Trend Micro Inc.

Suzhou Powersite Electric Co., Ltd.

State Grid Jiangsu Electric Power Company Research Institute

Nanjing Molecular Research, Inc.

Suzhou Powersite Electronic Co., Ltd.

Nanjing Kangni Mechanical & Electrical Co., Ltd.

Qiang Huang

Xinfeng Liu

Hu Cao

Ben Huang

Xiaochuan Wan

Xuewen Zhu

Jie He

Fei Chen

Kai Yu

Yuefeng Li

Shengfang Fan

Jun Wu

Wei Jun Zhang

Jie Chen

Junbiao Chang

Yang Liu

Jinggang Yang

Jian Liu

Xuebin Chen

Qiang Wu

Zheng Wang

Wanquan Wang

Hongze Li

Xiaosen Chen

Weizhong Wang

Liguo Liu

Rong Sun

Chenying Li

Jingying Cao

Yijun Fei

Xiao Tan

Runcong Liu

Ruiquan Ding

Luoming Liu

Xingming Wang

Lina Guo

A combined platform for testing fireproof materials for cables includes a main frame for providing operating space; an air circulation system including a fresh air supply unit for supplying fresh air into the operating space and an exhaust gas treatment unit for treating the gas in the operating space under set conditions; an open flame system for providing an open flame for testing cables; a water circulation system for supplying water at least to the exhaust gas treatment unit and the operating space; and a control system for collecting at least the temperature and gas concentration in the operating space, and performing process control based on the collected results. The actual working conditions of scenarios such as fire-resistant cable tunnels and fire-resistant cable trenches can be simulated, and multiple tests such as combustion performance test and physical and chemical performance test can be carried out under various working conditions.

Combined platform for testing fireproof materials for cables

The present application discloses a method for controlling filament current and apparatus. The method comprises: acquiring a current filament current value (S); determining a current range within which the current filament current value falls (S); determining a correspondence between a filament current and a control current according to the current range (S); and determining the current control current according to the current filament current value and the correspondence (S). The problem of large errors in the control of filament current caused by nonlinear characteristics of a filament transformer can be solved.

Filament current control method and apparatus

The present application provides a combined machine head and a ray imaging device, wherein the combined machine head comprises: a housing, having an enclosed cavity; a ray tube, arranged in the enclosed cavity; and a pump and a pipe, arranged in the enclosed cavity; wherein the pump is arranged on one side away from an anode of the ray tube, the pipe has a first end connected with an outlet of the pump and a second end extending to be near the anode of the ray tube; or the pump is arranged near the anode of the ray tube, the pipe has a first end connected to an inlet of the pump and a second end extending to one side away from the anode of the ray tube.

Combined machine head and ray imaging device

The present application discloses a pulse voltage generation device, method and controller, the device comprises: a transformer; a first AC/DC conversion circuit, with an alternating current side connected with a high-voltage side of the transformer; an energy storage capacitor, connected with a direct current side of the a first AC/DC conversion circuit, for storing electrical energy; and a discharge control circuit, in parallel connection with both ends of the energy storage capacitor, for controlling discharge of the energy storage capacitor to generate a high-voltage pulse. In the present application, an energy storage capacitor is arranged on a high-voltage side of the transformer, and a discharge control circuit is used to control the energy storage capacitor to discharge to generate a high-voltage pulse, avoiding the problem that frequency of the high-voltage pulse outputted on the high-voltage side is limited by variations of the induced magnetic field of the transformer, and is thus difficult to increase, and that the rising edge and falling edge of the high-voltage pulse take a long time.

Pulse voltage generation device, method, and controller

A sample program being evaluated for malware is scanned for presence of a critical code block. A path guide is generated for the sample program, with the path guide containing information on executing the sample program so that an execution path that leads to the critical code block is taken at runtime of the sample program. The path guide is applied to the sample program during dynamic analysis of the sample program so that behavior of the sample program during execution to the critical code block can be observed. This advantageously allows for detection of malicious samples, allowing for a response action to be taken against them.

Dynamic analysis of malware that has evasion code

The present disclosure provides an automated technique to detect and rectify input-dependent evasion code in a generic manner during runtime. Pattern-based detection is used to detect the evasion code and trigger an identification process. The identification process marks the evasion code and rectifies the execution flow to a more 'significant' path. The execution then moves on by following this path to bypass the evasion code. Other embodiments, aspects and features are also disclosed.

Method and system to identify and rectify input dependency based evasion in dynamic analysis

A malware detection system for evaluating sample programs for malware incorporates an evasion code detector. The evasion code detector includes semantic patterns for identifying conditional statements and other features employed by evasion code. The system inserts breakpoints at conditional statements, compares expected and actual evaluated values of conditional variables of the conditional statements, and changes the execution path of the sample program based on the comparison. Changing the execution path of the sample program to an expected execution path counteracts the evasion code, allowing for the true nature of the sample program to be revealed during runtime.

Anti-malware system with evasion code detection and rectification

Execution of a sample program being evaluated for malware is initiated and then suspended to set breakpoints on timing operations of the sample program. Execution of the sample program is suspended again when a breakpoint is hit, at which time a loop is identified in the sample program and evaluated for presence of stalling code. Execution flow of the sample program is changed to exit the loop when the loop is determined to include the stalling code.

Anti-malware program with stalling code detection

A virtual machine is used to perform a raw scan for evasive malware on a host computer without requiring an interrupt or restart of a host operating system. An antivirus program installs a raw scanner virtual machine. The raw scanner virtual machine is triggered to scan files and memory for malware. The raw scan results are collected by the antivirus program for analysis, such as for use in generating a report or for removal of malware. The memory and files of the host are mapped to a guest space of the virtual machine.

Instant raw scan on host PC with virtualization technology

Tablet computers send relevant geographic and identification data to an application server (one of the tablets, or a local or remote server) which groups them to form a video wall. Once placed next to one another in substantially the same plane, the tablets snap photographs at more or less the same time and these images are transmitted to the application server. The server determines the relative positions of the tablets and then streams a portion of a video or digital image to each of the tablets in order that all tablets display the video or image in an integrated fashion. The tablets may operate independently or may rely upon the remote application server. Relative positions are determined by analyzing features and determining an up-down or left-right relationship between pairs of images, sorting images into vertical and horizontal rows, and placing the images into a grid.

Detection of relative positions of tablet computers

An application document known to include malware (such as a document exploit) is opened and executed by its corresponding software application. Behaviors of this document (such as registry, file system, network and process) are monitored and recorded using internal software drivers and hook modules. A behavior report is generated and a baseline pattern is created including a number of regular expressions. A suspicious document of the same type as the monitored document is opened and executed by the same corresponding software application. Behaviors are monitored in the same way and a behavior report is generated. This behavior report is compared to the baseline pattern and a determination is made as to whether a document exploit is present. Known benign documents may also be opened, monitored and their behavior recorded, resulting in creation of a known benign pattern for the corresponding software application.

Document exploit detection using baseline comparison

A computer executes a suspicious software sample directly on its CPU in order to detect if the software sample is malicious. The software sample does not execute within a sandbox or virtual machine. Before the sample executes, a memory state of the computer is saved and a virtual disk file is created to bootstrap the computer at a later time. Malicious behavior of the software sample is collected while it executes and a report is generated. Hard disk access requests are redirected to a virtual disk file. The software sample does not detect that it is being analyzed. After execution of the sample, the computer is reverts to a clean state by bootstrapping the computer from the saved virtual disk file and then restoring the computer's volatile and non-volatile virtual memory from the saved memory state. A new software sample may then be executed and analyzed on the clean computer.

Detection of advanced persistent threat having evasion technology

This application discloses phosphoramidate and phosphonoamidate prodrugs of alcohol-based therapeutic agents, such as nucleosides, nucleotides, acyclonucleosides, C-nucleosides, and C-nucleotides, and use of these prodrugs for treatment of diseases or disorders, including infectious diseases and cancers. This application also discloses a general method for enhancing bioavailability and/or liver-targeting property of alcohol drugs through converting the alcohol drugs to phosphoramidate or phosphonoamidate prodrugs, and methods of preparation of these prodrugs.

Double-liver-targeting phosphoramidate and phosphonoamidate prodrugs

A single virtual machine is implemented upon a computer and an operating system executes within this virtual machine. A sample file suspected of being malware is received and any number of versions of the software application corresponding to the sample file are installed. Each version of the software application is executed within the operating system, each version opening the sample file. Behavior of each version and of the sample file is collected while each version is executing. A score indicating malicious behavior for each version with respect to the sample file is determined and reported. The versions may execute serially in the happening system, each version terminating before the next version begins executing. Or, all versions may execute concurrently within the operating system. Files and registries are hidden to facilitate installation. System information is changed to facilitate execution.

Multiple application versions in a single virtual machine

Growing community of inventors

Nanjing, China

Qiang Huang