Raytheon Bbn Technologies Corp.

Raytheon Company

Paul F Beraud, Iii

Suzanne P Hassell

Gangadhar Ganga

Alen Cruz

Stephen R Martin

Brian J Mastropietro

Christopher R Eck

Justin W Toennies

Stephen Patrick Marra

Frank Pietryka

Niraj K Srivastava

Travis C Hester

Ledford J Meadows, Iii

David A Hyde

Jeanette M Moody

Embodiments of a system and method for a cyber modeling and simulation framework arc generally described herein. In some embodiments, an interface () for ingest of network and vulnerability data associated with a node of a targeted network, a network visualization device () for presenting the network data and the vulnerability data, and for creating a network model based on the network and vulnerability data, a threat analysis simulator () for launching threat attacks on the targeted network and for applying modeled defenses against the threat attacks, the threat analysis simulator producing simulation results () and a data farming module for performing data fanning on the simulation results using different scenarios to generate a farm of data for use in designing anti-cyber-attack strategies () for the targeted network.

Method and device for simulating network resiliance against attacks

A system and method of deploying a network hopping adaptor is disclosed. In some embodiments, a network hopping adaptor may be configured to manipulate network traffic so as to change at least one network characteristic of the network traffic, and at least one network interface of a machine selected from a group of machines may be configured to send the network traffic to the network hopping adaptor. The network hopping adaptor may manipulate such characteristics as an IP address, a port number, an encryption algorithm or a compression algorithm. The group of machines may be deployed as virtual machines being executed by a virtualization server, and the network hopping adaptor may be implemented on another virtual machine being executed by the virtualization server. Alternatively, or in addition, the group of machines or the network hopping adaptor may be implemented as physical machines.

Adaptor implementation for internet protocol address and port hopping

Generally discussed herein are systems, apparatuses, or processes to recognize that a cyber threat exists or predict a future track of a cyber threat in a network. According to an example, a process for recognizing a cyber threat can include (1) determining a network layout of a network based on received network layout data, (2) receiving cyber sensor data indicating actions performed on the network, (3) calculating a first score associated with the cyber sensor data indicating that a cyber threat is present in the network by comparing a cyber threat profile of the cyber threat that details actions performed by the cyber threat to actions indicated by the cyber sensor data, (4) determining whether the calculated first score is greater than a specified threshold, or (5) determining that the cyber threat is present in response to determining the calculated first score is greater than the specified threshold.

Probabilistic cyber threat recognition and prediction

Growing community of inventors

Parrish, FL, United States of America

Paul F Beraud, Iii