Lockheed Martin Corporation

Eric R Steinbrecher

Jeremy Impson

Scott Charles Evans

Thomas Stephen Markham

Weizhong Yan

Bruce Gordon Barnett

John Moody

Bernhard Joseph Scholz

Richard Bejtlich

Nader Mehravari

Robert J Mitchell, Jr

Stephen J Dill

Edward E Eiland

T Stephen Markham

An intrusion detection method, system and computer-readable media are disclosed. The system can include a processor programmed to perform computer network intrusion detection. The intrusion detection can include an identification module and a detection module. The identification module can be adapted to perform semi-supervised machine learning to identify key components of a network attack and develop MDL models representing those attack components. The detection module can cluster the MDL models and use the clustered MDL models to classify network activity and detect polymorphic or zero-day attacks.

Intrusion detection using MDL clustering

A network intrusion detection system and method that includes a grammar inference engine. A grammar-based Minimum Description Length (MDL) compression algorithm is used to determine an attack based on closeness of fit to one or more compression models. The network intrusion detection system and method can determine zero day attacks.

Network intrusion detection using MDL compress for deep packet inspection

A network activity visualization system can include an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Network attack visualization and response through intelligent icons

A network activity visualization system can include a minimum description length (MDL) based network intrusion detection system having an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module coupled to the MDL-based intrusion detection system and adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Network intrusion detection visualization

A system and method for rapid deployment of economically feasible wide-area general-purpose telecommunications systems and services in urban, suburban, rural, and other inhabited geographical areas is disclosed. The solution described here is of particular importance in the aftermath of such events as catastrophic accidents, natural disasters, terrorist attacks, riots, and acts of war during which the local telecommunications infrastructure is destroyed. In addition, the basic methods and architectures defined herein are applicable to those scenarios in which wide-area telecommunication services must be deployed rapidly in previously uninhabited area such as military deployments.

Rapidly deployable emergency communications system and method

Transponders capable of providing identification information and possibly additional information are detected from wireless access points of a computer network as a substitute for closed radio frequency identification (RFID) systems while providing numerous additional functionalities and applications. Total asset visibility or responses to more limited queries are provided by inclusion of a geographic information system software application. Location reporting of proximity of devices/transponders to access points can be enhanced to a fine-grained level by triangulation or other algorithms including neural networks.

Growing community of inventors

Binghamton, NY, United States of America

Eric R Steinbrecher