Raytheon Bbn Technologies Corp.

Florida Institute of Technology

Raytheon Company

Rtx Bbn Technologies, Inc.

Michael Hassan Atighetchi

Stephane Yannick Blais

Joud Khoury

Marco Mattos Carvalho

Samuel Cunningham Nelson

Thomas C Eskridge

Borislava Ivanova Simidchieva

Brett Benyo

Fusun Yaman

Partha Pal

Zachary Ratliff

Aaron Daniel Adler

Fusun Yaman-Sirin

Jonathan Webb

Katarzyna Lucja Olejnik

Andrew Gronosky

Joseph Loyall

William Timothy Strayer

Brandon Doherty Kalashian

Stéphane Yannick Blais

Christopher Lawrence Willig

Techniques for evaluating cyber assets are disclosed. A system obtains, from data sources in an experimental environment, raw data generated in response to execution of a cyber asset. The system generates, from the raw data, at least one instance model corresponding to the data sources. The at least one instance model includes instances of concepts represented in a cyber impact ontology.

Systems and methods for evaluating cyber assets

Techniques are described herein for a messaging system to allow publishers that are aware of the identities of their respective subscribers to target content at those subscribers directly. This may be accomplished by allowing users and other targets (e.g., groups) to register their identities at particular computing nodes of a system. Then publishers (e.g., applications) may send out messages targeted at particular identities, and a publishing system may forward messages to appropriate nodes based on which identities are registered at those nodes. Legacy applications that are not able to target particular identities may instead connect to application adapters that are configured to learn which identities should be targeted by each application. In addition, anonymized identities may be used for application messages that need to cross between domains having differing security levels.

Efficient directed content in pub/sub systems

Techniques for verifiable computation for cross-domain information sharing are disclosed. An untrusted node in a distributed cross-domain solution (CDS) system is configured to: receive a first data item and a first cryptographic proof associated with the first data item; perform a computation on the first data item including one or more of filtering, sanitizing, or validating the first data item, to obtain a second data item; generate, using a proof-carrying data (PCD) computation, a second cryptographic proof that indicates (a) validity of the first cryptographic proof and (b) integrity of the first computation on the first data item; and transmits the second data item and the second cryptographic proof to a recipient node in the distributed CDS system. Alternatively or additionally, the untrusted node may be configured to transmit a cryptographic proof to a trusted aggregator in the CDS system.

Verifiable computation for cross-domain information sharing

Techniques for automated system requirements analysis are disclosed. A system requirements analysis (SRA) service generates a system model that includes system requirements, at least by performing natural-language processing on a natural-language representation of the system requirements. Based at least on the system model, the SRA service performs an analysis of the system requirements against codified system requirements rules. The SRA service determines, based at least on the analysis of the system requirements against the codified system requirements rules, that the system requirements include a violation of a system requirements rule. The SRA service generates a report that identifies at least (a) the violation of the system requirements rule and (b) a suggested action to remediate the violation of the system requirements rule.

Systems and methods for automated system requirement analysis

Techniques for enforcing trust policies for payload data transmitted through a data provisioning layer include: receiving, by a node in the data provisioning layer, payload data to be delivered to a recipient; obtaining, by the node, a trust policy indicating multiple attributes used to determine trustworthiness of payloads; determining, by the node, a set of values of the attributes associated with the payload data; generating, by the node, a trustworthiness opinion based at least on the trust policy and the set of values of the attributes; transmitting, by the node, the payload data and the trustworthiness opinion via the data provisioning layer toward the recipient; computing, by the recipient, a trustworthiness metric associated with the payload data based at least on the trustworthiness opinion; and determining, by the recipient, an action to take with respect to the payload data based at least on the trustworthiness metric.

Trust policies for a data provisioning layer

Techniques for cross-domain routing using a fractionated cross-domain solution (F-CDS) are disclosed. A first intermediate node operating in a first physical device in an assured pipeline of the F-CDS receives a data item originating at a source node in a first security domain. The first intermediate node applies a first data filter to determine that the data item complies with a data security requirement of the F-CDS. The first intermediate node transmits the data item to a second intermediate node operating in a second physical device in the assured pipeline of the F-CDS. The second intermediate node applies a second data filter to redundantly determine that first data item complies with the data security requirement of the F-CDS. The second intermediate node transmits the data item to a recipient node in a second security domain via the assured pipeline.

Fragmented cross-domain solution

A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

User interface supporting an integrated decision engine for evolving defenses

A method of performing a security assessment of a system includes analyzing a static structure of the system; storing, in a semantic system model, structure information about the static structure of the system; observing the system during a plurality of discrete temporal system states; storing, in the semantic system model, dynamic information about the system during the plurality of discrete temporal system states; performing a semantic composition analysis on the structure information to identify at least one vulnerability of the system; performing a flow analysis on the dynamic information to identify at least one anomalous behavior of the system during at least one of the plurality of discrete temporal system states; and generating, based on the at least one vulnerability of the system and the at least one anomalous behavior of the system, a vulnerability assessment of the system.

Methods and systems for eliminating and reducing attack surfaces through evaluating reconfigurations

Techniques for metadata-based information provenance are disclosed. A node in a data provisioning layer receives encrypted payload data to be delivered to a recipient. The node generates provenance metadata that describes at least one action taken by the node with respect to the encrypted payload data. The node transmits the encrypted payload data and the provenance metadata via the data provisioning layer toward the recipient.

Metadata-based information provenance

Multi-dimensional heuristic search as part of an integrated decision engine for evolving defenses

Methods and systems for performing security functions in a service-oriented computer system are provided. The method includes acts of receiving, from one or more entities, a service request for a service provided by one or more server computers adapted to process the service request; providing a copy of the service request to a processor adapted to analyze the copy of the service request; storing the service request in a memory; determining, by the processor, if the service request should be processed by performing one or more analyzes of the copy of the service request to determine if the service request would be harmful to the one or more server computers; and if it is determined that the service request should be processed by the one or more server computers, forwarding the service request to the one or more server computers.

Growing community of inventors

Framingham, MA, United States of America

Michael Hassan Atighetchi