Architecture Technology Corporation

Judson Powers

Robert A Joyce

Matthew P Donovan

Scott Aloisio

Daniel McArdle

Matthew A Stillerman

Paul Nicotera

Colleen Kimball

Joseph Sirianni

Tyler J Mitchell

Dahyun Hollister

Jason Hogan

Valentino Felipe

Stephen Kurt Brueckner

Daniel James Tingstrom

Noel E Schmidt

Eric R Chartier

Frank N Adelstein

Joseph Cascioli

Kenneth J Thurber

Katey Huddleston

Martiros Shakhzadyan

Daniel Mcardle

Ryan Marotz

Michael Joseph Kentley

Derek P Bronner

Christopher Dominessy

Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which improves security of a system. The analytic server may monitor the system by retrieving status information from various devices within the system. The analytic server may generate an attack tree model based on a set of aggregation rules that are configured based on the monitored status information. The analytic server may detect one or more attacks by associating the status information with corresponding nodes of the attack tree model and executing a logic of the attack tree model. The analytic server may determine aggregated impact and risk metrics and calculate an impact score for each attack based on aggregated impact and risk metrics. The analytic server may generate reports comprising the one or more attacks ranked based on the impact scores. The analytic server may respond to one or more attacks by taking automated actions.

Automated security compliance for system nodes

Disclosed herein are embodiments of systems, methods, and products for modernizing and optimizing legacy software. A computing device may perform an automated runtime performance profiling process. The performance profiler may automatically profile the legacy software at runtime, monitor the memory usage and module activities of the legacy software, and pinpoint/identify a subset of inefficient functions in the legacy software that scale poorly or otherwise inefficient. The computing device may further perform a source code analysis and refactoring process. The computing device may parse the source code of the subset of inefficient functions and identify code violations within the source code. The computing device may provide one or more refactoring options to optimize the source code. Each refactoring option may comprise a change to the source code configured to correct the code violations. The computing device may refactor the source code based on a selected refactoring option.

Optimization of source code to address inefficiencies

Systems and methods for analyzing memory architectures and for mapping data structures in software programs to appropriate memory to take advantage of the different memory architectures. A computer architecture having a processor connected to one or more first memories and one or more second memories is defined, wherein the first memories and the second memories are characterized by different performance profiles. An executable of a software program is instrumented to capture, during runtime, patterns of access to selected data structures of the executable. Based on an analysis of the patterns of access, allocation of the selected data structures between the first and second memories is determined.

Systems and methods for mapping data structures to memory in multi-level memory hierarchies

A computer-implemented method of securing vulnerabilities in a program, the method including receiving, by a computer, state information generated by an executed application program, training, by the computer, a constraints model based on the state information, generating, by the computer, one or more constraints with the constraints model, each of the one or more constraints describing an execution constraint for executing the application program, wherein the execution constraint enforces an intended operation of the application program, and applying, by the computer, the one or more constraints to the application program.

Applying constraints models for application layer security

A plurality of distributed network nodes may provide a decentralized access gateway to multiple, diverse types of databases. The plurality of distributed network nodes may host a private party blockchain. Each node may execute a peer-to-peer (P2P) client to perform operations associated with the private party blockchain. A subset of the nodes may be configured as validator nodes that may implement gossip protocols to cooperatively validate one or more database operations and generate a new block for the private party blockchain. Another subset of nodes may be configured as host nodes that may receive the new block and update a corresponding local copy of the private party blockchain appending the new block. Utilizing the co-operative validation of database operations and the updates appending the new blocks, the private party blockchain may maintain an immutable digital record of access and updates to the multiple and diverse types of databases.

Distributed network nodes defining a database access gateway

Systems, methods, and products may comprise an analytic server, which improves security of a unified system of distributed network infrastructure comprising a plurality of cyber-physical systems. The analytic server may instantiate a sub attack tree for each cyber-physical system within the unified system. The analytic server may determine how the interconnection of the plurality of cyber-physical systems may affect the unified system security. The analytic server may monitor systems and receive electronic notifications of alerts in real-time from devices in the plurality of cyber-physical systems. The analytic server may follow the logic of the attack tree model by traversing the attack tree from bottom up and determine how the alerts from the cyber-physical systems may affect the distributed network infrastructure as a whole. The analytic server may generate reports comprising a list of the prioritized attacks and recommendation actions to mitigate the attacks.

Systems and methods for applying attack tree models and physics-based models for detecting cyber-physical threats

A system having a distributed node hardware and software product is disclosed. The distributed topology allows for multiple GPS receiver node positions. The multiple GPS receiver node positions enable an accurate location estimation of a GPS spoofing signal emitter source of an incoming malicious GPS signal. The system detects the presence of a GPS spoofing signal emitter with high confidence against any spoofing geometry or strategy while the GPS receiver nodes are on the move.

Systems and methods for spoofed signal emitter detection for global positioning system using mesh computing

The methods and systems disclosed herein generally relate to automated execution and evaluation of computer network training exercises, such as in a virtual environment. A server executes a first attack action by a virtual attack machine against a virtual target machine based on a cyber-attack scenario, wherein the virtual target machine is configured to be controlled by the user computer. The server receives a user response to the first attack action, determines, using a decision tree, a first proposed attack action based on the user response, and executes an artificial intelligence model to determine a second proposed attack action based on the user response. The server selects a subsequent attack action from the first proposed attack action and the second proposed attack action and executes the subsequent attack action by the virtual attack machine against the virtual target machine.

System for cyber-attack simulation using artificial intelligence modeling

Embodiments disclosed herein describe systems and methods for assessing vulnerabilities of embedded non-IP devices. In an illustrative embodiment, a system of assessing the vulnerabilities of embedded non-IP devices may be within a portable device. The portable device may include a plurality of wired connectors for various wired communication/data transfer protocols. The portable device may include tools for analyzing the firmware binaries of the embedded non-IP devices, such as disassemblers and modules for concrete and symbolic (concolic) execution. Based upon the disassembly and the concolic execution, the portable device may identify vulnerabilities such as buffer overflows and programming flaws in the firmware binaries.

Automated cyber evaluation system

Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which provides a SilverlineRT system that prioritizes and analyzes security alerts and events. The server builds an attack tree based on attack detection rules. The server monitors large-scale distributed systems and receives alerts from various devices. The server determines attacks using the attack tree while excluding false alarms. The server determines impact and risk metrics for attacks in real-time, and calculates an impact score for each attack. The server ranks and prioritizes the attacks based on the impact scores. The server also generates real-time reports. By consider the mission and system specific context in the analysis alert information, the server gives insight into the overall context of problems and potential solutions, improving decision-making. By showing the impacts of alters, the server allows security personnel to prioritize responses and focus on highest value defense activities.

Attack-related events and alerts

Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which detects and defends against malware in-flight regardless of the specific nature and methodology of the underlying attack. The analytic server learns the system's normal behavior during testing and evaluation phase and trains a machine-learning model based on the normal behavior. The analytic server monitors the system behavior during runtime comprising the runtime behavior of each sub-system of the system. The analytic server executes the machine-learning model and compares the system runtime behavior with the normal behavior to identify anomalous behavior. The analytic server executes one or more mitigation instructions to mitigate malware. Based on multiple available options for mitigating malware, the analytic server makes an intelligent decision and takes the least impactful action that have the least impact on the system to maintain mission assurance.

Systems and methods including machine-learning models for detecting and mitigating malware

A method for improving efficiency of a training program begins with a processor monitoring and adapting execution of a training exercise of the training program. The processor determines a training program effectiveness measure including determining trainee skill improvement demonstrated during the training exercise, and monitoring and determining correctness and timeliness of trainee actions during the training exercise. The processor then determines a training program cost measure by determining a first monetary cost for the execution of the at least one training exercise, determining a second monetary cost associated with trainee man-hours for the training exercise, and generating the training program cost measure based on the first and second monetary costs. The processor then computes a ratio of the training program effectiveness measure to the training program cost measure.

System and method for improving training program efficiency

Various computing technologies for various reverse engineering platforms capable of outputting, including creating or generating, a human readable and high level source code, such as C, Fortran, LISP, or BASIC, from various binary files, such as application binaries, executable binaries, or data binaries, in an original language as developed pre-compilation. For example, some of such reverse engineering platforms can be programmed to disassemble binary files from different process architectures, identify various code optimizations as compiler introduced, reverse or unwind various compiler optimizations (de-optimize), and generate a human readable and high-level source code from de-optimized data.

Optimizing source code from binary files

Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which provides a terrain segmentation and classification tool for synthetic aperture radar (SAR) imagery. The server accurately segments and classifies terrain types in SAR imagery and automatically adapts to new radar sensors data. The server receives a first SAR imagery and trains an autoencoder based on the first SAR imagery to generate learned representations of the first SAR imagery. The server trains a classifier based on labeled data of the first SAR imagery data to recognize terrain types from the learned representations of the first SAR imagery. The server receives a terrain query for a second SAR imagery. The server translates the second imagery data into the first imagery data and classifies the second SAR imagery terrain types using the classifier trained for the first SAR imagery. By reusing the original classifier, the server improves system efficiency.

Systems and methods of radar neural image analysis using nested autoencoding

Various embodiments described herein relate to a machine-learning based electronic media analysis software system. The system is configured to detect anomalous and predictive patterns associated with an event. The system is configured to use feature extraction techniques and semi-supervised machine-learning to detect the patterns associated with the event in the electronic media messages, which may indicate a synthetic driven behavior and conversation corresponding to the event.

Growing community of inventors

Ithaca, NY, United States of America

Judson Powers