The Boeing Company

Mark Jonathan Handel

Douglas Alan Stuart

Hugh L Taylor

Steven A Dorris

Brett Michael Wilson

Steve A Dorris

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. An implementation of the DCA may detect anomalous behavior in various processes of a device or devices. Unlike previous approaches, the DCA implementation may use an inflammation signal to communicate information among the processes of device or a network, where the inflammatory signal indicates a likelihood that a process has been attacked by malicious software.

Process level locality and specialization for threat detection in the dendritic cell algorithm

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. A DCA module may receive an output or signal from multiple indicators concerning the state of at least a portion of the system. The DCA module is configured to combine the plurality of signals into a single signal vector. The DCA module may be configured to sort the received signals based on signal type and magnitude of each signal. The DCA module may then use a decay factor to weight the received signals so that a large number of 'nominal' signals do not drown out a small number of 'strong' signals indicating a malware attack. The decay factor may be exponentially increased each time it is applied so that all received signals are considered by the DCA module, but so that the &#x201c;nominal&#x201d; signals may have a minimal effect.

Method for combining multiple signal values in the dendritic cell algorithm

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. The DCA implementation may use an inflammation signal to communicate information among the processes of device or a network or among nodes of a network, where the inflammatory signal indicates a likelihood that a process or a node has been attacked by malicious software. The DCA implementation may dynamically change the malware sensitivity and responsiveness based on the inflammation signals without requiring user intervention. The inflammatory signal includes one or more inflammatory tuples, which may include multiple components such as a strength, a PrimeIndicator, and an optional third element, p. The strength component may be an indication of the magnitude of an attack and provide a degree of certainty of the attack. The PrimeIndicator may be an identifier of the indicator type that is the source of the inflammation tuple.

Dynamic loading and configuation of threat detectors based on feedback from other nodes

Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. An implementation of the DCA may detect anomalous behavior in various embedded network systems. Unlike previous approaches, the DCA implementation may use an inflammation signal to communicate information among the nodes of a distributed or centralized network, where the inflammatory signal indicates a likelihood to the connected nodes that a local node has been attacked by malicious software.

Growing community of inventors

Seattle, WA, United States of America

Mark Jonathan Handel