Department 13, Inc.

Genghiscomm Holdings, LLC

Other

Tybalt, LLC

Robi Sen

Steve J Shattil

Thomas John Hoeft

Thomas J Hoeft

Ian Charles Starnes

A computer-implementable method employs network signal metadata to train a cognitive learning and inference system to produce an inferred function, wherein the metadata comprises a syntactic structure of at least one network communication protocol. The inferred function is used to map metadata of a detected network signal to a cognitive profile of a transmitter of the detected network signal. The mapping effects intelligent discrimination of the transmitter from at least one other transmitter through corroborative or negating evidentiary observation of properties associated with the metadata of the detected network signal. Information content in the network signal can be determined from the inferred function or the cognitive profile without demodulating the network signal.

Detection, analysis, and countermeasures for radio transceivers

A computer-implementable method employs radio signal metadata to train a cognitive learning and inference system to produce an inferred function, wherein the metadata comprises a syntactic structure of at least one radio communication protocol. The inferred function is used to map metadata of a detected radio signal to a cognitive profile of a transmitter of the detected radio signal. The mapping effects intelligent discrimination of the transmitter from at least one other transmitter through corroborative or negating evidentiary observation of properties associated with the metadata of the detected radio signal. A response to the transmitter is based upon the mapping.

A radio transmitter adjusts its radio frequency (RF) fingerprint to defeat RF fingerprinting identification without destroying the content of its transmissions. The radio transmitter comprises a frequency-upconverter configured to upconvert a baseband or intermediate-frequency signal to an RF signal, and an amplifier to amplify the RF signal to produce a transmission signal. An RF fingerprint control circuit changes the non-linear behavior of the frequency-upconverter or the amplifier in order to change the RF fingerprint. The transmitter may create RF fingerprint 'personalities' to be paired with different radio protocol behaviors and subscriber terminal identification codes (e.g., MAC addresses or SMSIs) for generating different radio identities.

Intrusion detection and radio fingerprint tracking

In a wireless communication system, a secure communication link is provided by producing a set of reference symbols selected from a modulation symbol constellation; generating a data-bearing pre-coding transform from information to be transmitted to a receiver; applying the data-bearing pre-coding transform to the set of reference symbols, thereby distorting the reference symbols with respect to the information, to produce a linear transformation signal; and transmitting the linear transformation signal to the receiver. The reference symbols are known at the receiver. The receiver removes the reference symbols from the linear transformation signal and decodes the data-bearing pre-coding transform.

LPI/LPD communication systems

A computer-implementable method for generating a cognitive insight is performed by a counter-unmanned autonomous vehicle (UAV) system. The method comprises receiving training data based upon sensor measurements of at least one UAV for processing in a cognitive learning and inference system. The system performs a plurality of machine learning operations on the training data to generate a cognitive profile of the at least one UAV. A cognitive insight is generated based upon the cognitive profile, and a countermeasure is enacted against the UAV based upon the cognitive insight.

Detection, analysis, and countermeasures for automated and remote-controlled devices

In a computer network that has a plurality of nodes, a measure of trustworthiness for a particular node can be updated by other nodes that monitor the particular node's behavior. This includes collecting trustworthiness reports from the other nodes; updating the particular node's trustworthiness level based on the reports; and causing the particular node to route data in the computer network based on its trustworthiness level. The particular node's role in performing at least one of a set of functions is based on a hierarchy of trustworthiness levels, wherein the functions can include monitoring other nodes; sending alerts when anomalous behavior is detected; transmitting a free-antibody software program to a requesting node; updating defensive programs; participating in consensus-based threat analysis with other nodes; identifying threats; tagging suspicious nodes; and performing countermeasures against identified threats.

Cooperative intrusion detection

In a wireless communication system, a secure communication link is provided by producing a set of reference symbol values selected from a modulation symbol constellation; generating a linear transformation operator from information to be transmitted to a receiver; applying the linear transformation operator to the set of reference symbol values, thereby distorting the reference symbol values with respect to the information, to produce a linear transformation signal; and transmitting the linear transformation signal to the receiver. The receiver decodes the linear transformation signal to receive the information.

A radio transmitter adjusts the spectral, amplitude, and/or phase characteristics of its transmissions to defeat radio fingerprinting identification without destroying the content of the transmissions. The transmitter determines a threshold of signal distortion that impedes RF fingerprint identification while providing an acceptable amount of degradation to data transmissions and then synthesizes a distortion of its unique RF fingerprint to impede identification. The transmitter may create RF fingerprint 'personalities' to be paired with different radio protocol behaviors and subscriber terminal identification codes (e.g., MAC addresses or SMSIs) for generating different radio identities.

A system deploys electronic countermeasures against unmanned aerial vehicles (UAVs) that are determined to be a threat. A radio transceiver coupled to at least one antenna detects if radio signals are being communicated between a remote control unit and a UAV. A mitigation engine communicatively coupled to the radio transceiver synthesizes an exploit signal to be transmitted to the UAV, wherein the exploit signal is configured to inject commands into the UAV's navigation system. If the system determines that the UAV is operating in an autopilot mode, it transmits an induce-mode signal that causes the UAVs to switch to a communication mode so the UAV is responsive to the exploit signal.

Unmanned aerial vehicle intrusion detection and countermeasures

A network node in a distributed network employs a surface immunoglobulin program to monitor other nodes in the distributed network and generate an alert upon detecting a suspicious activity; and pushes a free-antibody program to a requesting node petitioning to access the distributed network. The free-antibody program can include a software agent that monitors the requesting node. The free-antibody program reports detected malware and/or suspicious activity to the surface immunoglobulin program, which can enact countermeasures against the requesting node. The network node's role is based on a hierarchy of trustworthiness levels, wherein it performs at least one of monitoring other nodes, sending alerts when anomalous behavior is detected, transmitting the free-antibody software program to the requesting node, updating defensive programs, participating in consensus-based threat analysis with other nodes, identifying threats, tagging suspicious nodes, and performing countermeasures against identified threats.

A network node in a distributed network employs a surface immunoglobulin system configured to monitor other nodes in the distributed network and generate an alert upon detecting a suspicious activity; and a free-antibody system configured to push a free-antibody program to a requesting node petitioning to access the distributed network. The free-antibody program is configured to communicatively couple to the surface immunoglobulin system while monitoring behavior of the requesting node. The free-antibody program reports detected malware and/or suspicious activity to the surface immunoglobulin system, which can enact countermeasures against the requesting node.

In a wireless communication system, a secure communication link is provided by selecting a decoy data signal vector for transmission, generating a MIMO precoding matrix from a message to be sent; and multiplying the decoy data signal vector by the MIMO precoding matrix to construct a precoded signal vector. The MIMO precoding matrix produces information-bearing synthesized channel distortions in the transmitted signal. An undistorted version of the decoy data may be transmitted to an intended receiver. The receiver distinguishes between the synthesized information-bearing channel distortions and natural channel distortions to decrypt the information, while an eavesdropper would find it difficult to distinguish between natural and synthesized channel distortions in the signals it receives.

A first node in a wireless network retransmits a data signal. The node employs a precoder that generates transmit power values from a message to be transmitted and precodes the data signal with the transmit power values before the data signal is retransmitted. A second node receives the retransmitted signal. The second node uses a reference signal processor configured to determine the data signal and a decoder configured to remove the data signal from the received signal. The power values are estimated and processed to decode the information therefrom.

A system detects unmanned aerial vehicles (UAVs) and deploys electronic countermeasures against one or more UAVs that are determined to be a threat. A signal detector detects radio signals communicated between a remote control unit and UAV. A feature extractor extracts signal features from the detected radio signals, and a classifier processes the detected radio signals based on its signal features and determines whether the detected radio signals correspond to a known or unknown radio protocol. A threat analyzer determines if a detected UAV is a threat based on at least one of remote-sensing data and classification(s) of the detected radio signals. When a UAV system employs an unknown radio protocol, a mitigation engine synthesizes an exploit based on corresponding extracted signal features. A response analyzer detects a response from the UAV system when an exploit is activated and may adapt the exploit based on the response. In some cases, the exploits can be configured against a UAV in autopilot mode.

Growing community of inventors

McLean, VA, United States of America

Robi Sen