The Boeing Company

The Boeing Compoany

Mingyan Li

Jai Joon Choi

Douglas Alan Stuart

Timothy McNally Mitchell

Changzhou Wang

Radhakrishna G Sampigethaya

Eric John Martens

Brett Michael Wilson

Li Yang

Joshua D Cazalas

Ramkumar Balasubramanian

Radha Poovendran

William R Ferng

David S Mier

Matthew Lee Benson

Su-Nei Nina Shen

Patrick Tague

Brett M Wilson

A system includes a processor and a storage device containing instructions. Execution of the instructions causes the processor to: (1) connect with an onboard system of a vehicle, wherein the onboard system is connectable to a network; (2) collect an activity log generated by the onboard system, wherein the activity log includes log messages indicative of an activity of the onboard system; (3) extract a feature list from the activity log, wherein the feature list includes features and each one of the features includes select information from a corresponding one of the log messages; (4) extract an episode from the feature list, wherein the episode is indicative of the activity of the onboard system; and (5) classify the episode with an episode classification, wherein the episode classification is indicative of an event that occurred during the activity.

System, method, and program for analyzing vehicle system logs

A method of securing, by a managing node, communication in a network of member nodes including a first member node. Communication is secured using a (k, n) secret sharing scheme during a first phase. The managing node announces a phase shift to a subsequent phase relative to the first phase. The managing node secures communication in the network during the subsequent phase using a (k+x, n) secret sharing scheme. Each of the member nodes is previously in possession of exactly one corresponding unique share for the second key. The first member node is previously in possession of a first unique share for the second key. The managing node deletes the first member node from the subsequent phase by broadcasting the first unique share for the second key.

Threshold scheme enabled symmetric key member deletion

A multiple vehicle cyber-attack detection system including a vehicle operations center coupled to and monitoring vehicles, where each operations center includes a cyber-attack alert module. A vehicle cyber-attack detection system is in communication with each operations center and includes a first tier security module coupled to an onboard system of each vehicle and receives system log data generated by the onboard system. The first tier security module extracts extracted features from a time series of overlapping windowed system log data generated from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements. A second cyber-attack anomaly detection module includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. Each cyber-attack alert module generates a notification of the first cyber-attack and/or the second cyber-attack on a user interface.

Method and system for vehicle cyber-attack event detection

A vehicle cyber-attack detection system includes at least one first tier security module coupled to at least one onboard system of a respective vehicle and being configured so as to receive system log data generated by the at least one onboard system of the respective vehicle. The first tier security module extracts extracted features from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements determined from the extracted features, and a second cyber-attack anomaly detection module that includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. A cyber-attack alert module is coupled to the first tier security module for generating a notification of one or more of the first cyber-attack and the second cyber-attack to effect cyber-attack diagnostics and remediation by vehicle personnel.

Methods and systems for use in validating input data in a computing system. Input data associated with a destination software application, such as a database, is received at a computing system. The input data is forwarded to an intermediate software application, such as a web application. When the input includes one or more patterns, a query produced by the intermediate software application based on the input data is validated, such as by comparing the structure of the query to one or more expected query structures. If the validation succeeds, the query is forwarded to the destination software application. Otherwise, the query is discarded.

Methods and systems for validating input data

A method includes receiving first vehicle log data related to modification of a first software part at a first vehicle. The method also includes receiving first ground log data of a first ground system. The first ground log data indicates first chain-of-custody information regarding the first software part. The method further includes analyzing the first vehicle log data and the first ground log data based on baseline data to detect an anomaly. The method also includes sending a notification in response to detecting the anomaly.

Anomaly detection in chain-of-custody information

A method and apparatus for authenticating a signal received at a wireless node. The signal is received at the wireless node. The wireless node is one of a plurality of wireless nodes in a communications network. A set of parameters is identified for the signal. A distance between the wireless node and a source of the signal is identified using a location of the wireless node and the set of parameters for the signal. A determination as to whether the source of the signal is an authorized source is made using the distance identified.

Method and apparatus for authenticating information received at an airport surface wireless node

A method, apparatus, and system for managing network security at an airport. A threat level for the airport is identified. A number of policies for a network data processing system is identified at the airport based on the threat level identified for the airport in response to identifying the threat level for the airport. Enforcement of the number of policies is initiated in the network data processing system.

Airport security system

A method, apparatus, and computer program product for generating a model. A set of actions associated with a control flow of a set of attack patterns using non-deterministic controls is described to form a control block. A set of ontology references associated with the set of attack patterns is identified. The model is generated and it comprises the control block and the set of ontology references.

Modeling cyberspace attacks

An embodiment includes methods that generate random cryptographic keys, and send the keys to client devices. These methods may send representations of channel locator functions to the client devices, which may use the channel locator functions to locate particular control channels, using the random keys as input.

Growing community of inventors

Redmond, WA, United States of America

Mingyan Li