摘要:
A binary function database system is provided in which binary functions are extracted from compiled and linked program files and stored in a database as robust abstractions which can be matched with others using one or more function matching heuristics. Such abstraction allows for minor variations in function implementation while still enabling matching with an identical stored function in the database, or with a stored function with a given level of confidence. Metadata associated with each function is also typically generated and stored in the database. In an illustrative example, a structured query language database is utilized that runs on a central database server, and that tracks function names, the program file from which the function is extracted, comments and other associated information as metadata during an analyst's live analysis session to enable known function information that is stored in the database to be applied to binary functions of interest that are disassembled from the program file.
摘要:
Automated malware signature generation is disclosed. Automated malware signature generation includes monitoring incoming unknown files for the presence of malware and analyzing the incoming unknown files based on both a plurality of classifiers of file behavior and a plurality of classifiers of file content. An incoming file is classified as having a particular malware classification based on the analyzing of incoming unknown files and a malware signature is generated for the incoming unknown file based on the particular malware classification. Access is provided to the malware signature.
摘要:
The present invention is directed to a method and system for automatically classifying an application into an application group which is previously classified in a knowledge base. More specifically, a runtime behavior of an application is captured as a series of events which are monitored and recorded during the execution of the application. The series of events are analyzed to find a proper application group which shares common runtime behavior patterns with the application. The knowledge base of application groups is previously constructed based on a large number of sample applications. The construction of the knowledge base is done in such a manner that each sample application can be classified into application groups based on a set of classification rules in the knowledge base. The set of classification rules are applied to a new application in order to classify the new application into one of the application groups.
摘要:
The present invention is directed towards systems and methods for generating and displaying the difference between a primary result set and a secondary result set. According to the present invention, a method for displaying the difference between a primary result set and a secondary result set for a query comprises generating a primary result set and a secondary result set, the primary result set and secondary result set generated according to one or more respective disparate search algorithms. A difference result set is determined according to a difference between items in the primary result set and second result set, which is displayed to a user.
摘要:
A swimming goggle buckle includes a goggle main body, two single buckle complexes, and a headband, wherein the goggle main body includes a nose pad, a rim, face contacting pads, a glass lens formed in the rim, and an opening formed at each end. One end of each single buckle complex is fastened at an opening thereof and the other end connecting to the headband, thereby enabling the goggle buckle to be easy to assemble, difficult to disassemble, convenient to adjust, while still containing relatively few individual parts.
摘要:
A marketing system includes a plurality of automated transaction machines (74, 76, 78, 80, 82, 84, 86). The automated transaction machines operate to carry out financial transactions with associated host computers (90, 94, 100, 104). Marketing presentations are stored on and output from the transaction machines responsive to messages exchanged with a market message server (110) which is connected to the automated transaction machines through a network (108). The connection to the automated transaction machines which provides delivery of the market presentation materials and which causes the output of presentations, is generally independent of the messages associated with authorizing financial transactions. Some described embodiments of the invention enable presenting marketing campaigns to users of the transaction machines. The marketing campaigns may include sequences of presentations that are output on a targeted basis to particular users.
摘要:
The present invention is an improvement of a swimming goggle buckle, including a goggle main body, two single buckle complexes, and a headband, wherein the goggle main body having a nose pad, a rim, face contacting pads, glass lens formed in the rim, and an opening formed at each end, wherein one end of each single buckle complex being fastened at an opening thereof and the other end connecting to the headband, thereby enabling the present invention being easy in assembling, difficult in disassembling, convenient in adjusting the headband, and less in parts quantity.
摘要:
An upper cover plate for an air-tight chamber and a tool for removing the upper cover plate from the chamber are introduced. The upper cover plate integrates a chamber body to form the air-tight chamber, in which the chamber body further includes a top surface for air-tightly matching with a bottom surface of the upper cover plate. The upper cover plate further includes a plurality of thread holes engageable respectively with a plurality of the tools. The present invention is characterized on that at least one of the thread holes is formed as a through thread hole connecting to the bottom surface, and that the respective tool for engaging with the through thread hole includes a portion for penetrating the through thread hole and going beyond the bottom surface. By providing the present invention, the top surface of the chamber body can be utilized as a pivotal plane for the tool to easily perform a helical lifting application upon the upper cover plate through the engaged threads, so that the air-tight state of the chamber can be easily removed.
摘要:
An improved keypad includes a plurality of apertured bases in the keyboard, a pressing rod and a keypad for each of the apertured bases. The pressing rod has opposing projected tracks and the apertured base has slots on its interior wall. This structure allows the pressing rod to be housed inside the apertured base so as to reduce the friction during the keypad operation. The reduction of friction provides a smooth keyboard operation. Moreover, the gap between the exterior wall of the pressing rod and the interior wall of the aperture base is wider, therefore, the keypad resonance is lessened during operation.