The Boeing Company

Jai Joon Choi

Mingyan Li

Changzhou Wang

Douglas Alan Stuart

Haiqin Wang

Sidney Ly

Ali Salour

Brian Christopher Grubel

Bruce S Howard

Laurance N Hazlehurst

Eric John Martens

William R Ferng

Kelly SeiYuda Bunn

Dion Stephen David Reid

Brett Michael Wilson

Ryan D Hammond

Li Yang

Ramkumar Balasubramanian

Joshua D Cazalas

Tyler Charles Staudinger

Dragos Dorin Margineantu

Anne Kao

Robert E Cranfill

Zachary D Jorgensen

Karl Loren Johnson

Al Salour

Rodney Allen Tjoelker

Peter John Stackle

Anh-Thu N Thai

Chen-En Chen

Brett M Wilson

Laurence N Hazlehurst

A method of securing, by a managing node, communication in a network of member nodes including a first member node. Communication is secured using a (k, n) secret sharing scheme during a first phase. The managing node announces a phase shift to a subsequent phase relative to the first phase. The managing node secures communication in the network during the subsequent phase using a (k+x, n) secret sharing scheme. Each of the member nodes is previously in possession of exactly one corresponding unique share for the second key. The first member node is previously in possession of a first unique share for the second key. The managing node deletes the first member node from the subsequent phase by broadcasting the first unique share for the second key.

Threshold scheme enabled symmetric key member deletion

A method of machine learning model development includes building an autoencoder including an encoder trained to map an input into a latent representation, and a decoder trained to map the latent representation to a reconstruction of the input. The method includes building an artificial neural network classifier including the encoder, and a classification layer partially trained to perform a classification in which a class to which the input belongs is predicted based on the latent representation. Neural network inversion is applied to the classification layer to find inverted latent representations within a decision boundary between classes in which a result of the classification is ambiguous, and inverted inputs are obtained from the inverted latent representations. Each inverted input is labeled with a class that is its ground truth, and thereby producing added training data for the classification, and the classification layer is further trained using the added training data.

Machine learning model development

A multiple vehicle cyber-attack detection system including a vehicle operations center coupled to and monitoring vehicles, where each operations center includes a cyber-attack alert module. A vehicle cyber-attack detection system is in communication with each operations center and includes a first tier security module coupled to an onboard system of each vehicle and receives system log data generated by the onboard system. The first tier security module extracts extracted features from a time series of overlapping windowed system log data generated from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements. A second cyber-attack anomaly detection module includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. Each cyber-attack alert module generates a notification of the first cyber-attack and/or the second cyber-attack on a user interface.

Method and system for vehicle cyber-attack event detection

A computer-implemented method for discovering network attack paths is provided. The method includes a computer generating scoring system results based on analysis of vulnerabilities of nodes in a network configuration. The method also includes the computer applying Bayesian probability to the scoring system results and selected qualitative risk attributes wherein output accounts for dependencies between vulnerabilities of the nodes. The method also includes the computer applying a weighted-average algorithm to the output yielding at least one ranking of nodes in order of likelihood of targeting by an external attacker.

System and method for discovering optimal network attack paths

A vehicle cyber-attack detection system includes at least one first tier security module coupled to at least one onboard system of a respective vehicle and being configured so as to receive system log data generated by the at least one onboard system of the respective vehicle. The first tier security module extracts extracted features from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements determined from the extracted features, and a second cyber-attack anomaly detection module that includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. A cyber-attack alert module is coupled to the first tier security module for generating a notification of one or more of the first cyber-attack and the second cyber-attack to effect cyber-attack diagnostics and remediation by vehicle personnel.

A computer-implemented method for determining service flow rank based on service flow dependency is provided. The method includes receiving a plurality of data flow information for a plurality of data flows. Each data flow of the plurality of data flows includes a source, a destination, a start time, and an associated service. The method also includes determining a plurality of dependency sets based on the plurality of data flow information. Each dependency set of the plurality of dependency sets includes at least a first data flow and a second data flow. The method further includes calculating a plurality of dependency strengths based on the plurality of dependency sets, calculating a plurality of total service scores based on the first data flows of the plurality of dependency sets, and calculating a plurality of service flow ranks based on the plurality of dependency strengths and the plurality of total service scores.

Methods and systems for improved computer network analysis

A design and implementation of open web architecture for cyber situational awareness is disclosed herein. The architecture is user-centric, web-based and service-oriented to increase the flexibility of user dashboard and utilization of third-party provided information and web services. A method disclosed herein includes accessing a gadget workbench including a workflow to be executed by a web gadget. The method also includes interacting a data source with the workflow, interacting an analysis module with the workflow, and interacting a visualization module with the workflow. The method further includes generating the web gadget based on the data source, the analysis module and the visualization module.

Open web architecture and gadget workbench for cyber situational awareness and method therefor

An alert system may include an alert sender module, an alert routing module, an alert controller module, and an alert mechanism. The alert sender module may be configured to send an encrypted alert independent of an internet security firewall. The alert routing module may have a registry and may be configured to receive the encrypted alert and process the encrypted alert according to a security mechanism associated with the registry. The alert controller module may be configured to accept the encrypted alert from the alert routing module according to the security mechanism. The alert mechanism may be configured to be activated by the alert controller module.

System and method for transmitting an alert

In one embodiment, a data acquisition device comprises a plurality of sensors to detect an environmental condition, a configurable processor coupled to the plurality of sensors, wherein the configurable processor is configured to receive one or more signals from the plurality of sensors and process the one or more signals to generate environmental data representative of the environmental condition, and a first input/output module to transmit the data to a remote device. Other embodiments may be disclosed.

Reconfigurable network enabled plug and play multifunctional processing and sensing node

A method, apparatus, and computer program product for generating a model. A set of actions associated with a control flow of a set of attack patterns using non-deterministic controls is described to form a control block. A set of ontology references associated with the set of attack patterns is identified. The model is generated and it comprises the control block and the set of ontology references.

Modeling cyberspace attacks

A security tool is disclosed for predicting a sequence of events based on the current events observed. The security tool relies on sequential event mining algorithms to discover the baseline event patterns, from which a prediction can be performed. The security tool translates the sequential patterns into a Dynamic Bayesian Network prediction model. A temporal reasoning engine then feeds the model with the current event status and predicts what events are likely to happen in next time window, and with what probability.

System and method for network security event modeling and prediction

The embodiments described herein describe a computerized system and method for retrieving and processing data to provide dependency and root cause information for a process. The computerized system and method include receiving historic data of the process, detecting temporal dependency or precedence tasks in the process from the historic data, generating a historic dependency graph, aggregating the historic dependency graph into a probabilistic precedence network (PPN), pruning the PPN, and presenting results to a user.

Growing community of inventors

Sammamish, WA, United States of America

Jai Joon Choi