Abstract: A system, method, and device for detecting Command and Control (C2) traffic is disclosed. The method includes (i) converting, by one or more processors, a header for network traffic to a header representation having a smaller dimensionality than the header, (ii) querying a classifier based at least in part on the header representation to obtain a traffic classification, (iii) automatically detecting C2 traffic based at least in part on the traffic classification, and (iv) handling the network traffic based at least in part on the traffic classification.

Abstract: Various techniques for LLM powered detection reasoning solutions are disclosed. In some embodiments, a system, a process, and/or a computer program product for an LLM powered detection reasoning solution includes monitoring network traffic at a security platform, wherein the security platform generates a sample based on the monitored network traffic; sending the sample to a security service to generate a Large Language Model (LLM) powered detection and reason, wherein the LLM is prompted to automatically generate a malware or benign verdict and a reason for explaining the verdict; and reporting the LLM powered detection and reason.

Abstract: A physical downlink control channel (PDCCH) monitoring method is used to reduce power consumption of a terminal device. The method includes obtaining a first discontinuous reception (DRX) parameter used to configure a first DRX and a second DRX parameter used to configure a second DRX. A start time of a first cycle period of the first DRX is t1, a start time of a second cycle period of the second DRX is t2, and t1 is earlier than t2. When a time difference between t1 and t2 is less than a first threshold, PDCCH monitoring is initiated at a time t3, where t3 is no later than t2 and t3 is later than t1. This enables the terminal device to delay the start time of the first cycle period, reducing the time of PDCCH monitoring, thereby reducing power consumption of the terminal device.

Abstract: A cybersecurity intelligence system maintains a current view of published cybersecurity issues by periodically crawling websites that publish information about cybersecurity issues, including first impression issues and updates to issues. The system aggregates unstructured descriptions for a same issue. For each published issue detected from crawling, the system prompts a foundation model to generate a structured representation that can be consumed. The structured representation includes key-value pairs corresponding to issue type and affected vendor product. Distilling and consolidating the issue descriptions into these informational components intelligently surfaces salient features of the information for addressing issues. After some quality assurance of the structured representations from the model, the structured representations are published for access by consumers.

Abstract: Techniques for inline exploit detection via loose condition forwarding and cloud analysis (e.g., cloud-based security analysis) are disclosed. In some embodiments, a system/process/computer program product for inline exploit detection via loose condition forwarding and cloud analysis includes monitoring network traffic of a session at a security platform; selecting a subset of the monitored network traffic associated with the session to send to a cloud-based security service for analysis based on a security policy, wherein the selected subset of the monitored network traffic is determined to be associated with suspicious session traffic that is selected using a prefilter condition (e.g., a prefilter signature, heuristics, machine learning implemented prefiltering condition, etc.) for an unknown exploit; and receiving, from the cloud-based security service, results of the analysis based on the security policy, and performing a responsive action based on the results of the analysis based on the security policy.

Abstract: A security feed normalizer aggregates and normalizes threat intelligence data across security feeds and extracts threat descriptors of cybersecurity threats from the aggregated/normalized data. A first large language model (LLM) determines whether each threat descriptor is informative, i.e., comprises sufficient information for reproducing/generating network traffic of the corresponding cybersecurity threat. For informative threat descriptors, a second LLM generates network traffic for the corresponding cybersecurity threats. The generated network traffic is used for subsequent remediation of corresponding threats.

Abstract: A system facilitates multi-session, multi-aspect analysis of conversations between users and applications that leverage language models (“generative AI applications”). The system retrieves conversation logs for conversations carried out between users and a generative AI application(s) and sorts the conversation logs by conversation. The system analyzes the conversations in multiple aspects for various use cases: security, analytics, and organizational compliance. In the security analysis, the system analyzes the queries and responses of each conversation to determine if the conversation includes a multi-turn attack. For the analytics and organization compliance use cases, the system evaluates how end users are using the generative AI application(s) across conversations to provide customers with additional insights, such as the spread of subject matter areas for which employees are using the generative AI application(s).

Abstract: A genetic algorithm is implemented to generate prompts that evade content filters of generative artificial intelligence (AI) systems. The genetic algorithm applies grammar operations to mutate candidate prompts, communicates the candidate prompts to generative AI systems, and selects candidate prompts that successfully evade content filters according to corresponding responses. A disambiguation model that corrects grammar in prompts is tested on the selected prompts to determine if grammar is properly corrected. Once tested, the disambiguation model is deployed in an ensemble with a classifier that outputs verdicts for prompts with grammar corrected by the disambiguation model.

Abstract: In a described example, an example no-lead semiconductor device package includes: a die pad in a central portion of a partially etched leadframe and terminals. The terminals include a device side surface formed in an upper layer of the partially etched leadframe, and a first exterior end in the upper layer; a board side surface formed in a lower layer of the partially etched leadframe extending from the upper layer; a second exterior end in the lower layer, the second exterior end inset from the first exterior end, and an inset portion extending from the first exterior end to the second exterior end. A semiconductor die is mounted to the die pad. Mold compound covers the semiconductor die, the second exterior end of the terminals and the inset portion of the terminals are exposed from the mold compound, with the mold compound extending along sides of the terminals.

Abstract: An image transform model and an image recovery model in the present disclosure are trained to obfuscate hidden malicious payloads in original images and recover the original images from the obfuscated/transformed images, respectively. The image transform model is trained on known malicious images as an ensemble with an adversarial discriminator that predicts whether malicious payloads are recoverable from transformed images output by the image transform model. The trained image transform model is then fixed and used to generate transformed images from the known malicious images, and the transformed images are used as training data for the image recovery model to recover the corresponding (original) known malicious images.

Abstract: A communication method, a communication apparatus, and a storage medium are provided. The method includes obtaining first information from a core network. The first information is configured to indicate a correspondence between a first data packet and a second data packet. Adjusting a delay budget of the second data packet based on the first information and second information. The second information is related to a transmission status of the first data packet.

Abstract: A service transmission method and apparatus. The service transmission method includes: an application function network element indicates N QoS flows or N PDU sets to an access network device. The access network device may select, from the N QoS flows or the N PDU sets based on a plurality of factors such as a current network status and a channel status, M QoS flows or M PDU sets that can ensure a current service transmission delay, and indicate the M QoS flows or the M PDU sets to the application function network element. The application function network element selects, from the M QoS flows or the M PDU sets, a QoS flow or a PDU set used for service transmission. The service transmission delay can be ensured by using the service transmission method in embodiments.

Abstract: Various techniques for LLM powered detection reasoning solutions are disclosed. In some embodiments, a system, a process, and/or a computer program product for an LLM powered detection reasoning solution includes monitoring network traffic at a security platform, wherein the security platform generates a sample based on the monitored network traffic; sending the sample to a security service to generate a Large Language Model (LLM) powered detection and reason, wherein the LLM is prompted to automatically generate a malware or benign verdict and a reason for explaining the verdict; and reporting the LLM powered detection and reason.

Abstract: A user equipment (UE) may monitor a channel for wireless communication associated with a first radio access technology (RAT) during one or more of a first active duration or a first inactive duration. The UE may operate in a first power mode during the first inactive duration. The UE may monitor the channel for wireless communication associated with a second RAT during one or more of a second active duration or a second inactive duration. The UE may operate during the second inactive duration in one or more of the first power mode or a second power. The UE may operate according to the first mode or the second mode based on the monitoring of the channel associated with the first RAT and the second RAT.

Abstract: Conflicting aliases in database queries are identified with a graph-based approach. A conflict detector builds a base graph comprising nodes representing the database's tables and fields and edges representing relationships between the tables and fields. The detector iterates over one or more database queries and augments the base graph with nodes representing aliases of tables/fields identified in each database query. The detector inserts an edge between each node corresponding to an alias and the node of the base graph corresponding to the aliased table or field. For table aliases, the detector inserts an edge between the table alias node and each node of the base graph corresponding to a field of the table that is indicated in the database query. The detector evaluates the augmented graph for the presence of cycles that indicate that the database query(ies) represented in nodes therein include conflicting aliases.

Abstract: A security feed normalizer aggregates and normalizes threat intelligence data across security feeds and extracts threat descriptors of cybersecurity threats from the aggregated/normalized data. A first large language model (LLM) determines whether each threat descriptor is informative, i.e., comprises sufficient information for reproducing/generating network traffic of the corresponding cybersecurity threat. For informative threat descriptors, a second LLM generates network traffic for the corresponding cybersecurity threats. The generated network traffic is used for subsequent remediation of corresponding threats.

Abstract: Techniques for inline exploit detection via loose condition forwarding and cloud analysis (e.g., cloud-based security analysis) are disclosed. In some embodiments, a system/process/computer program product for inline exploit detection via loose condition forwarding and cloud analysis includes monitoring network traffic of a session at a security platform; selecting a subset of the monitored network traffic associated with the session to send to a cloud-based security service for analysis based on a security policy, wherein the selected subset of the monitored network traffic is determined to be associated with suspicious session traffic that is selected using a prefilter condition (e.g., a prefilter signature, heuristics, machine learning implemented prefiltering condition, etc.) for an unknown exploit; and receiving, from the cloud-based security service, results of the analysis based on the security policy, and performing a responsive action based on the results of the analysis based on the security policy.

Abstract: A system, method, and device for detecting Command and Control (C2) traffic is disclosed. The method includes (i) converting a monitored traffic sample to an image representation, (ii) querying a classifier based at least in part on the image representation to obtain a traffic classification, (iii) automatically detecting C2 traffic based at least in part on the traffic classification, and (iv) handling the network traffic based at least in part on the traffic classification.

Abstract: A first terminal device sends a resource configuration request to an access and mobility management function network element. The access and mobility management function network element sends a response message to the first terminal device, to indicate whether a semantic library is available. When the semantic library is available, the access and mobility management function network element sends a resource configuration indication to a resource controller, to perform resource reservation and resource instantiation configuration. When the semantic library is available, the first terminal device sends first information to the access and mobility management function network element. The first information carries a key required for configuring a computing environment.