Raytheon Company

Brandon Woolley

Norman Cramer

Matthew Hammond

Ross MacKinnon

Holger M Jaenisch

James W Handley

Brian D McFarland

Guy G Swope

William L Cram

Ross Mackinnon

Eric Rammelsberg

Mark A Bradbury

Ryan Howard Thomson

Michael J Lambert

Brian Mcfarland

A system and method for detecting embedded malware from a device including a receiver for receiving embedded binary image; a memory for encoding and storing the received embedded binary image; and one or more processors coupled to the receiver. The method includes extracting statistical features from the encoded embedded binary image; producing gridded data from the statistical features, using SV; inputting the gridded data to a machine learning (ML) trained to detect embedded malware from the gridded data; and determining whether the embedded binary image is benign or malware.

Embedded malware detection using spatial voting and machine learning

A method of generating cyber chaff can include determining a cell of a grid of cells to which a first feature and a second feature of user data maps, identifying a cell type of the cell, the cell type indicating whether the cell is an active cell, an inactive cell, or a sub-process cell, and providing cyber chaff based on cyber chaff data associated with either (a) one or more cells of the inactive cell type or (b) one or more cells of the sub-process cell type.

Cyber chaff using spatial voting

A method, apparatus and computer-readable medium for testing a target device. A fuzzer and a monitor are connected to the target device via a tactical bus. The fuzzer records messages sent from a source device to the target device over the tactical bus, creates a first fuzzed message having a data structure of the recorded message, and sends the first fuzzed message to the target device over the tactical bus. A fuzzer monitor monitors the target device for an anomalous response to the first fuzzed message, and determines a vulnerability of the target device from the response to the first fuzzed message.

Tactical bus fuzz tester

A system and methods are disclosed for securely booting a processing system using a three step secure booting process. Several embodiments are presented, wherein upon power-on-reset, the first boot step uses a secure boot device comprising of a programmable device or an FPGA which boots up first, validates its configuration file and then validates the processor(s) configuration data before presenting the configuration data to the processor(s). This enables validation of 'pre-boot' information, such as the Reset Control Word and pre-boot processor configuration data. The second and third boot steps validate the internal secure boot code and external boot code respectively using one or more of secure validation techniques, such as encryption/decryption, Key mechanisms, privilege checking, pointer hashing or signature correlation schemes. This results in an end-to-end secure boot process for a variety of architectures, such as single processor systems, synchronous and asynchronous multiprocessing systems, single core systems and multi-core processing systems.

Mediated secure boot for single or multicore processors

A separation kernel isolating memory domains within a shared system memory is executed on the cores of a multicore processor having hardware security enforcement for static virtual address mappings, to implement an efficient embedded multi-level security system. Shared caches are either disabled or constrained by the same static virtual address mappings using the hardware security enforcement available, to isolate domains accessible to select cores and reduce security risks from data co-mingling.

Multi-level, hardware-enforced domain separation using a separation kernel on a multicore processor with a shared cache

Growing community of inventors

Murphy, TX, United States of America

Brandon Woolley