Lockheed Martin Corporation

Jeremy Impson

Scott Charles Evans

Thomas Stephen Markham

Eric R Steinbrecher

Nader Mehravari

Kenneth B Donovan

John Moody

Edward E Eiland

Weizhong Yan

Bruce Gordon Barnett

Michael C Dapp

Bernhard Joseph Scholz

Richard Bejtlich

Robert J Mitchell, Jr

Stephen J Dill

T Stephen Markham

David M Ciarletta

An intrusion detection method, system and computer-readable media are disclosed. The system can include a processor programmed to perform computer network intrusion detection. The intrusion detection can include an identification module and a detection module. The identification module can be adapted to perform semi-supervised machine learning to identify key components of a network attack and develop MDL models representing those attack components. The detection module can cluster the MDL models and use the clustered MDL models to classify network activity and detect polymorphic or zero-day attacks.

Intrusion detection using MDL clustering

An intrusion masquerade detection system and method that includes a grammar inference engine. A grammar-based Minimum Description Length (MDL) compression algorithm is used to determine a masquerade based on a distance from a threshold in a model of an estimated algorithmic minimum sufficient statistic.

Intrusion detection using MDL compression

MDL compress system and method for signature inference and masquerade intrusion detection

A network intrusion detection system and method that includes a grammar inference engine. A grammar-based Minimum Description Length (MDL) compression algorithm is used to determine an attack based on closeness of fit to one or more compression models. The network intrusion detection system and method can determine zero day attacks.

Network intrusion detection using MDL compress for deep packet inspection

A network activity visualization system can include an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Network attack visualization and response through intelligent icons

A network activity visualization system can include a minimum description length (MDL) based network intrusion detection system having an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module coupled to the MDL-based intrusion detection system and adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Network intrusion detection visualization

One embodiment is directed to providing access between external systems and embedded vehicle electronic systems. That is, an interface module may receive information from a system external to the vehicle, determine an embedded system of the vehicle to which to provide the information, and provide the information to the embedded system. Similarly, the interface module may receive information a embedded electronic systems of a vehicle, determine a system external the vehicle to which to provide the information, and provide the information to the external system.

Methods and apparatus for providing access to vehicle electronic systems

Methods and apparatus for interfacing external systems with vehicle electronic systems

A system and method for rapid deployment of economically feasible wide-area general-purpose telecommunications systems and services in urban, suburban, rural, and other inhabited geographical areas is disclosed. The solution described here is of particular importance in the aftermath of such events as catastrophic accidents, natural disasters, terrorist attacks, riots, and acts of war during which the local telecommunications infrastructure is destroyed. In addition, the basic methods and architectures defined herein are applicable to those scenarios in which wide-area telecommunication services must be deployed rapidly in previously uninhabited area such as military deployments.

Rapidly deployable emergency communications system and method

A system and method for detecting if an object has been tampered with comprising a characterizer, a comparator, and indicator, and optionally, a signer. The characterizer generates a first digital characterization of an object at a first time and at least one subsequent digital characterization of the object at at least one subsequent time. The comparator compares the first digital characterization with the at least one subsequent digital characterization, and the indicator generates a pre-selected characterization signal if the first and subsequent digital characterizations don't match. Optionally, the first digital characterization can be accompanied by a first digital signature. The signer optionally verifies the digital signature at the at least one subsequent time.

System and method for detecting alteration of objects

A system and method for mobile platform real-time collection, transmission, and processing of an array of environmental and vehicle-related data in the context of an Intelligent Transportation System (ITS) network. The system and method provide enhanced in-vehicle data collection, enhanced communications capability between the vehicle and the ITS system, and enhanced ITS implementation functionality to provide real-time incident reporting to ITS users.

Incident-aware vehicular sensors for intelligent transportation systems

A traffic characterization system and method of use for executing a traffic characterization protocol over an ad hoc communications network. Conventional in-vehicle computers and conventional wireless local area network (LAN) transceivers host the traffic characterization system and the messages generated by the system. As a traffic jam occurs, the mobile units send out traffic characterization data in a sequence activated by the content of the messages and traffic characterization protocol of the present invention. All vehicles participating in the traffic characterization system and approaching the traffic jammed area receive the characterization data and have the opportunity to route around the jam.

Growing community of inventors

Vestal, NY, United States of America

Jeremy Impson