Microsoft Technology Licensing, LLC

University of Washington

Douglas Reed Beck

Yi-Min Wang

Raymond W McCollum

Radu Rares Palanca

Steven J Menzies

Todd Schoepflin

Yi He

Chad E Verbowski

Leonardo G Del Castillo

Lorenzo Rizzi

Andrew Kilgour Juenger

David Allstot

Chun Beng Goh

Roussi A Roussev

Hakon Strande

Marc D Reyhner

Aaron Roy Johnson

Stuart William Milton

Roy Goh

Raymond Cheng Hui Xue

Binh Dou Vo

Techniques of shifting the lens stack from an image capture sensor within a smart device and/or mobile device are disclosed. The shifting of the center of the lens stack from the center of the sensor allows the Field of View (FOV) of such a camera assembly to have an angle from the normal and/or perpendicular direction from the surface of the device. Such an angle allows the FOV to be substantially horizontal and/or parallel to a surface when the device is held (e.g. by a kickstand) at a similar angle from the vertical direction. When the front of the lens stack is substantially at a front surface of the device and the sensor is attached to a back surface of the device, then the Total Track Length (TTL) is substantially the depth of the device.

Shifted lens camera for mobile computing devices

A network can be explored to investigate exploitive behavior. For example, network sites may be actively explored by a honey monkey system to detect if they are capable of accomplishing exploits, including browser-based exploits, on a machine Also, the accomplishment of exploits may be detected by tracing events occurring on a machine after visiting a network site and analyzing the traced events for illicit behavior. Alternatively, site redirections between and among uniform resource locators (URLs) may be explored to discover relationships between sites that are visited.

Honey monkey network exploration

A method and system for determining whether resources of a computer system are being hidden is provided. The security system invokes a high-level function of user mode that is intercepted and filtered by the malware to identify resources. The security system also directly invokes a low-level function of kernel mode that is not intercepted and filtered by the malware to identify resources. After invoking the high-level function and the low-level function, the security system compares the identified resources. If the low-level function identified a resource that was not identified by the high-level function, then the security system may consider the resource to be hidden.

Detecting user-mode rootkits

A method for suppressing banding and rolling flicker in video acquired by a video camera. The method comprises acquiring a plurality of video frames and assessing an amount of rolling flicker in the plurality of video frames. The method further comprises configuring the video camera to quiet banding and rolling flicker responsive to periodic illumination at a first frequency if the amount of rolling flicker is above a threshold, and, configuring the video camera to quiet banding and rolling flicker responsive to periodic illumination at a second frequency if the amount of rolling flicker is below the threshold.

Video artifact suppression via rolling flicker detection

A network can be explored to investigate exploitive behavior. For example, network sites may be actively explored by a honey monkey system to detect if they are capable of accomplishing exploits, including browser-based exploits, on a machine. Also, the accomplishment of exploits may be detected by tracing events occurring on a machine after visiting a network site and analyzing the traced events for illicit behavior. Alternatively, site redirections between and among uniform resource locators (URLs) may be explored to discover relationships between sites that are visited.

A method and system for detecting that a software system has been infected by software that attempts to hide properties related to the software system is provided. A detection system identifies that a suspect operating system has been infected by malware by comparing properties related to the suspect operating system as reported by the suspect operating system to properties as reported by another operating system that is assumed to be clean. The detection system compares the reported properties to the actual properties to identify any significant differences. A significant difference, such as the presence of an actual file not reported by the suspect operating system, may indicate that the suspect storage device is infected.

Method and system for detecting infection of an operating system

A rules runtime engine for scheduling and concurrently processing of rules. The engine efficiently runs a large number of rules in a parallel fashion. This is accomplished by authoring rules in a rule definition language, passing these rules through the translator for communication to the runtime engine and, scheduling and concurrently processing the translated instructions using the runtime engine. The engine also receives configuration data that instantiates the instructions thus, giving form to a living set of rules.

Scalable synchronous and asynchronous processing of monitoring rules

A rules definition language the authoring rules for concurrent processing. The RDL includes statements that facilitate efficient use of computer resources by allowing a rule to be broken down into one or more instructions, and processing these instructions asynchronously to provide more efficient use of the computer resources. Once processed into the instructions, results thereof can be passed among the instructions to facilitate process completion of the rule.

Rules definition language

Methods and apparatuses for double-sampling a signal using an operational amplifier having dedicated unswitched connections to sample and hold circuits. In one embodiment, a circuit according to the teachings of the present invention includes an op-amp having four input terminals. Two of the input terminals are tied to ground and the other two terminals are coupled to S/H circuits through unswitched connections. In one embodiment, the S/H circuits are coupled to sample an input signal during different clock phases.

Method and apparatus for double-sampling a signal

A method and apparatus for decoding data encoded in the horizontal overscan portion of a video signal. A video data detector is configured to decode data encoded in a video signal in a first type of video signal format, such as NTSC. When the detector receives the video signal, it enters a &ldquo;fast acquisition&rdquo; loop in which it attempts to decode a sequence of valid data from several consecutive frames of the video signal. If the detector cannot decode a sequence of valid data from the consecutive frames of the video signal, the detector is reconfigured to decode data encoded in the video signal in a second type of video signal format, such as PAL. The detector then attempts to decode a sequence of valid data from the next several consecutive frames of the video signal. If the detector is unable to decode a sequence of valid data from the consecutive frames, the detector is reconfigured for the first type of video signal format and the above process repeats. If the detector decodes a sequence of valid data in the several consecutive frames of the video signal, the detector enters a &ldquo;controlled persistence&rdquo; loop. In the controlled persistence loop, the detector continues to decode data until it fails to decode valid data from a series of consecutive video frames. When the detector fails to decode data from a series of consecutive video frames, the detector reenters the fast acquisition loop.

Growing community of inventors

Seattle, WA, United States of America

Douglas Reed Beck