Abstract: Methods and systems for process constraint include collecting system call information for a process. It is detected whether the process is idle based on the system call information and then whether the process is repeating using autocorrelation to determine whether the process issues system calls in a periodic fashion. The process is constrained if it is idle or repeating to limit an attack surface presented by the process.

Abstract: A hybrid vehicle, an air conditioning system and a method for controlling the air conditioning system are provided. The air conditioning system includes: an electric compressor; a mechanical compressor, connected with the electric compressor in parallel; a power battery, connected with the electric compressor and configured to supply power to the electric compressor; an engine, connected with the mechanical compressor and configured to supply a power source to the mechanical compressor; an engine controller, connected with the engine and configured to start the engine when the mechanical compressor is to be started; a battery manager, connected with the power battery and configured to detect a state of charge of the power battery; and a controller, connected with the engine controller and the battery manager and configured to start the electric compressor and the mechanical compressor at different time according to the state of charge of the power battery.

Abstract: A data stream system includes one or more monitored machines generating real-time data stream that describes system activities of the monitored machines; a data stream management module receiving the real-time data stream; and a data stream archiving module coupled to the data stream management module, the data stream archiving module including a data stream receiver and a data stream inserter.

Abstract: Embodiments of automated cloud service performance prediction are disclosed. The automated cloud service performance prediction includes extracting one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original performance metric value and original timing information associated with a page loading of a webpage. The prediction also includes simulating a page loading of the webpage based on the adjusted timing information and the dependency relationships to estimate a new performance metric value associated with the simulated page loading of the webpage. The prediction additionally includes comparing the original performance metric value to the new performance metric value to determine whether the adjusted timing information increased or decreased the new performance metric value relative to the original performance metric value.

Abstract: A system and method for detecting sensitive user input leakages in software applications, such as applications created for smartphone platforms. The system and method are configured to parse user interface layout files of the software application to identify input fields and obtain information concerning the input fields. Input fields that contain sensitive information are identified and a list of sensitive input fields, such as contextual IDs, is generated. The sensitive information fields are identified by reviewing the attributes, hints and/or text labels of the user interface layout file. A taint analysis is performed using the list of sensitive input fields and a sink dataset in order to detect information leaks in the sensitive input fields.

Abstract: A method and system for constructing behavior queries in temporal graphs using discriminative sub-trace mining. The method includes generating system data logs to provide temporal graphs, wherein the temporal graphs include a first temporal graph corresponding to a target behavior and a second temporal graph corresponding to a set of background behaviors, generating temporal graph patterns for each of the first and second temporal graphs to determine whether a pattern exists between a first temporal graph pattern and a second temporal graph pattern, wherein the pattern between the temporal graph patterns is a non-repetitive graph pattern, pruning the pattern between the first and second temporal graph patterns to provide a discriminative temporal graph, and generating behavior queries based on the discriminative temporal graph.

Abstract: Methods and systems for intrusion attack recovery include monitoring two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated based on the audit logs. A relevancy score for each edge of the DGraphs is determined. Irrelevant events from the DGraphs are pruned to generate a condensed backtracking graph. An origin is located by backtracking from an attack detection point in the condensed backtracking graph.

Abstract: Systems and methods for detection and prevention of Return-Oriented-Programming (ROP) attacks in one or more applications, including an attack detection device and a stack inspection device for performing stack inspection to detect ROP gadgets in a stack. The stack inspection includes stack walking from a stack frame at a top of the stack toward a bottom of the stack to detect one or more failure conditions, determining whether a valid stack frame and return code address is present; and determining a failure condition type if no valid stack frame and return code is present, with Type III failure conditions indicating an ROP attack. The ROP attack is contained using a containment device, and the ROP gadgets detected in the stack during the ROP attack are analyzed using an attack analysis device.

Abstract: Systems and methods are disclosed for protecting privacy in an application software (app) by detecting application repacking; detecting application tainting, including: detecting descrying information leakage; detecting vulnerability espial; and detecting a privacy leak.

Abstract: Methods and systems for process constraint include collecting system call information for a process. It is detected whether the process is idle based on the system call information and then whether the process is repeating using autocorrelation to determine whether the process issues system calls in a periodic fashion. The process is constrained if it is idle or repeating to limit an attack surface presented by the process.

Abstract: Systems and methods are disclosed for protecting privacy in an application software (app) by detecting application repacking; detecting application tainting, including: detecting descrying information leakage; detecting vulnerability espial; and detecting a privacy leak.

Abstract: There is provided a method for quantitatively detecting 8-oxo 2?-deoxyguanosine in an aqueous sample solution with high sensitivity. A method for quantitatively detecting 8-oxo 2?-deoxyguanosine in an aqueous sample solution, including the steps of 1) immobilizing a fluorescent probe molecule showing a fluorescence response specific to 8-oxo 2?-deoxyguanosine on surfaces of fine particles via a spacer unit and bringing the sample solution into contact with the fine particles, and 2) measuring a physical property of the fine particles before and after the contact with the sample solution to determine a change in the physical property.

Abstract: A method for scalable analysis of Android applications for security includes applying Android application analytics to an Android application, which in turn includes applying an application taint tracking to the Android application and applying application repacking detection to the Android application, and determining security vulnerabilities in the Android application responsive to the analytics.

Abstract: There is provided a method for quantitatively detecting 8-oxo 2?-deoxyguanosine in an aqueous sample solution with high sensitivity. A method for quantitatively detecting 8-oxo 2?-deoxyguanosine in an aqueous sample solution, including the steps of 1) immobilizing a fluorescent probe molecule showing a fluorescence response specific to 8-oxo 2?-deoxyguanosine on surfaces of fine particles via a spacer unit and bringing the sample solution into contact with the fine particles, and 2) measuring a physical property of the fine particles before and after the contact with the sample solution to determine a change in the physical property.

Abstract: Systems, methods, and apparatus are provided for vulnerability signature based Network Intrusion Detection and/or Prevention which achieves high throughput comparable to that of the state-of-the-art regex-based systems while offering improved accuracy. A candidate selection algorithm efficiently matches thousands of vulnerability signatures simultaneously using a small amount of memory. A parsing transition state machine achieves fast protocol parsing. Certain examples provide a computer-implemented method for network intrusion detection. The method includes capturing a data message and invoking a protocol parser to parse the data message. The method also includes matching the parsed data message against a plurality of vulnerability signatures in parallel using a candidate selection algorithm and detecting an unwanted network intrusion based on an outcome of the matching.

Abstract: Web page load time prediction is achieved by simulating and adjusting the load times of web objects in a webpage to determined adjustments that optimize an overall page load time (PLT) of the webpage. The webpage load time prediction includes extracting a parental dependency graph (PDG) for the webpage. The PDG encapsulates one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original PLT and original timing information of a webpage. The prediction also includes simulating a page loading of the webpage based on adjusted timing information of each web object and the PDG to estimate a new PLT of the webpage. The prediction additionally includes comparing the original PLT of the webpage to the new PLT of the webpage to determine whether the adjusted timing information increased or decreased the new PLT of the webpage.

Abstract: Embodiments of automated cloud service performance prediction are disclosed. The automated cloud service performance prediction includes extracting a parental dependency graph (PDG) for a webpage. The PDG encapsulates one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original page load time (PLT) and original timing information of a webpage. The prediction also includes simulating a page loading of the webpage based on adjusted timing information of each web object and the PDG to estimate a new PLT of the webpage. The prediction additionally includes comparing the original PLT of the webpage to the new PLT of the webpage to determine whether the adjusted timing information increased or decreased the new PLT of the webpage.

Abstract: Web page load time production and simulation includes determining an original page load time (PLT) of a webpage and timing information of each web object of the web page in a scenario. Each object is also annotated with client delay information based on a parental dependency graph (PDG) of the web page. The time information of each web object is further adjusted to reflect a second scenario that includes one or more modified parameters. The page loading of the web page is then simulated based on the adjusted timing information of each web object and the PDG of the web page to estimate a new PLT of the web page.

Abstract: Embodiments of automated cloud service performance prediction are disclosed. The automated cloud service performance prediction includes extracting a parental dependency graph (PDG) for a webpage. The PDG encapsulates one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original page load time (PLT) and original timing information of a webpage. The prediction also includes simulating a page loading of the webpage based on adjusted timing information of each web object and the PDG to estimate a new PLT of the webpage. The prediction additionally includes comparing the original PLT of the webpage to the new PLT of the webpage to determine whether the adjusted timing information increased or decreased the new PLT of the webpage.

Abstract: Systems, methods, and apparatus are provided for vulnerability signature based Network Intrusion Detection and/or Prevention which achieves high throughput comparable to that of the state-of-the-art regex-based systems while offering improved accuracy. A candidate selection algorithm efficiently matches thousands of vulnerability signatures simultaneously using a small amount of memory. A parsing transition state machine achieves fast protocol parsing. Certain examples provide a computer-implemented method for network intrusion detection. The method includes capturing a data message and invoking a protocol parser to parse the data message. The method also includes matching the parsed data message against a plurality of vulnerability signatures in parallel using a candidate selection algorithm and detecting an unwanted network intrusion based on an outcome of the matching.