The Boeing Company

Douglas Alan Stuart

Jai Joon Choi

Mingyan Li

Brett Michael Wilson

Mark Jonathan Handel

Hugh L Taylor

Steven A Dorris

Eric John Martens

Li Yang

Ramkumar Balasubramanian

Joshua D Cazalas

Steve A Dorris

Brett M Wilson

A method of securing, by a managing node, communication in a network of member nodes including a first member node. Communication is secured using a (k, n) secret sharing scheme during a first phase. The managing node announces a phase shift to a subsequent phase relative to the first phase. The managing node secures communication in the network during the subsequent phase using a (k+x, n) secret sharing scheme. Each of the member nodes is previously in possession of exactly one corresponding unique share for the second key. The first member node is previously in possession of a first unique share for the second key. The managing node deletes the first member node from the subsequent phase by broadcasting the first unique share for the second key.

Threshold scheme enabled symmetric key member deletion

A multiple vehicle cyber-attack detection system including a vehicle operations center coupled to and monitoring vehicles, where each operations center includes a cyber-attack alert module. A vehicle cyber-attack detection system is in communication with each operations center and includes a first tier security module coupled to an onboard system of each vehicle and receives system log data generated by the onboard system. The first tier security module extracts extracted features from a time series of overlapping windowed system log data generated from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements. A second cyber-attack anomaly detection module includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. Each cyber-attack alert module generates a notification of the first cyber-attack and/or the second cyber-attack on a user interface.

Method and system for vehicle cyber-attack event detection

A vehicle cyber-attack detection system includes at least one first tier security module coupled to at least one onboard system of a respective vehicle and being configured so as to receive system log data generated by the at least one onboard system of the respective vehicle. The first tier security module extracts extracted features from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements determined from the extracted features, and a second cyber-attack anomaly detection module that includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. A cyber-attack alert module is coupled to the first tier security module for generating a notification of one or more of the first cyber-attack and the second cyber-attack to effect cyber-attack diagnostics and remediation by vehicle personnel.

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. An implementation of the DCA may detect anomalous behavior in various processes of a device or devices. Unlike previous approaches, the DCA implementation may use an inflammation signal to communicate information among the processes of device or a network, where the inflammatory signal indicates a likelihood that a process has been attacked by malicious software.

Process level locality and specialization for threat detection in the dendritic cell algorithm

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. A DCA module may receive an output or signal from multiple indicators concerning the state of at least a portion of the system. The DCA module is configured to combine the plurality of signals into a single signal vector. The DCA module may be configured to sort the received signals based on signal type and magnitude of each signal. The DCA module may then use a decay factor to weight the received signals so that a large number of 'nominal' signals do not drown out a small number of 'strong' signals indicating a malware attack. The decay factor may be exponentially increased each time it is applied so that all received signals are considered by the DCA module, but so that the &#x201c;nominal&#x201d; signals may have a minimal effect.

Method for combining multiple signal values in the dendritic cell algorithm

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. The DCA implementation may use an inflammation signal to communicate information among the processes of device or a network or among nodes of a network, where the inflammatory signal indicates a likelihood that a process or a node has been attacked by malicious software. The DCA implementation may dynamically change the malware sensitivity and responsiveness based on the inflammation signals without requiring user intervention. The inflammatory signal includes one or more inflammatory tuples, which may include multiple components such as a strength, a PrimeIndicator, and an optional third element, p. The strength component may be an indication of the magnitude of an attack and provide a degree of certainty of the attack. The PrimeIndicator may be an identifier of the indicator type that is the source of the inflammation tuple.

Dynamic loading and configuation of threat detectors based on feedback from other nodes

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. An implementation of the DCA may detect anomalous behavior in various embedded network systems. Unlike previous approaches, the DCA implementation may use an inflammation signal to communicate information among the nodes of a distributed or centralized network, where the inflammatory signal indicates a likelihood to the connected nodes that a local node has been attacked by malicious software.

Growing community of inventors

St. Charles, MO, United States of America

Douglas Alan Stuart