Architecture Technology Corporation

Other

Nathan E Bahr

Ranga S Ramanujan

John Jun Wu

Ryan L Hagelstrom

Robert A Joyce

Maher N Kaddoura

Brett Thompson

Steven M Schneider

Corey Webster

Disclosed herein are embodiments of systems, methods, and products that provide adversary detection and threat hunting. A server may comprise a user side virtual machine facing the cyber protection users, a collection virtual machine facing the at-risk network, and a data repository. The server may receive user requests requesting status data from the at-risk network via the user side virtual machine. The server may collect status data from the at-risk network via the collection virtual machine and store the collected data into the data repository. Different users may request duplicate information from the at-risk network. The server may retrieve the requested information from the data repository for duplicate requests and return the responses immediately for such requests. Because the server does not query the at-risk network for duplicate requests, the server may reduce the amount of bandwidth needed to acquire and distribute the requested information.

Systems and methods for adversary detection and threat hunting

Systems and methods for open threat hunt

A method of embedding information in a packet with low overhead is provided. The method includes receiving an IP packet at a first networking device and translating it into an intermediary packet having a non-IP header and a data field. Translating includes copying at least the transport layer data field into the data field of the intermediary packet, compressing the IP header, and embedding out-of-band data into the non-IP header of the intermediary packet. The intermediary packet is sent to second networking device. At the second networking device the intermediary packet is translated into a re-created IP packet. The re-created IP packet is sent toward a destination of the original IP packet.

IP packet translation for low-overhead out-of-band data embedding

Embodiments for a method of controlling entry of packets into a broadcast network are provided. The method includes providing a plurality of edge devices communicatively disposed on an edge of the broadcast network. Reachability information is exchanged amongst the plurality of edge devices by translating Internet Protocol (IP) packets into ZOOM packets and including the reachability information in the ZOOM packets. A ZOOM packet has a data field that is a copy of a data field of the IP packet and a header that includes the reachability information. A first edge device of the plurality of edge devices maintains a table of forward destinations reachable via the broadcast network based on the reachability information exchanged. The first edge device discards IP packets from endpoint devices if the IP packets do not have a destination that is indicated as reachable in the table of forward destinations for that edge device.

Packet control for a broadcast network

A method of obfuscating a source of a multicast packet is provided. The method includes receiving a plurality of multicast packets at a first device from one or more second devices, the multicast packets received over one or more network links. A source internet protocol (IP) address of each multicast packet of the plurality of multicast packets is an IP address of the one or more second devices that sent the multicast packet. The source IP address of each of the plurality of multicast packets is changed to an IP address other than an IP address of the first device or an IP address of the one or more second devices. The plurality of multicast packets can then be sent.

IP source obfuscation

A method of cyber-attack protection is provided. The method includes receiving a unicast packet at a first router and determining whether a destination for the unicast packet is behind a cooperating router. If the destination for the unicast packet is behind a cooperating router, the unicast packet is tunneled from the first router to a tunnel multicast address to which the cooperating router subscribes.

Network route hijack protection

A method of cyber-attack protection is provided. The method includes receiving one or more internet group management protocol (IGMP) membership report messages on one or more ports of a network switch. A table is maintained associating each of the one or more ports to the one or more group addresses of which any hosts coupled to that port are members. An IGMP group leave message is received at a first port of the network switch. A group address in the group leave message is compared to all group addresses associated in the table with the first port. If the group address in the group leave message does not match any group address associated with the first port, the group leave message is dropped without being acted on in accordance with IGMP.

IGMP group leave message blocking

Embodiments for a method of exchanging networking information are provided. The method includes receiving an internet protocol (IP) packet at a first networking device and translating, at the first networking device, the IP packet into a ZOOM packet. The ZOOM packet does not conform to an IP protocol. The ZOOM packet includes a copy of the bits of the data field from the IP packet. The ZOOM packet includes a ZOOM header with a portion of an IP header of the first IP packet with networking information. The method also includes sending the ZOOM packet into a broadcast network. The ZOOM packet is received at a second networking device, and the networking information is extracted from the ZOOM header. The IP packet is then re-created and sent toward a destination of the IP packet.

IP packet translation to piggyback networking information

Embodiments for a method of coordinating wideband anti-jam modems (WAMs) are provided. The method includes receiving an IP packet at a first edge module from a router, wherein the router is configured with the first edge module as a default route. It is determined whether to send the information corresponding to the IP packet via a first WAM corresponding to the first edge module or via a second WAM corresponding to a second edge module. If the information is to be sent via the first WAM, information corresponding to the IP packet is forwarded to the first WAM. If the information is to be sent via the second WAM, the IP packet is encapsulated in a transfer packet for the second edge module corresponding to the second WAM and the transfer packet is sent to the router for forwarding to the second edge module corresponding to the second WAM.

Coordination of local wideband anti-jam modems

Embodiments for a method of dynamically tuning receivers of a wideband anti-jam modem (WAM) are provided. The method includes cyclically tuning one or more receivers through a plurality of channels except a first channel. The method also includes receiving an indication, while cyclically tuning, that one or more packets to an endpoint device behind a first WAM are to be sent to the first WAM on a second channel of the plurality of channels. In response to receiving the indication, the cyclical tuning for a first receiver of the plurality of receivers is halted and the first receiver is tuned to the second channel for a first period of time to receive the one or more messages. After the first period of time, cyclically tuning the first receiver along with any other receivers of the one or more receivers through the plurality of channels except the first channel.

Dynamic receiver tuning of wideband anti-jam modems

In one example, in a Dynamic Host Configuration Protocol (DHCP) network comprising one or more configuration computing systems, a method includes receiving one or more augmented DHCP configuration messages. The method also includes determining that each of the one or more augmented DHCP configuration messages includes a message tag indicating that the respective augmented DHCP configuration message contains parameter information that includes a client identifier associated with a respective one of the one or more network devices. The method further includes determining, based on the parameter information included in each of the one or more augmented DHCP configuration messages, configuration data that is usable to configure the one or more network devices. The method also includes configuring, based on the configuration data, the one or more network devices.

Scalable and automated network-parameter assignment

This disclosure is directed to techniques for internet group management protocol tunneling. This may be done by electing, by each of a plurality of multicast gateways in a subnet, a designated router in the subnet. The designated router sends internet group management protocol queries to at least one router in the subnet. The designated router further tunnels internet group management protocol reports.

Adaptive multicast network communications

This disclosure is directed to techniques for communicating in an adaptive multicast network. In general, the disclosure is directed to communicating in an adaptive multicast network. This may be done by archiving, at a rendezvous point, multicast subscription information for terminal nodes in the adaptive multicast network, wherein the multicast subscription information comprises a dynamic list of receiver terminal nodes located within the adaptive multicast network that subscribe to particular multicast streams from one or more terminal nodes in the adaptive multicast network. A router receives a multicast stream from a sender terminal node. The router receives the multicast subscription information for the multicast stream sent by the sender terminal node from the rendezvous point. The router forwards the multicast stream to all receiver terminal nodes in the dynamic list of receiver terminal nodes indicated as subscribing to the multicast stream sent by the sender terminal node.

Growing community of inventors

Eden Prairie, MN, United States of America

Nathan E Bahr