Author: claimsbot

1. A method of inspecting content intended for a workstation to inspect content that performs exploits, comprising:
receiving the content for inspection at an inspection server using a processor and memory
loading a virtual machine at the inspection server with an operating system and processes for inspecting the content, wherein the operating system and processes are similar to those executed at the intended workstation;
activating the content in the virtual machine; and,
tracing the activity of the virtual machine to form trace data by using features of the processor;
wherein upon occurrence of an exception control is transferred to an analyzer that analyzes the trace data based on a context of the exception; and a notification is provided if suspicious activity is detected.
2. A method according to claim 1, wherein the inspection server intercepts the content before being provided to the workstation.
3. A method according to claim 1, wherein the inspection server receives the content from the workstation.
4. A method according to claim 1, wherein the trace includes recording details of flow control instructions executed by the virtual machine.
5. A method according to claim 1, wherein the trace includes recording a list of modules inside processes executed by the virtual machine and the addresses of memory pages used by the modules.
6. A method according to claim 1, wherein the trace includes recording a page dump of memory pages used by modules of processes executed by the virtual machine when initializing the modules.
7. A method according to claim 1, wherein the trace includes recording a page dump of a memory page used by modules of processes executed by the virtual machine before starting to execute code from the memory page.
8. A method according to claim 1, wherein the exception includes a change in the executed page address due to transfer of control from one process to another by the operating system.
9. A method according to claim 1, wherein the exception includes receiving notification that a memory for storing details of flow control instructions executed by the virtual machine is full.
10. A method according to claim 1, wherein the exception includes receiving notification if the processor is set to execute code from a user mode memory page while the current privilege level of the processor is lower than 3.
11. A method according to claim 1, wherein the trace includes recording a page dump of a memory page wherein the page permission changed from-non executable to executable.
12. A method according to claim 1, wherein the exception includes receiving notification that the process crashed or that the operating system crashed.
13. A method according to claim 1, wherein the trace includes receiving a memory page marked as readwriteexecute and changing the memory page permissions in the shadow page table to readwrite; and,
if an attempt to execute code from the page occurs, then changing the memory age permissions in the shadow page table to readexecute and dumping the page content;
then, if an attempt to write to the page occurs changing the memory page permissions in the shadow page table to readwrite.
14. A method according to claim 1, wherein activity is suspicious if activation of the content leads to detection of jump oriented programming (JOP) patterns.
15. A method according to claim 1, wherein activity is suspicious if activation of the content leads to detection of return oriented programming (ROP) patterns.
16. A method according to claim 1, wherein activity is suspicious if activation of the content leads to a crash of the process or of the operating system in the virtual machine.
17. A method according to claim 1, wherein activity is suspicious if activation of the content leads to the processor being set to a different execution level than a memory page with the code being executed.
18. An inspection server for inspecting content intended for a workstation to detect content that performs malicious exploits, comprising:
a general purpose computer using a processor and memory to serve as the inspection server receiving the content for inspection;
a hypervisor application in the inspection server for loading a virtual machine with an operating system and processes, wherein the operating system and processes are similar to those executed at the intended workstation; and,
an analyzer application;
wherein the inspection server is programmed to activate the content and trace activity of the virtual machine to form trace data by using features of the processor; and upon occurrence of art exception the analyzer analyzes the trace data based on a context of the exception and notifies if suspicious activity is detected.
19. An inspection server according to claim 18, wherein the operating system is halted when the analyzer application is executed in the virtual machine.
20. A non-transitory computer readable medium comprising computer code to be executed by a general purpose computer for performing a method according to claim 1.
21. A method of detecting potentially malicious content, comprising:
identifying the content for inspection;
upon occurrence of an application processing the content on a processor, tracing the activity of the processor in order to form trace data, by using features of the processor;
upon occurrence of an exception, transferring control to an analyzer that detects suspicious activity according to the trace data based on a context of the exception;
22. A method according to claim 21, wherein identifying the content is performed by identifying attachments in email with potentially malicious file types.
23. A method according to claim 21, wherein identifying the content is performed by identifying content in data received from a web site with potentially malicious data types.
24. A method according to claim 21, wherein the trace includes recording details of flow control instructions executed by the workstation
25. A method according to claim 21, wherein the trace includes recording a list of Modules inside processes executed by the workstation and the addresses of memory pages used by the modules.
26. A method according to claim 21, wherein the trace includes recording a page dump of memory pages used by modules of processes executed by the workstation.
27. A method according to claim 21, wherein the trace includes recording a page dump of a memory page used by modules of processes executed by the workstation before starting to execute code from the memory page.
28. A method according to claim 21, wherein a notification is provided upon the detection of suspicious activity.
29. A method according to claim 21, wherein a virtual machine is loaded for activating the content.
30. A method according to claim 21, wherein an inspection server intercepts the content before being provided to a workstation.
31. A method according to claim 21, wherein an inspection server receives the content from a workstation.
32. A computer system for detecting potentially malicious content, comprising:
a storage medium for storing computer components; and
a computerized processor for executing the computer components comprising:
a first computer component for identifying content for inspection;
a second computer component for tracing the activity of the processor processing the content in order to form trace data, by using features of the processor
a third computer component for, upon occurrence of an exception, transferring control to an analyzer that detects suspicious activity according to the trace data based on
a context of the exception;
a fourth computer component for, detecting suspicious activity according to the trace data based on a context of the exception.

The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.

1. A rotary pulse type filter dust collector comprising:
a dust collector body having an intermediate plate;
a number of filter bags arranged vertically in the dust collector body;
a compressed air tank located inside a machine room formed on the intermediate plate, and movably mounted above the intermediate plate by means of driving means, the compressed air tank receiving compressed air introduced from the outside;
a number of nozzles perforating the compressed air tank;
diaphragm valves connected to the nozzles respectively and correspondingly;
mechanical 3-way valves for driving the plurality of nozzles and diaphragm valves of the compressed air tank by predetermined groups in order to clean the corresponding filter bags, the mechanical 3-way valves of the same number as the groups being mounted in the compressed air tank;
a number of protrusions formed on the inner walls of the machine room to change the air flow direction of the 3-way valves by pressing manipulation levers of the 3-way valves;
a reduction motor and an mechanical transmitting device for driving the compressed air tank; and
an inverter controller for controlling a cleaning interval of the dust collector by controlling the rotational speed of the driving means.
2. The rotary pulse type filter dust collector according to claim 1, wherein the 3-way valve includes:
a valve entrance hole for receiving compressed air from the compressed air tank;
a valve exit hole for discharging the compressed air to a side of the diaphragm valve; and
a manipulation lever for generating signals in contact with the protrusions to change it’s air flow direction.
3. The rotary pulse type filter dust collector according to claim 1, wherein the compressed air tank is formed in a fan shape or a rectangular-shape according to the shape of the dust collector body.
4. The rotary pulse type filter dust collector according to claim 3, wherein if the compressed air tank is in the fan shape, the 3-way valve is located on the circumferential surface of the compressed air tank, and is in contact or not in contact with the protrusions formed on the inner walls of the machine room when the fan-shaped compressed air tank is rotated on the center of the intermediate plate.
5. The rotary pulse type filter dust collector according to claim 3, wherein if the compressed air tank is in a hexahedral shape, the 3-way valves are located on both side surfaces of the compressed air tank, and is in contact or not in contact with the protrusions formed on side surfaces of the machine room when the compressed air tank performs a reciprocating motion.
6. The rotary pulse type filter dust collector according to claim 1, wherein the driving means is arranged on the side surface or the upper portion of the machine room.
7. The rotary pulse type filter dust collector according to claim 6, wherein the driving means arranged on the side surface of the machine room includes:
at least one wheel mounted on the lower end of the compressed air tank in a rolling way;
a reduction motor;
a driving shaft and a driving sprocket connected to the reduction motor;
a driven shaft and a driven sprocket separated from the driving sprocket at opposite side;
a chain for connecting the driving sprocket and the driven sprocket with each other; and
a protrusion formed on the chain for driving the compressed air tank.
8. The rotary pulse type filter dust collector according to claim 4, 6, 7, wherein the inverter controller controls the cleaning interval by means of controls the rotational speed of the reduction motor.

1. A method for the differentiation of HBV infection stages which comprises the identification of cell and particle-free full-length HBV transcripts (I) and truncated HBV transcripts (II) extracted from a body fluid sample, wherein the ratio of I:II is indicative of a particular infection stage.
2. The method of claim 1 wherein the body fluid is serum.
3. The method of claim 2 wherein an apparent ratio of I:II>1 is indicative of a highly replicative HBV infection stage.
4. The method of claim 2 wherein an apparent ratio of I:II<1 is indicative of a chronic HBV infection stage.
5. The method of claim 4 wherein an apparent ratio of I:II<1 is indicative of a late stage of such a chronic HBV infection stage.
6. The method of claim 2, 4 or 5 wherein an apparent ratio of I:II<1 is indicative of a risk to develop HCC.
7. The method of claim 2 wherein circulating HBV-RNA found in the absence of other HBV seromarkers is indicative of occult stages of HBV infection.
8. The method of any one of claims 1 to 7 wherein the circulating HBV transcipts are transcripts comprising the X-region of HBV (HBx RNA).
9. The method of any one of claims 1 to 8 wherein identification of full-length transcripts (I) and truncated HBV transcripts (II) in serum is carried out by RTPCR using anchored oligo(dT) downstream primer(s) allowing to discriminate between full-length HBV transcripts (I) and truncated HBV transcripts (II).
10. The method of claim 9 wherein the oligo(dT)anchored primers comprise the nucleotide sequence (T)15 GCT GG, (T)15 GAA GC andor (T)15 AGC TC.
11. The method of any one of claims 9 and 10 wherein the identification of full-length HBV transcripts (I) and truncated HBV transcripts (II) by RTPCR comprises a semi-nested PCR using in the second PCR step an upstream primer which is located downstream of the upstream primer of the first PCR step.
12. The method of any one of claims 8 to 11 wherein the PCR-products are characterized by agarose gel electrophoresis or automatized fluorescence emission spectra.
13. Kit for carrying out the method of any of claims 1-12 comprising at least one of the oligo(dT)anchored primers of claim 10.

The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.

What is claimed is:

1. A method of monitoring apparatuses of manufacturing integrated circuit (IC), while a plurality of lots of wafers are processed by a plurality of apparatuses, used for monitoring a plurality of apparatus events, the method of monitoring apparatuses of manufacturing IC comprising:
providing a database with a plurality of data of the apparatus events;
downloading the data of the apparatus events from the database;
calculating a plurality of achievement indices by using the data of the apparatus events;
establishing a control chart by using the achievement indices;
establishing a knowledge archive of rules by using the data of the apparatus events, the achievement indices, and the control chart, and determining a plurality of limitative rules to detect an abnormal point;
forming a calendar file by sorting the data of the apparatus events with time; and
executing a step of replaying the apparatus events so as to proceed a rectification.
2. The method of monitoring apparatuses of manufacturing IC of claim 1, wherein the data of the apparatus events comprises: an apparatus status, a plurality of transferred out accounts, and a plurality of data of work in process (WIP).
3. The method of monitoring apparatuses of manufacturing IC of claim 1, wherein the achievement indices comprises a production output (move), a productive time (PT), a pieces of hour (POH), a time of waiting for material (loss time; LT), a batch count (batch), a averaged waiting time of WIP (W), and a waiting length of WIP (L).
4. The method of monitoring apparatuses of manufacturing IC of claim 1, wherein the control chart is established by gathering about 60 data in 2 months of the data of the apparatus events, and restricted by 3 standard deviations.
5. The method of monitoring apparatuses of manufacturing IC of claim 1, wherein the calendar file comprises a plurality of changes of the apparatus statuses, transferred out accounts, and WIP.
6. The method of monitoring apparatuses of manufacturing IC of claim 1, wherein the step of replaying apparatus events further comprises establishing a apparatus replaying system by establishing a plurality of graphic interfaces with the calendar file and the knowledge archive of rules.
7. The method of monitoring apparatuses of manufacturing IC of claim 6, wherein the apparatus replaying system is programmed by the language which is selected from a group consisting of visual basic and foxpro.
8. A method of monitoring apparatuses of manufacturing integrated circuit (IC), while a plurality of lot s of wafers are processed by a plurality of apparatuses, used for monitoring a plurality of apparatus events, the method of monitoring apparatuses of manufacturing IC comprising:
providing a database with a plurality of data of the apparatus events;
downloading the data of the apparatus events from the database;
calculating a plurality of achievement indices by using the data of the apparatus events;
establishing a control chart by using the achievement indices;
establishing a knowledge archive of rules by using the data of the apparatus events, the achievement indices, and the control chart;
forming a calendar file by sorting the data of apparatus events with time; and
executing a step of replaying apparatus events by a apparatus replaying system so as to read the apparatus events.
9. The method of monitoring apparatuses of manufacturing IC of claim 8, wherein the data of the apparatus events comprises: an apparatus state, a plurality of transferred out account, and a plurality of data of work in process.
10. The method of monitoring apparatuses of manufacturing IC of claim 8, wherein the achievement indices comprises a production output (move), a productive time (PT), a pieces of hour (POH), a time of waiting for material (loss time; LT), a batch count (batch), an averaged waiting time of WIP (W), and a waiting length of WIP (L).
11. The method of monitoring apparatuses of manufacturing IC of claim 8, wherein the control chart is established by gathering about 60 data in 2 months of the data of the apparatus events, and restricted by 3 standard deviations.
12. The method of monitoring apparatuses of manufacturing IC of claim 8, wherein the calendar files comprises a plurality changes of apparatus statuses, transferred out accounts, and WIP.
13. The method of monitoring apparatuses of manufacturing IC of claim 1, wherein the step of establishing the knowledge archive with rules further comprises determining a plurality of limitative rules to detect an abnorml point.
14. The method of monitoring apparatuses of manufacturing IC of claim 8, wherein the step of replaying apparatus events by an apparatus replaying system further comprises establishing a plurality of graphic interfaces with the calendar file and the knowledge archive of rules.
15. The method of monitoring apparatuses of manufacturing IC of claim 8, wherein the replaying system of apparatuses is programmed by the language which is selected from a group consisting of visual basic and foxpro.
16. A system of monitoring apparatuses of manufacturing IC, to monitor a plurality of the apparatus events, wherein a plurality of apparatuses process a plurality of lots of wafers with a plurality of steps, the system of monitoring apparatuses of manufacturing IC comprising:
a control mainframe for controlling the apparatuses;
a data mainframe with a plurality of operation parameters for recording a plurality of data of the apparatus events and a plurality of process data; and
a control mainframe for executing a process of monitoring the apparatuses by replaying the apparatus events processing the lots of wafers, the process of monitoring apparatuses comprising:
downloading the data of the apparatus events from the data mainframe;
calculating a plurality of achievement indices by using the data of the apparatus events;
establishing a control chart by using the achievement indices;
establishing a knowledge archive of rules by using the data of the apparatus events, the achievement indices, and the control chart, and determining a plurality of limitative rules to detect an abnormal point;
forming a calendar file by sorting the data of apparatus events with time; and
executing a step of replaying apparatus events so as to proceed a rectification.
17. The system of monitoring apparatuses of manufacturing IC of claim 16, wherein the control chart is established by gathering about 60 data in 2 months of the data of apparatus events, and restricted by 3 standard deviations.
18. The system of monitoring apparatuses of manufacturing IC of claim 16, wherein the calendar files comprises a plurality changes of apparatus statuses, transferred out accounts, and WIP.
19. The system of monitoring apparatuses of manufacturing IC of claim 16, wherein the step of replaying the apparatus events further comprises establishing a apparatus replaying system by stablishing a plurality of graphic interfaces with the calendar file and the knowledge archive of rules.
20. The system of monitoring apparatuses of manufacturing IC of claim 19, wherein the apparatus replaying system is programmed by the language which is selected from a group consisting of visual basic and foxpro.