Acalvio Technologies, Inc.

Neo Prime, LLC

Lawrence Livermore National Security, LLC

Shadow Networks, Inc.

Craig A Schultz

Johnson L Wu

Yadong Zhang

Steven M Silva

Eric Winsborrow

John J Nitao

Ching-Hai Tsai

Jeffrey M Starr

John Compton

Charles R Carrigan

David J Simons

Philip E Harben

Barry A Kirkendall

A system and method are presented for forecasting the risk of cyber-attacks on targeted networks. The described technology quantifies linear and non-linear damages to network-dependent assets by propagating probabilistic distributions of events in sequence and time in order to forecast damages over specified periods. Damage-forecasts are used to estimate probabilistically time-varying financial losses for cyber-attacks. The described technology incorporates quantities and dependencies for pricing insurance, re-insurance, and self-insurance, assessing cost-benefit tradeoffs for sequenced implementation of security control measures, and detecting attacks in the targeted network.

Probabilistic model for cyber risk forecasting

Methods and systems are presented of presenting false and/or decoy content to an intruder operating on a computer system by obfuscating critical files on a computer storage device with data that directs subsequent infiltration and propagation to designated decoy hosts and decoy applications. Method and systems are provided for selectively presenting different contents to different viewers/users of application resource files for the purpose of preventing the valuable content from being read, tampered with, exfiltrated, or used as a means to perform subsequent attacks on network resources.

Alternate files returned for suspicious processes in a compromised computer network

A shadow network, which can be a virtual reproduction of a real, physical, base computer network, is described. Shadow networks duplicate the topology, services, host, and network traffic of the base network using shadow hosts, which are low interaction, minimal-resource-using host emulators. The shadow networks are connected to the base network through virtual switches, etc. in order to form a large obfuscated network. When a hacker probes into a host emulator, a more resource-intensive virtual machine can be swapped in to take its place. When a connection is attempted from a host emulator to a physical computer, the a host emulator can step in to take the place of the physical computer, and software defined networking (SDN) can prevent collisions between the duplicated IP addresses. Replicating the shadow networks within the network introduces problems for hackers and allows a system administrator easier ways to identify intrusions.

Network infrastructure obfuscation

A method and apparatus is utilized to determine the bearing and/or location of sources, such as, alternating current (A.C.) generators and loads, power lines, transformers and/or radio-frequency (RF) transmitters, emitting electromagnetic-wave energy for which a Poynting-Vector can be defined. When both a source and field sensors (electric and magnetic) are static, a bearing to the electromagnetic source can be obtained. If a single set of electric (E) and magnetic (B) sensors are in motion, multiple measurements permit location of the source. The method can be extended to networks of sensors allowing determination of the location of both stationary and moving sources.

Poynting-vector based method for determining the bearing and location of electromagnetic sources

Growing community of inventors

Danville, CA, United States of America

Craig A Schultz