Abstract:
Systems, methods, and computer programs are disclosed for detecting high-level functionality of an application executing on a computing device. One method comprises storing, in a secure memory on a computing device, a virtual address mapping table for an application. The virtual address mapping table comprises a plurality of virtual addresses in the application binary code mapped to corresponding target application functionalities. The application is registered with a high-level operating system (HLOS). During execution of the application binary code, the HLOS detects when one or more of the virtual addresses corresponding to the target application functionalities are executed based on the virtual address mapping table.
Abstract:
Systems, methods, and computer programs are disclosed for updating virtual memory addresses of target application functionalities for an updated version of application binary code. The method comprises storing a virtual address mapping table associated with application binary code registered with a high-level operating system. The virtual address mapping table comprises a plurality of virtual addresses mapped to corresponding target application functionalities in the application binary code. In response to receiving an updated version of the application binary code, a pseudo binary code template is selected, which is associated with one or more of the plurality of virtual addresses in the virtual address mapping table. The pseudo binary code template is matched to binary instructions in the updated version of the application binary code. The new virtual addresses corresponding to the matching binary instructions are determined. The virtual address mapping table is updated with the new virtual addresses.
Abstract:
Systems, methods, and devices for executing a function in a dynamically-typed language are described herein. In one aspect, a method includes generating a function selection decision tree based on one or more specializations of a generic function and one or more function inputs via an electronic device. The method further includes selecting one of the specializations or the generic function based on an input type of at least one function input via the electronic device. The method further includes calling the selected specialization or generic function via the electronic device. Another aspect of the subject matter described in the disclosure provides a method of executing a function in a prototype-based dynamically-typed language. The method includes maintaining a list of calls to one or more specializations of the function via the electronic device. The method further includes creating or destroying a specialization of the function via the electronic device. The method further includes updating calls to the created or destroyed specialization via the electronic device. Advantageously in certain embodiments, selection logic overhead can be reduced using criteria that can utilize different weightages for one or more inputs based on heuristics or runtime information.
Abstract:
A method for multi-instance learning (MIL)-based classification of a streaming input is described. The method includes running a first biased MIL model using extracted features from a subset of instances received in the streaming input to obtain a first classification result. The method also includes running a second biased MIL model using the extracted features to obtain a second classification result. The first biased MIL model is biased opposite the second biased MIL model. The method further includes classifying the streaming input based on the classification results of the first biased MIL model and the second biased MIL model.
Abstract:
Methods for countering a shared paging channel hijack attack. In an example embodiment, a wireless device may monitor the shared paging channel during a paging occasion in a DRX cycle to detect a first IMSI-based paging message in the paging occasion, and continue monitoring for IMSI-based paging in subsequent radio subframes in the paging frame and radio subframes in subsequent radio frames within the DRX cycle to determine whether there are indications of a paging channel hijack attack. In an example embodiment, this monitoring may be to determine whether one or more subframes that are not the paging occasion receive IMSI-based paging messages, in response to which a threat probability may be increased. The wireless device may perform an operation (e.g., an actuation operation such as disabling monitoring of, and preventing connection attempts to, the base station, etc.) to protect against a shared paging channel hijack attack.
Abstract:
Systems, devices, and methods for communications among access points (APs) and mobile wireless devices are disclosed. A database having a persistent profile table (PPT) can be used to store information related to access point operations. Information related to a plurality of APs can be detected and stored in the PPT. Certain information may be common to multiple of the APs, allowing for compression of the data for more efficient storage. Fingerprint data related to the APs can be clustered based on a first order identifier (e.g., SSID, PLMN) and a second order identifier (e.g., MAC, MAC prefix, cell ID). The clusters can be further compressed by, for example, storing common features only once, and storing uncommon features individually, along with an identifier frame indicating which features are unique within the group of clusters. A mobile device can query the persistent profile table to verify the identity of unknown APs.
Abstract:
In various embodiments, a wireless device processor may determine a threat score for a first cell, determine whether the first cell threat score is below a first threat score threshold, update a good neighbor cell data structure using neighbor cell information from the first cell in response to determining that the first cell threat score is below the first threat score threshold, performing cell reselection to a second cell, determine whether the second cell transmits a system information block message indicating fake neighbor cell information, and increase a threat score for the second cell in response to determining that the second cell provides the SIB message indicating fake neighbor cell information and that a good neighbor cell data structure includes an indication of one or more good neighbor cells that are within the time threshold and the location threshold and doing countermeasures in a response to the determination.
Abstract:
Systems and methods are disclosed for detecting high-level functionality of an application executing on a computing device. One method includes storing, in a secure memory, an application-specific virtual address mapping table for an application. The application-specific virtual address mapping table comprises a plurality of virtual address offsets in the application binary code mapped to corresponding target application functionalities. In response to launching the application, a process-specific virtual address mapping table is generated for an instance of an application process to be executed. The process-specific virtual address mapping table defines actual virtual addresses corresponding to the target application functionalities using the virtual address offsets in the application-specific virtual address mapping table. During execution of the application code, the method detects when one or more of the actual virtual addresses corresponding to the target application functionalities are executed based on the process-specific virtual address mapping table.
Abstract:
This disclosure relates to allocating memory resources of a computing device comprising non-volatile random access memory (NVRAM) and dynamic random access memory (DRAM). An exemplary method is performed for every independently executable component of an application and includes determining attributes of the component. The method also includes associating the component with a memory profile of a plurality of memory profiles based on the attributes, wherein each memory profile of the plurality of memory profiles specifies a number of banks of the NVRAM and a number of banks of the DRAM. The method also includes causing the computing device to generate an assignment of the component to banks of the NVRAM and DRAM based on the memory profile associated with the component so the computing device can execute the component using the banks of the NVRAM and DRAM based on the assignment.
Abstract:
A method for multi-instance learning (MIL)-based classification of a streaming input is described. The method includes running a first biased MIL model using extracted features from a subset of instances received in the streaming input to obtain a first classification result. The method also includes running a second biased MIL model using the extracted features to obtain a second classification result. The first biased MIL model is biased opposite the second biased MIL model. The method further includes classifying the streaming input based on the classification results of the first biased MIL model and the second biased MIL model.