automated fuzzy hash based signature collection is disclosed. A set of candidate fuzzy hashes corresponding to a set of false negative samples is received. A false positive reduction analysis is performed on the received set of candidate fuzzy hashes to generate a reduced set of fuzzy hashes. At least a portion of the reduced set of fuzzy hashes is clustered into a fuzzy hash cluster. A signature for a family of malware is generated based at least in part on the fuzzy hash cluster.