Ntt Docomo, Inc.

Qualcomm Incorporated

Docomo Communications Laboratories Usa, Inc.

Nayeem Islam

Rajarshi Gupta

Shahid Shoaib

Saumitra Mohan Das

Manuel Roman

Ayman Fawzy Naguib

Yu Song

Ajay Chander

Dong Zhou

Peter S Lee

Mastooreh Salajegheh

Sudha Anil Kumar Gathala

George C Necula

David Espinosa

Vinay Sridhara

Hui Chao

Giridhar Dhati Mandyam

Mihai Christodorescu

Te-Won Lee

Seyed Ali Ahmadzadeh

Faraz Mohammad Mirzaei

Hao-hua Chu

Masaji Katagiri

Harold Gilkey

Dachuan Yu

Dallas Wiener

Hugo Romero

Ali Ismael

Peter Lee

Methods, and computing devices implementing the methods, that enable client computing devises to work in conjunction with a server device to identify and temporarily defend against non-benign applications (e.g., malware, etc.) and other threats before a more permanent solution or defense (e.g., a patch or software upgrade) becomes available and installed on the client computing device. The server device may be configured to receive reports from the client computing devices, receive threat feeds from third-party servers (e.g., threat intelligence servers, etc.), and use information included in the received threat feed and information included in the received reports to analyze, in the server computing device, a software application that is operating on a client device in multiple passes. The server may generate threat scores (e.g., one for each pass, etc.), and the threat scores to the client computing device for use in devising a customized security response.

Methods and systems for on-device real-time adaptive security based on external threat intelligence inputs

Various embodiments include methods for detecting software attacks on a process executing on a computing device. Various embodiment methods may include monitoring structural attributes of a plurality of virtual memory regions utilized by the process, and comparing the monitored structural attributes to the expected structural attributes of the plurality of VMRs. Various embodiment methods may further include determining whether the monitored structural attributes represent anomalous behavior of the process based on the comparison between the monitored structural attributes and the expected structural attributes.

Detecting software attacks on processes in computing devices

Apparatuses and methods are described herein for identifying a Unmanned Aerial Vehicle (UAV), including, but not limited to, determining a first maneuver type, determining a first acoustic signature of sound captured by a plurality of audio sensors while the UAV performs the first maneuver type, determining a second acoustic signature of sound captured by the plurality of audio sensors while the UAV performs a second maneuver type different from the first maneuver type, determining an acoustic signature delta based on the first acoustic signature and the second acoustic signature, and determining an identity of the UAV based on the acoustic signature delta.

Device for UAV detection and identification

Methods, devices, systems, and non-transitory process-readable storage media for a computing device to use machine learning to dynamically configure an application and/or complex algorithms associated with the application. An aspect method performed by a processor of the computing device may include operations for performing an application that calls a library function associated with a complex algorithm, obtaining signals indicating user responses to performance of the application, determining whether a user tolerates the performance of the application based on the obtained signals indicating the user responses, adjusting a configuration of the application to improve a subsequent performance of the application in response to determining the user does not tolerate the performance of the application, and storing data indicating the user responses to the performance of the application and other external variables for use in subsequent evaluations of user inputs.

Application characterization for machine learning on heterogeneous core devices

Methods, devices, and non-transitory storage media for dynamic patching of diversity-based software executing on a computing device. One of many variations of various module utilized by software may be selected from a list of available module variations to be used when software is executed. An embodiment method for updating software may include obtaining or receiving a notification indicating a particular module variation that should not be used as a module for the software, and removing the module variation from the list of available module variations for the module in response to the notification. In some embodiments, the notification may be received by the mobile device from a remote server, and further the notification does not include data capable of being used as a module by the software during runtime. In some embodiments, the module variation may be one of flawed, outdated, and identified as exploited by malware.

Dynamic patching for diversity-based software security

Various embodiments include methods implemented on a computing device for analyzing a program executing within a virtual environment on the computing device. The methods may include determining whether the program is attempting to detect whether it is being executed within the virtual environment, and analyzing the program within a protected mode of the computing device in response to determining that the program is attempting to detect whether it is being executed within the virtual environment.

Detecting program evasion of virtual machines or emulators

Techniques for operating a security system are provided. An example method for operating a security system according to the disclosure includes monitoring interactions of an unauthorized party with a computing environment configured to simulate the server, generating synthetic content based on the unauthorized party's interactions with the computing environment, and configuring the security system to permit the unauthorized party to access the synthetic content responsive to the unauthorized party's interactions with the security system.

Techniques for using a honeypot to protect a server

Various aspects provide systems and methods for optimizing hardware monitoring on a computing device. A computing device may receive a monitoring request to monitor a portion of code or data within a process executing on the computing device. The computing device may generate from the monitoring request a first monitoring configuration parameter for a first hardware monitoring component in the computing device and may identify a non-optimal event pattern that occurs while the first hardware monitoring component monitors the portion of code or data according to the first monitoring configuration parameter. The computing device may apply a transformation to the portion of code or data and reconfigure the first hardware monitoring component by modifying the first monitoring configuration parameter in response to the transformation of the portion of code or data.

Optimization of hardware monitoring for computing devices

Aspect methods, systems and devices may be configured to create/capture checkpoints without significantly impacting the performance, power consumption, or responsiveness of the mobile device. An observer module of the mobile device may instrument or coordinate various application programming interfaces (APIs) at various levels of the mobile device system and constantly monitor the mobile device (via a low power process, background processes, etc.) to identify the normal operation patterns of the mobile device and/or to identify behaviors that are not consistent with previously computed normal operation patterns. The mobile device may store mobile device state information in a memory as a stored checkpoint when it determines that the mobile device behaviors are consistent with normal operation patterns, and upload a previously stored checkpoint to a backup storage system when it determines that the mobile device behaviors are not consistent with normal operation patterns.

Techniques for autonomic reverting to behavioral checkpoints

Example methods, apparatuses, or articles of manufacture are disclosed herein that may be utilized, in whole or in part, to facilitate or support one or more operations or techniques for position estimation via one or more proximate fingerprints for use in or with a mobile communication device.

Position estimation via proximate fingerprints

Schema-driven XML parsing techniques allow an XML parser to optimize its parsing process by composing parse and to dynamically generate parsing code components based on XML schema definition for the targeted XML document. These techniques reduce the XML parsing time and reduce the memory requirement during parsing process. Further, a reconfigurable parser is provided which is guided during parsing of the XML document by XML element lexicographical information and state transition information extracted from a schema associated with the XML document. Pre-allocated element object pools may be provided based on the schema analysis to reduce the requirements for dynamic memory allocation and de-allocation operations.

Method and apparatus for schema-driven XML parsing optimization

A mechanism and supporting apparatus to enable resource sharing among groups of users over mobile terminals. The system presented leverages the carrier infrastructure to simplify the requirements at the terminals, and describes a graphical user interface binding mechanism that allows developing generic graphical users interfaces that can be customized to heterogeneous devices at run-time.

Method and apparatus for resource sharing over handset terminals

A method and apparatus is disclosed herein for generating and solving constraints. In one embodiment, the method comprises modifying program code by inserting one or more dynamic annotations having unsolved variables, generating one or more constraints based on the one or more dynamic annotations using a verifier, solving the one or more generated constraints; and modifying the program code by inserting a dynamic annotation in place of an annotation containing an unsolved variable.

Method and apparatus for enforcing safety properties of computer programs by generating and solving constraints

A method and apparatus for performing checks on program code. In one embodiment, the method comprises receiving program code and statically verifying information about one or more dynamic checks in the program code, where each of the one or more dynamic checks in the program code checks an operation in the program code.

Performing checks on the resource usage of computer programs

A method and apparatus for composing software are described. In one embodiment, the method includes obtaining software structure data that identifies multiple application components associated with requested functionality, obtaining software logic data indicating interaction rules between the application components, storing the software structure data and the software logic data in memory, and coordinating the invocation of the application components at run time based on the software logic data.

Growing community of inventors

Palo Alto, CA, United States of America

Nayeem Islam