Los Alamos National Security, LLC

Triad National Security, LLC

Michael E Fisk

Joshua Charles Neil

Alexander Kent

Curtis Storlie

Benjamin Uphoff

Alexander William Brugh

Curtis Hash, Jr

Eugene M Gavrilov

Curtis Lee Hash, Jr

Daniel A Quist

Non-harmful data mimicking computer network attacks may be inserted in a computer network. Anomalous real network connections may be generated between a plurality of computing systems in the network. Data mimicking an attack may also be generated. The generated data may be transmitted between the plurality of computing systems using the real network connections and measured to determine whether an attack is detected.

Non-harmful insertion of data mimicking computer network attacks

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent ('UHCA') may also be used to detect anomalous behavior.

Path scanning for the detection of anomalous subgraphs and use of DNS requests and host agents for anomaly/change detection and network situational awareness

A method enables the topology of an acyclic fully propagated network to be discovered. A list of switches that comprise the network is formed and the MAC address cache for each one of the switches is determined. For each pair of switches, from the MAC address caches the remaining switches that see the pair of switches are located. For each pair of switches the remaining switches are determined that see one of the pair of switches on a first port and the second one of the pair of switches on a second port. A list of insiders is formed for every pair of switches. It is determined whether the insider for each pair of switches is a graph edge and adjacent ones of the graph edges are determined. A symmetric adjacency matrix is formed from the graph edges to represent the topology of the data link network.

Network topology mapper

Growing community of inventors

Jemez, NM, United States of America

Michael E Fisk