Zhichun Li

US Patent:

8335838, Dec 18, 2012

Filed:

Oct 6, 2011

Appl. No.:

13/267254

Inventors:

Ming Zhang - Redmond WA, US
Yi-Min Wang - Bellevue WA, US
Albert Greenberg - Seattle WA, US
Zhichun Li - Evanston IL, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/173

US Classification:

709218

Abstract:

Web page load time prediction is achieved by simulating and adjusting the load times of web objects in a webpage to determined adjustments that optimize an overall page load time (PLT) of the webpage. The webpage load time prediction includes extracting a parental dependency graph (PDG) for the webpage. The PDG encapsulates one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original PLT and original timing information of a webpage. The prediction also includes simulating a page loading of the webpage based on adjusted timing information of each web object and the PDG to estimate a new PLT of the webpage. The prediction additionally includes comparing the original PLT of the webpage to the new PLT of the webpage to determine whether the adjusted timing information increased or decreased the new PLT of the webpage.

US Patent:

8522348, Aug 27, 2013

Filed:

Jul 29, 2010

Appl. No.:

12/846541

Inventors:

Yan Chen - Northfield IL, US
Zhichun Li - Evanston IL, US
Gao Xia - Beijing, CN
Bin Liu - Beijing, CN

Assignee:

Northwestern University - Evanston IL

International Classification:

G06F 11/00

US Classification:

726 23

Abstract:

Systems, methods, and apparatus are provided for vulnerability signature based Network Intrusion Detection and/or Prevention which achieves high throughput comparable to that of the state-of-the-art regex-based systems while offering improved accuracy. A candidate selection algorithm efficiently matches thousands of vulnerability signatures simultaneously using a small amount of memory. A parsing transition state machine achieves fast protocol parsing. Certain examples provide a computer-implemented method for network intrusion detection. The method includes capturing a data message and invoking a protocol parser to parse the data message. The method also includes matching the parsed data message against a plurality of vulnerability signatures in parallel using a candidate selection algorithm and detecting an unwanted network intrusion based on an outcome of the matching.

US Patent:

20090158433, Jun 18, 2009

Filed:

Dec 18, 2007

Appl. No.:

11/958760

Inventors:

Zhichun LI - Evanston IL, US
Yan CHEN - Evanson IL, US
Zhi FU - Lake Zurich IL, US

Assignee:

MOTOROLA, INC. - Schaumburg IL

International Classification:

G06F 15/18

US Classification:

726 24

Abstract:

Network-level data traffic comprising data packets, wherein at least some of the data packets have at least one field of unbounded length, are received (). A worm-detection signature is then generated () as a function, at least in part, of the lengths of particular data packet fields. So configured, these teachings are particularly suitable for use in detecting worms that seek to exploit the use of an unbounded field in a data packet to overwhelm buffer memory in a receiving network element as a basis for installing the worm's code.

US Patent:

20110054878, Mar 3, 2011

Filed:

Aug 26, 2009

Appl. No.:

12/547704

Inventors:

Ming Zhang - Redmond WA, US
Yi-Min Wang - Bellevue WA, US
Albert Greenberg - Seattle WA, US
Zhichun Li - Evanston IL, US

Assignee:

MICROSOFT CORPORATION - Redmond WA

International Classification:

G06G 7/62
G06F 17/30

US Classification:

703 21, 707E17055

Abstract:

Embodiments of automated cloud service performance prediction are disclosed. The automated cloud service performance prediction includes extracting a parental dependency graph (PDG) for a webpage. The PDG encapsulates one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original page load time (PLT) and original timing information of a webpage. The prediction also includes simulating a page loading of the webpage based on adjusted timing information of each web object and the PDG to estimate a new PLT of the webpage. The prediction additionally includes comparing the original PLT of the webpage to the new PLT of the webpage to determine whether the adjusted timing information increased or decreased the new PLT of the webpage.

US Patent:

20130097313, Apr 18, 2013

Filed:

Dec 6, 2012

Appl. No.:

13/707042

Inventors:

Microsoft Corporation - Redmond WA, US
Yi-Min Wang - Bellevue WA, US
Albert Greenberg - Seattle WA, US
Zhichun Li - Evanston IL, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/08

US Classification:

709224

Abstract:

Embodiments of automated cloud service performance prediction are disclosed. The automated cloud service performance prediction includes extracting one or more dependency relationships for each web object in the webpage. The prediction further includes determining an original performance metric value and original timing information associated with a page loading of a webpage. The prediction also includes simulating a page loading of the webpage based on the adjusted timing information and the dependency relationships to estimate a new performance metric value associated with the simulated page loading of the webpage. The prediction additionally includes comparing the original performance metric value to the new performance metric value to determine whether the adjusted timing information increased or decreased the new performance metric value relative to the original performance metric value.

US Patent:

20200257794, Aug 13, 2020

Filed:

Feb 11, 2020

Appl. No.:

16/787610

Inventors:

- Princeton NJ, US
Junghwan Rhee - Princeton NJ, US
Kangkook Jee - Princeton NJ, US
Zhichun Li - Santa Clara CA, US
Adil Ahmad - Lafayette IN, US
Haifeng Chen - West Windsor NJ, US

International Classification:

G06F 21/53
G06F 21/60
G06F 21/12
G06F 9/455
G06F 21/44
G06F 21/54

Abstract:

Systems and methods for implementing a system architecture to support a trusted execution environment (TEE) with computational acceleration are provided. The method includes establishing a first trusted channel between a user application stored on an enclave and a graphics processing unit (GPU) driver loaded on a hypervisor. Establishing the first trusted channel includes leveraging page permissions in an extended page table (EPT) to isolate the first trusted channel between the enclave and the GPU driver in a physical memory of an operating system (OS). The method further includes establishing a second trusted channel between the GPU driver and a GPU device. The method also includes launching a unified TEE that includes the enclave and the hypervisor with execution of application code of the user application.

US Patent:

20200250308, Aug 6, 2020

Filed:

Feb 4, 2020

Appl. No.:

16/781366

Inventors:

- Princeton NJ, US
Kangkook Jee - Princeton NJ, US
Zhichun Li - Santa Clara CA, US
Zhengzhang Chen - Princeton Junction NJ, US
Xiao Yu - Princeton NJ, US

International Classification:

G06F 21/55

Abstract:

Methods and systems for security monitoring and response include assigning an anomaly score to each of a plurality of event paths that are stored in a first memory. Events that are cold, events that are older than a threshold, and events that are not part of a top-k anomalous path are identified. The identified events are evicted from the first memory to a second memory. A threat associated with events in the first memory is identified. A security action is performed responsive to the identified threat.

US Patent:

20200184070, Jun 11, 2020

Filed:

Nov 25, 2019

Appl. No.:

16/693710

Inventors:

- Princeton NJ, US
Junghwan Rhee - Princeton NJ, US
Kangkook Jee - Princeton NJ, US
Zhichun Li - Princeton NJ, US

International Classification:

G06F 21/54
G06N 20/00
G06F 8/73
G06F 8/75
G06F 8/41
G06F 21/53

Abstract:

A method for implementing confidential machine learning with program compartmentalization includes implementing a development stage to design an ML program, including annotating source code of the ML program to generate an ML program annotation, performing program analysis based on the development stage, including compiling the source code of the ML program based on the ML program annotation, inserting binary code based on the program analysis, including inserting run-time code into a confidential part of the ML program and a non-confidential part of the ML program, and generating an ML model by executing the ML program with the inserted binary code to protect the confidentiality of the ML model and the ML program from attack.