Bastille Networks, Inc.

International Business Machines Corporation

Bastille Network, Inc.

Christopher Jay Rouland

Robert Baxley

Michael Thomas Engle

David Maynor

Christopher W Klaus

Logan Michael Lamb

Patrick Morton Becker

Trung Dinh

Justin Trent Altman

Robert John Baxley

Systems and methods can support a sensor mesh and signal transmission architecture for electromagnetic signature analysis and threat detection. Sensor antennas may be deployed within an electromagnetic environment. A configurable antenna feed network can couple radio frequency signals from the antennas to both software-defined radio receivers and hardware-defined radio receivers. A raw signal analysis engine associated with the software-defined radio receiver can receive digital samples of the radio frequency signals, identify signal features within the digital samples, and generate signal feature vectors from the identified signal features. A signal feature network can receive the signal feature. A signal aggregation and analysis engine can receive the signal feature vectors from the signal feature network, aggregate the signal feature vectors, process the signal feature vectors, and identify wireless attacks according to the signal features within the signal feature vectors. One or more updatable analysis databases can support the signal processing operations.

Sensor mesh and signal transmission architectures for electromagnetic signature analysis

Systems and methods can support identifying radio transmissions associated with autonomous or remote-controlled vehicles. Radio frequency signals may be received using one or more sensors, wherein the sensors comprise radio receivers. Radio frequency fingerprints may be identified within one or more of the radio frequency signals, wherein the radio frequency fingerprints comprise radio signal characteristics or radio hardware identifiers. A stored radio frequency fingerprint may be determined as matching the received radio frequency fingerprint. A motion characteristic may be computed. The received radio frequency fingerprint may be associated with an autonomous or remote-controlled vehicle based upon the stored radio frequency fingerprint or the motion characteristic. Information regarding the identified autonomous or remote-controlled vehicle may be presenting to one or more operator interfaces.

Ground and air vehicle electromagnetic signature detection and localization

Systems and methods can support threat detection using electromagnetic signatures. One or more sensors comprising radio receivers may receive radio frequency signals within an electromagnetic environment. Radio frequency signatures may be identified from one or more of the radio frequency signals. A baseline electromagnetic environment may be established from the radio frequency signatures. The radio frequency signatures may be monitored over time to detect variations from the baseline electromagnetic environment. Variations in the electromagnetic environment may be evaluated against stored threat signatures. Operator interfaces may present indications of threats determined from evaluating the variations in the electromagnetic environment.

Electromagnetic threat detection and mitigation in the Internet of Things

Systems and methods can support a computational signal processing architecture for electromagnetic signature analysis and threat detection. A plurality of sensor antennas can couple a radio frequency signal into a radio receiver. The radio receiver can generate digital samples of the signal. A raw signal analysis engine can identify signal features within the digital samples, generate signal feature vectors from the identified signal features, decode signal content from the signal feature vectors, and transmit the signal feature vectors into a signal feature network. The signal feature vectors may be aggregated from the signal feature network into a signal aggregation and analysis engine. The signal aggregation and analysis engine can refine feature vectors through processing such as identifying wireless attacks according to the signal features within the signal feature vectors. One or more operator interfaces and one or more analysis databases may support these operations.

Computational signal processing architectures for electromagnetic signature analysis

Systems and methods can support coprocessing radio signals and video to identify and locate a radio transmitter. Positions and orientations for cameras and RF sensors may be maintained. An RF signature associated with the radio transmitter may be received from the RF sensors to determine an RF persona. A first physical location for the radio transmitter may be estimated according to a physical radio propagation model operating on RF signals. A video stream from one or more of the cameras may be received. An individual may be identified in the video stream using computer vision techniques. A second physical location for the radio transmitter may be estimated from the video stream. Relationships may be established between the first physical location and the second physical location and between the RF persona and the identified individual. The relationships may be presented to an operator interface.

Diverse radio frequency signature, video, and image sensing for detection and localization

Systems and methods can support detecting and identifying threats associated with wireless devices. A radio receiver can collect radio frequency signals from one or more sensor antennas positioned within an electromagnetic environment. The receiver can generate data samples representing at least a portion of the radio frequency signals. Feature vectors can be generated comprising at least a portion of the data samples and attribute information. The attribute information can describe one or more features of a communicated signal within the radio frequency signals. Content of the feature vectors may be compared against signatures of known signals to identify radio frequency signals associated with a wireless attack. Content of the feature vectors may be compared against templates of known attacks to classify the identified wireless attacks. Threat information associated with the wireless attacks may be presented to one or more operator interfaces.

Electromagnetic signature analysis for threat detection in a wireless environment of embedded computing devices

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super-persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Anomalous behavior detection based on behavioral signatures

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Electromagnetic persona generation based on radio frequency fingerprints

Systems and methods can support detecting and identifying threats associated with wireless devices within an electromagnetic environment. One or more sensor antennas may be located within the electromagnetic environment. Radio frequency signals may be coupled from the sensor antennas into a radio receiver. The radio receiver can communicate data samples representing a portion of the radio frequency signal to a raw signal analysis engine. The raw signal analysis engine can identify features associated with a communicated signal within the data samples. The raw signal analysis engine can classify modulation features and decode information features from the communicated signal. Feature vectors may be generated comprising the data samples and the identified features associated with the data samples. The feature vectors can be transmitted to a signal aggregation and analysis engine to support detecting and identifying electromagnetic threats and to support associated operator interfaces.

Blind signal classification and demodulation in a multimodal radio frequency environment

Radio frequency fingerprint detection

Anomalous behavior detection using radio frequency fingerprints and access credentials

Security measures based on signal strengths of radio frequency signals

A dynamic protection system can analyze a computer system to determine its vulnerabilities to attack and generate a policy for protecting the computer system based on the identified vulnerabilities. Data received by the computer system can be analyzed to determine if it poses a threat to the system. This can prevent the data from entering the system or host based on a determination that the data poses a threat. Also, the dynamic protection system can receive policy updates to allow it to protect the system more efficiently and effectively. In other words, the dynamic protection system can protect an evolving computer system operating in an environment that is characterized by constantly changing methods of attack. Furthermore, by minimizing a need for manual intervention, attacks can be rapidly and accurately detected with a minimization of false positives, thereby lowering the cost of operation.

Growing community of inventors

Atlanta, GA, United States of America

Christopher Jay Rouland