Ying Yu Lin

US Patent:

7809670, Oct 5, 2010

Filed:

Dec 8, 2006

Appl. No.:

11/608625

Inventors:

Tony Lee - San Francisco CA, US
Jigar J. Mody - Bellevue WA, US
Ying Lena Lin - Sammamish WA, US
Adrian M. Marinescu - Sammamish WA, US
Alexey A. Polyakov - Sammamish WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 17/00

US Classification:

706 59, 726 22

Abstract:

The present invention is directed to a method and system for automatically classifying an application into an application group which is previously classified in a knowledge base. More specifically, a runtime behavior of an application is captured as a series of events which are monitored and recorded during the execution of the application. The series of events are analyzed to find a proper application group which shares common runtime behavior patterns with the application. The knowledge base of application groups is previously constructed based on a large number of sample applications. The construction of the knowledge base is done in such a manner that each sample application can be classified into application groups based on a set of classification rules in the knowledge base. The set of classification rules are applied to a new application in order to classify the new application into one of the application groups.

US Patent:

8402541, Mar 19, 2013

Filed:

Mar 12, 2009

Appl. No.:

12/402861

Inventors:

Cristian Craioveanu - Redmond WA, US
Ying Lin - Redmond WA, US
Peter Ferrie - Redmond WA, US
Bruce Dang - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 23, 726 22, 726 24, 726 25, 726 26, 726 27, 712233, 713188

Abstract:

Malware detection systems and methods for determining whether a collection of data not expected to include executable code is suspected of containing malicious executable code. In some embodiments, a malware detection system may disassemble a collection of data to obtain a sequence of possible instructions and determine whether the collection of data is suspected of containing malicious executable code based, at least partially, on an analysis of the sequence of possible instructions. In one embodiment, the analysis of the sequence of possible instructions may comprise determining whether the sequence of possible instructions comprises an execution loop. In a further embodiment, a control flow of the sequence of possible instructions may be analyzed. In a further embodiment, the analysis of the sequence of possible instructions may comprise assigning a weight that is indicative of a level of suspiciousness of the sequence of possible instructions. In a further embodiment, the sequence of possible instructions may begin with a possible instruction that comprises at least one candidate operation code (opcode) that has been determined to occur frequently in executable code.

US Patent:

20180034836, Feb 1, 2018

Filed:

Oct 10, 2017

Appl. No.:

15/729030

Inventors:

- Princeton NJ, US
LuAn Tang - Pennington NJ, US
Ying Lin - Seattle WA, US
Zhichun Li - Princeton NJ, US
Haifeng Chen - West Windsor NJ, US
Guofei Jiang - Princeton NJ, US

International Classification:

H04L 29/06

Abstract:

Methods and systems for detecting security intrusions include detecting alerts in monitored system data. Temporal dependencies are determined between the alerts based on a prefix tree formed from the detected alerts. Content dependencies between the alerts are determined based on a distance between alerts in a graph representation of the detected alerts. The alerts are ranked based on an optimization problem that includes the temporal dependencies and the content dependencies. A security management action is performed based on the ranked alerts.

US Patent:

20180004754, Jan 4, 2018

Filed:

Jan 14, 2015

Appl. No.:

15/543879

Inventors:

Ying LIN - Redmond WA, US
Mathias JOURDAIN - Redmond WA, US
Guang YANG - Redmond WA, US
- Redmond WA, US

Assignee:

MICROSOFT TECHNOLOGY LICENSING, LLC - Redmond WA

International Classification:

G06F 17/30

Abstract:

Examples of the present disclosure describe content creation of at least one abstract from extracted content. Input information is received that comprises a link to a landing page and keyword information. The landing page is evaluated and content including at least one of image data and text data is extracted from the landing page. Properties of the content extracted are analyzed. The content extracted is ranked based on the analyzed properties and application of at least two ranking algorithms. A first ranking algorithm applied ranks the content based on relevance to the landing page and a second ranking algorithm applied ranks the content extracted based on relevance to the keyword information. The ranked content is filtered to remove content or portions of content that are determined to be unappealing based on applying filtering rules to the ranked content. At least one abstract is created from the filtered and ranked content.

Address:

555 S Santa Anita Ave, San Marino, CA 91108

Phone:

6264560746

VIN:

5TDKK3DC0BS102729

Make:

TOYOTA

Model:

SIENNA

Year:

2011