Abstract: In embodiments of the present invention, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation. In response to the selection of a file, an application controller may be used to select a software application from two or more software applications to open the selected file, based at least in part on the selected file's reputation. If launched, a software application may be configured to open the file in an environment, such as a virtual machine, quarantined environment, and the like, that is appropriate for the file based at least in part on the reputation information. A software application may be a secure software application configured to manage secure files, or an insecure software application configured to manage insecure files.

Abstract: Techniques for sample traffic based self-learning malware detection are disclosed. In some embodiments, a system/process/computer program product for sample traffic based self-learning malware detection includes receiving a plurality of samples for malware detection analysis using a sandbox; executing each of the plurality of samples in the sandbox and monitoring network traffic during execution of each of the plurality of samples in the sandbox; detecting that one or more of the plurality of samples is malware based on automated analysis of the monitored network traffic using a command and control (C2) machine learning (ML) model if there is not a prior match with an intrusion prevention system (IPS) signature; and performing an action in response to detecting that the one or more of the plurality of samples is malware based on the automated analysis of the monitored network traffic using the C2 ML model. In some embodiments, the IPS signatures and C2 ML model are automatically generated and trained.

Abstract: A script analysis platform may obtain a script associated with content wherein the script includes one or more functions that include one or more expressions. The script analysis platform may parse the script to generate a data structure and may traverse the data structure to determine the one or more functions and to determine properties of the one or more expressions, wherein traversing the data structure includes evaluating one or more constant sub-expressions of the one or more expressions. The script analysis platform may analyze the properties of the one or more expressions to determine whether the script exhibits malicious behavior. The script analysis platform may cause an action to be performed concerning the script or the content based on determining whether the script exhibits malicious behavior.

Abstract: In general, in one aspect, a method for machine learning recognition of portable executable files as malware includes providing training data comprising features of portable executable files and a descriptive information for the portable executable files, the descriptive information comprising a family or type of malware. The method may include training a model using the training data to detect malware. The method may include using the trained model to recognize malware by providing features of a portable executable file as input and providing a threat score and descriptive information as output.

Abstract: The disclosed technology teaches reducing threat detection processing by applying similarity measures. The method includes recognizing that a file is an edited version of a previously processed file and retrieving, from an archive, at least an entropy measure of the previously processed file, and calculating an entropy measure for the edited version of the file. The method applies a similarity measure to compare the entropy measures for the edited version and the previously processed file, avoiding full threat scanning of the file to detect malware except when the similarity measure reaches a scanning trigger. When any similarity measure or combination of similarity measures reaches a trigger, the technology teaches processing the file by using a threat detection module to detect malware. Further included is logging the edited version of the file for further processing when the similarity measure reaches a logging trigger.

Abstract: A system and method for detecting and preventing ransomware includes creating a number of watch files in a filesystem and adding a location and a timestamp of each to an ingest log. A number of native files are found in the filesystem and cataloged, adding the location and the timestamp of each to the ingest log. Periodically, each timestamp of each entry in the ingest log is compared to a current timestamp of a corresponding file in the filesystem and a count of watch files that have change and a count of native files that have changed is made. If the count of watch and native files that have changed indicate that a ransomware program is running on the computer, the ransomware program is suspended and reported. If a command indicates that the ransomware program is not ransomware, execution of the program is resumed.

Abstract: Techniques and architectures for representing data with one or more n-dimensional representations and/or using one or more models to identify malware are described herein. For example, the techniques and architectures may determine one or more coordinates for one or more points based on one or more sets of bits in the data and generate an n-dimensional representation for the data based on the one or more points. The techniques and architectures may evaluate the n-dimensional representation with one or more machine-trained models to detect malware.

Abstract: Upon receiving malware detection rules that are to be identified with respect to an input traffic stream, a rule database that requires less storage capacity than the malware detection rules is generated by substituting tokens for selected symbol strings within the malware detection rules. A compressed traffic stream is generated by substituting the tokens for instances of the selected symbol strings within the input traffic stream, and then compared with the rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the malware detection rules.

Abstract: Examples disclosed herein relate to integrity monitoring of a computing system. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring.

Abstract: Methods, systems, and computer programs are presented for secure data encryption in a multi-tenant service platform. One method includes an operation for detecting a write request to write index data to storage. The write request is from a first user from a group of users, and the storage is configured to store index data for the group of users. Further, the method includes operations for authenticating that the first user is approved for access to the storage, and for identifying a first encryption key for the first user, where each user from the group of users has a separate encryption key. Further yet, the method includes encrypting the index data with the first encryption key and storing the encrypted index data in the storage.

Abstract: A fork support is provided for duplicating an application running inside an enclave entity. In this regard, a request to duplicate an application running inside a first enclave may be received by one or more processors of a host computing device of the first enclave. A snapshot of the first enclave including the application may be generated. The snapshot may be encrypted with a snapshot key and copied to untrusted memory of the host. A second enclave may be generated. The snapshot key may be sent from the first enclave to the second enclave through a secure communication channel. The encrypted snapshot may be copied from the untrusted memory of the host into the second enclave. The encrypted snapshot may be decrypted inside the second enclave with the snapshot key.

Abstract: A method includes receiving historical interaction data, which includes a plurality of historical interactions. Each historical interaction is associated with a plurality of data fields. The method includes assigning a plurality of weights to the plurality of data fields, generating a neural network using the plurality of weights and the plurality of data fields, identifying a first plurality of feature indicators indicative of a first class, the first class being different from a second class; receiving a second plurality of feature indicators derived from data relating to compromised accounts, updating, a probability distribution component using the first plurality of feature indicators and the second plurality of feature indicators, and receiving current data for an interaction. The method also includes applying the probability distribution component to the current data, and scoring the interaction using the probability distribution component.

Abstract: A device includes a memory and a processor. The processor is to execute the instruction to: receive, from a user device, a username of a user and a string; retrieve a first Message Authentication Code (MAC) and a salt from a database in response to receiving the username and the string; send the first MAC, the salt, and one or more parameters to a Hardware Security Module (HSM); receive, from the HSM, a message indicating whether the first MAC matches a second MAC that the HSM generates based on the one or more parameters and the salt. In addition, the processor to perform one of: authenticate the user when the message indicates that the first MAC matches the second MAC; or not authenticate the user when the message indicates that the first MAC does not match the second MAC.

Abstract: Systems and methods for data aggregated based on disparate local processing of requests. One of the methods includes receiving a request associated with analyzing medical data, the request specifying one or more constraints; accessing index information, and identifying one or more medical providers storing medical data responsive to the request; instructing, for each medical provider, compute systems controlled by the medical provider to perform the request; receiving, from the medical providers, results associated with the request, and aggregating the results; providing the aggregated results in response to the request.

Abstract: A data management device manages personal data to which consent information indicating a data user authorized as a receiver has been added. The data management device includes: a cache memory and a processor. When personal data requested by a data user is stored in the cache memory, the processor acquires the requested personal data from the cache memory. When personal data requested by the data user is not stored in the cache memory, the processor acquires the requested personal data from a data holder. The processor decides based on consent information added to the personal data acquired whether to provide the personal data to the data user. When the data management device acquires new personal data from a data holder, the processor decides whether to store the new personal data in the cache memory based on consent information added to the new personal data.

Abstract: An apparatus includes a memory, a communication interface in communication with a network, a first processor, and a second process different from the first processor. The first processor configured to receive data from a user device and to separate the data into a first data set including metadata associated with a user of the user device and a second data set including anonymized data associated with a set of actions to be performed on a predetermined schedule. The second processor is configured to receive the second data set from the first processor and a user input associated with a selection of a simulation and at least one additional action otherwise not included in the set of actions. The second processor configured to perform the simulation using the second data set to simulate an acceleration of the predetermined schedule as a result of the at least one additional action.

Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for sending and receiving requests to delete and/or retrieve certain data. Example methods may include sending from an electronic device a request to delete and/or retrieve selected data from a server based on selected categories, receiving the request at the server, and determining data to delete and/or retrieve on the server based on the request from the electronic device, deleting and/or retrieving the data on the server, and/or sending the retrieved selected to the electronic device.

Abstract: Some embodiments of the present disclosure disclose methods and systems for assessing the data risk management capabilities of data processors that receive second-party data as part of an engagement to provide support services. In some embodiments, the transfer of the second-party data to the data processors can be monitored to identify file transfers including unauthorized personally identifiable information (PII) attributes. In some embodiments, the database of the data processor may be scanned to locate any residual second-party data that should be removed after the data processor's engagement to provide the support services have expired.

Abstract: A security object management system may include a management module including a device processor and a non-transitory computer readable medium including instructions stored thereon, and executable by the processor, for performing the following steps: accessing a database having stored therein data regarding a plurality of security objects, wherein the data includes ownership data regarding the assignment of rights associated with the security objects; and receiving user input to certify the accuracy of data associated with at least one of the security objects; wherein the computer readable medium further includes instructions for, in response to a change in data associated with a security object, executing a write back function whereby the change in the data is stored in a database that is accessible by a third party having access rights exclusive of ownership and administrator rights of the security object in the database.

Abstract: Provided are an image processing method, an image matching method, a device, and a storage medium. The image processing method includes: obtaining an image feature of an input image; determining a plurality of local image features of the image feature; determining a plurality of local feature vectors corresponding to the plurality of local image features respectively; determining a hash code of the input image based on the plurality of local feature vectors.

Abstract: An inspection apparatus includes an image-capturing unit configured to capture an image of an article, an inspection unit configured to inspect the article, a generation-processing unit, and a storage-processing unit. The generation-processing unit generates a data group related to an inspection result obtained by the inspection unit, the data group including article information for distinguishing the article, the inspection result obtained by the inspection unit, captured-image information for distinguishing a captured image captured by the image-capturing unit from another captured image, and a hash value of the captured image that are associated with each other. The storage-processing unit stores the data group and the captured image in respective different storage units.

Abstract: Disclosed implementations may include receiving a first communication comprising first content generated by a first user; identifying authentication metadata embedded within the first communication; receiving a second communication generated by a second user, wherein the second communication comprises second content and the authentication metadata; decoding the authentication metadata from the second communication; parsing the first content of the first communication and the second content of the second communication; determining that the first content is different than the second content based at least in part on the parsing; and generating an alteration notification based at least in part on the determining.

Abstract: In one embodiment, a system includes a non-volatile memory that may serve as both the main memory system and the backing store (or persistent storage). In some embodiments, the non-volatile memory is divided into a main memory portion and a persistent portion. Data in the main memory operation may be encrypted using one or more first keys, and data in the persistent portion may be encrypted using one or more second keys, in an embodiment. The volatile behavior of main memory may be implemented by discarding the one or more first keys in a power down event or other event that indicates a loss of main memory data, while the one or more second keys may be retained. In one embodiment, the physical address space of the non-volatile memory may be a mapping from a second physical address space that is used within the system.

Abstract: A processing device sets a first flag that indicates whether a first critical security parameter (CSP) file exists. The first CSP file includes a first set of CSPs for a memory device. The processing device sets a second flag that indicates whether the first CSP file is valid. The processing device sets a third flag that indicates whether a second CSP file exists. The second CSP file includes a second set of CSPs for the memory device. The processing device sets a fourth flag that indicates whether the second critical security parameter file is valid. The processing device selects one of the first or second CSP file as an active CSP file based on an evaluation of the first, second, third, and fourth flags.

Abstract: Product displays are used to hold and present products. A method of manufacturing a product display can include forming display unit and cartridge blanks for assembly into a product display that has been designed using a product display design model executed on a computing device. A dataset of standardized units is created and includes products, cartridges, and display units. The product display design model generates product display design options that specify geometric arrangements of cartridges within display units, where the cartridges are each associated with a product type. The geometric arrangements are based on inputs that include combinations of a target total product count, a target mix ratio, product types, and a product display type. Display unit blanks and cartridge blanks used to construct display units and cartridges of the product display are formed by a manufacturing device based on a generated product display design option.

Abstract: A processor may receive a geofence perimeter of a geospatial region. The processor may analyze one or more objects within the geofence perimeter. The processor may generate a digital twin ecosystem. The digital twin ecosystem may include digital copies of the one or more objects. The processor may present a simulation of the digital twin ecosystem to a user.

Abstract: Systems and methods are disclosed for automatically adjusting a workspace comprising a plurality of nodes for sustained workflow. One method comprises receiving a new node in the workspace and determining that the new node overlaps with one or more nodes. Based on the determination, a set of nodes within a predetermined distance of the overlap may be repositioned, the set of nodes comprising the new node and the one or more nodes. Upon determining that the new node still overlaps with the one or more nodes, the set of nodes may be scaled down until there is no overlap.

Abstract: A method of determining placement of pipes within a fire suppression system including: obtaining a layout of nozzles within a room for a fire suppression system; determining a number of pipes, a length of each of the pipes, and a location of each of the pipes to connect each nozzle within the room to a fire suppression agent source in response to the layout of nozzles within the room; determining locations of junctions and elbows to interconnect the pipes; and determining whether the pipe, junctions, and elbows violate a piping constraint.

Abstract: A building system including one or more storage devices storing instructions thereon that, when executed by one or more processors, cause the one or more processors to receive an indication to execute an artificial intelligence (AI) agent, execute the AI agent based on the digital twin to generate an inference or a prediction, cause a graphical model of the building including graphical representations of the entities to include information based on the inference or the prediction, and cause a display device of a user device to display the graphical model.

Abstract: Methods and systems are disclosed for generatively designing a model of an assembly of mechanical parts. One method includes receiving a first set of constraints for a first part; determining a spatial relationship between the first part and a second part; updating the first set of constraints for the first part based on at least the spatial relationship between the first part and the second part; updating a second set of constraints for the second part based on at least the updated first set up constraints and/or the spatial relationship between the first part and the second part; and generating a model for the first part based on the updated first set of constraints.

Abstract: A drill bit design generator uses drill bit metrics to generate drill bit designs with reduced 3D coupled vibration. The drill bit design generator generates an initial set of drill bit designs that are simulated in a deployed or artificial environment. Simulated drill bits according to the initial drill bit designs have gyroscopic sensors that detect the presence of 3D coupled vibration. A drill bit simulator tracks metrics such as side cutting efficiency and drilling efficiency during simulations and correlates these metrics with 3D coupled vibration. The drill bit design generator determines thresholds for these metrics using correlations with 3D coupled vibration and generates updated/new drill bit designs using the metric thresholds.

Abstract: A multiple fluid model tool for utilizing a 3D CAD point-cloud to automatically create a fluid model is presented. For example, a system includes a modeling component, a machine learning component, and a three-dimensional design component. The modeling component generates a three-dimensional model of a mechanical device based on point cloud data indicative of information for a set of data values associated with a three-dimensional coordinate system. The machine learning component predicts one or more characteristics of the mechanical device based on input data and a machine learning process associated with the three-dimensional model. The three-dimensional design component that provides a three-dimensional design environment associated with the three-dimensional model. The three-dimensional design environment renders physics modeling data of the mechanical device based on the input data and the one or more characteristics of the mechanical device on the three-dimensional model.

Abstract: A method of modeling an equivalent wind turbine generator (WTG) system for a wind farm having a plurality of WTG units includes determining an impact factor of each WTG unit of the plurality of WTG units, determining an equivalent single WTG unit model parameters of the wind farm based on the impact factor of each WTG unit, and determining an effective wind speed of the wind farm to use as the equivalent WTG input wind speed. The method produces a model of static and/or dynamic wind farm behavior. Additionally, a software configured to execute a method of modeling an equivalent wind turbine generator (WTG) system for a wind farm having a plurality of WTG units.

Abstract: Methods for selecting a filter for a filtration process are described. Input data is received, and based on the input data, one or more filter characteristics for each of a plurality of filter candidates for a filtration process are identified. Process parameters of the filtration process are identified. A computer-implemented simulation process of the filtration process for each of the plurality of filter candidates is performed, based on the identified process parameters and identified filter characteristics. One or more output characteristics of the filtration process are determined based on the simulation. A filter candidate of the plurality of filter candidates is selected based on the one or more output characteristics.

Abstract: An optimization method executed by a computer upon attempting to solve a ground state of an Ising model by simulating a state change of the Ising model when a magnetic field applied to the Ising model is reduced, the Ising model representing a problem to be solved, the method including: executing a first process, the first process being a real time propagation in which an intensity of the magnetic field is reduced with progress of time in simulation; and in response to the progress of time in the real time propagation of the first process, executing a second process, the second process including reducing energy of the Ising model based on an imaginary time propagation method.

Abstract: Apparatuses, methods, and systems for generating simulations of physical variables of a physical system are disclosed. A method includes fusing observation data and numeric simulation data. The fusing includes preprocessing the observational data and the numeric simulation data to remove inconsistencies of the observational data and the numeric simulation data, processing the preprocessed observational data and the numeric simulation data to extract interpretable structures and patterns within that data using ground truth and labeled information to create domain interpretable data, normalizing the preprocessed observation data, the numeric simulation data, and the domain interpretable data layers.

Abstract: According to some embodiments, system and methods are provided comprising receiving, via a communication interface of a distortion and correction module comprising a processor, a defined geometry for one or more parts, wherein the parts are manufactured with an additive manufacturing machine; discretizing the defined geometry into a mesh including a plurality of nodes; predicting a distortion of a position of each node of the plurality of nodes; determining whether the predicted distortion position exceeds a pre-set tolerance; determining an adjusted pre-distortion position for each node of the plurality of nodes when the predicted distortion position exceeds the pre-set tolerance; predicting a distortion of the adjusted determined pre-distortion position for each node of the plurality of nodes; determining whether the distortion of the determined adjusted pre-distortion position exceeds the pre-set tolerance; and printing the part when one of the predicted distortion position and the predicted adjusted pre-d

Abstract: An estimated gas leak flow rate can be determined using a teaching set of concentration profiles, a regression model implemented by a machine-learning subsystem, and a subset of attributes measured within an environment. The teaching set of concentration profiles can include gas flow rates associated with relevant attributes. The regression model can be transformed into a gas leak flow regression model via the machine-learning subsystem using the teaching set. The subset of attributes measured within the environment can be applied to the gas leak flow regression model to determine other attributes absent from the subset of attributes and an estimated gas flow rate for the environment. A gas leak attenuation action can be performed in response to the estimated gas flow rate.

Abstract: Methods and apparatus operative to quantify building metrics using artificial intelligence analysis of a design plan. A design plan is represented using multiple dynamic components. Each dynamic component may include a parameter changeable via the user interactive interface. The dynamic components may be arranged in a user interactive interface to form a first set of boundaries, including a respective length and area, and defining at least a portion of a first unit. AI may determine a longest path of egress and a supportable occupancy load that may be used to determine compliance with parameters of a given code. The AI may assess whether a building described in the design plans complies with a relevant code set forth by an authority having jurisdiction. Codes may include, for example, codes enforcing fire safety and the Americans with Disabilities Act.

Abstract: Systems or methods of the present disclosure may improve scalability (e.g., component scalability, product variation scalability) of integrated circuit systems by disaggregating periphery intellectual property (IP) circuitry into modular periphery IP tiles that can be installed as modules. Such an integrated circuit system may include a first die that includes programmable fabric circuitry and a second die that that includes a periphery IP tile. The periphery IP tile may be disaggregated from the programmable fabric die and may be communicatively coupled to the first die via a modular interface.

Abstract: A method to store the shapes of an electrical circuit design in a hierarchical set of arrays that inverts the layout size order by area includes defining a plurality of storage levels. Each level corresponds to a two-dimensional projection of the three-dimensional volume of the circuit layout. Accordingly, each level subsumes the entire physical space of the circuit layout. Each level may include a respective grid of slots. The slots may be rectangular. Each slot within any single level may be the same size and dimensions as every other slot in this level. Shapes are added to this storage technique based upon size, not based upon physical layer. Each slot can contain shapes from any physical layer as long as that shape fits entirely within the slot.

Abstract: A parallel analog circuit automatic optimization method based on genetic algorithm and machine learning comprises global optimization based on genetic algorithm and local optimization based on machine learning, with the global optimization and the local optimization performed alternately. The global optimization based on genetic algorithm utilizes parallel SPICE simulations to improve the optimization efficiency while guaranteeing the optimization accuracy, combined with parallel computing. The local optimization based on machine learning establishes a machine learning model near the global optimal point obtained by the global optimization, and uses the machine learning model to replace the SPICE simulator, thus reducing the time costs brought by a large number of simulations.

Abstract: In an embodiment, a method for optimizing an integrated circuit physical design for an integrated circuit. A physical design graph includes a plurality of physical design sub-configurations, each including a placement of a group of physical cells and having annotated characteristics. The method includes identifying, in the integrated circuit physical design, a first physical design sub-configuration including a first placement of a first group of the physical cells and having first annotated characteristics, the first annotated characteristics being outside target characteristics. The method includes selecting from the physical design graph, based on the first group of the physical cells and the target characteristics, at least a second physical design sub-configuration including a second placement of the first group of the physical cells and being within the target characteristics.

Abstract: In an embodiment, a method includes: receiving data representative of an electrical circuit including an arrangement of devices, inputs, outputs, and power sources; determining a minimum number of segments based on the received data; grouping the devices into N segments based on common features shared between two or more of the devices, where N is equal to the minimum number of segments; and generating discrete portions of the grouped devices to form a physical layout representative of a physical manifestation of the electrical circuit, such that when the discrete portions are integrated together they form a physical manifestation of the electrical circuit.

Abstract: A semiconductor device includes a first cell. The first cell includes a first functional feature, a first sensitivity region, at least one anchor node, wherein each of the at least one anchor node is different from the first functional feature, and a number of anchor nodes of the at least one anchor node linked to the first functional feature is based on a position of the first functional feature relative to the first sensitivity region. The semiconductor device further includes a second cell abutting the first cell. The second cell includes a second functional feature, wherein the second functional feature satisfies a minimum spacing requirement with respect to the first functional feature.

Abstract: A method of manufacturing an integrated circuit includes adjusting a first spacing between an adjacent pair of routing tracks in a first set of routing tracks to be equal to a second spacing, adjusting a third spacing between an adjacent pair of routing tracks in a second set of routing tracks to be equal to a fourth spacing, placing a first and second pair of conductive patterns on the corresponding first and second set of routing tracks, forming a first set of conductive structures based on the first pair of conductive patterns, and a second set of conductive structures based on the second pair of conductive patterns. A first and second cell have a same cell height that is a non-integer multiple of a minimum pitch. One spacing of a first set of spacings is different from another spacing of the first set of spacings.

Abstract: The present disclosure relates to a system and method for use in an electronic circuit design. Embodiments may include receiving, using a processor, one or more DFM rules files from at least one PCB fabricator and importing the one or more DFM rules files to a DFM rule aggregator database. Embodiments may also include grouping one or more rules associated with the one or more DFM rules files using an automated or manual operation. Embodiments may further include performing automatic or manual rule aggregation on the grouped rules based upon, at least in part, rules aggregation information including a DFM template file.

Abstract: A method includes: identifying attributes that are associated with cell edges of abutted cells in a layout of a semiconductor device, wherein the attributes include at least one of terminal types of the cell edges; determining at least one minimal boundary leakage of the abutted cells based on the attributes, for adjustment of the layout of the semiconductor device. A system is also disclosed herein.

Abstract: Processing a circuit design includes stabilizing the circuit design by a design tool that performs one or more iterations of implementation, optimization assessment, optimization, and stability assessment until a threshold stability level is achieved. The design tool determines, in response to satisfaction of the threshold stability level, different strategies based on features of the circuit design and likelihood that use of the strategies would improve timing. Each strategy includes parameter settings for the design tool. The design tool executes multiple implementation flows using different sets of strategies to generate alternative implementations. One implementation of the alternative implementations nearest to satisfying a timing requirement is selected.

Abstract: A method includes generating a diffraction map from a plurality of target patterns, generating a favorable zone and an unfavorable zone from the diffraction map, placing a plurality of sub-resolution patterns in the favorable zone, and performing a plurality of geometric operations on the plurality of sub-resolution patterns to generate modified sub-resolution patterns. The modified sub-resolution patterns extend into the favorable zone, and are away from the unfavorable zone.