CYBER CHAFF USING SPATIAL VOTING

• US 20190312908A1
• Filed: 04/09/2019
• Published: 10/10/2019
• Est. Priority Date: 04/10/2018
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Jaenisch, Holger M., Handley, James W., Lambert, Michael J., Woolley, Brandon, Cram, William L., MacKinnon, Ross, Bradbury, Mark A., Swope, Guy G.
• Granted Patent: US 11,381,599 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06N 3/006 based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO]
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method of generating cyber chaff can include determining a cell of a grid of cells to which a first feature and a second feature of user data maps, identifying a cell type of the cell, the cell type indicating whether the cell is an active cell, an inactive cell, or a sub-process cell, and providing cyber chaff based on cyber chaff data associated with either (a) one or more cells of the inactive cell type or (b) one or more cells of the sub-process cell type.

Claims

1. A system for generating cyber chaff, the system comprising:

a memory including data indicating a grid size for a grid of cells, a number of cells in the grid of cells and for each cell, a cell type indicating whether the cell is an active cell, an inactive cell, or a sub-process cell, and cyber chaff data;

processing circuitry coupled to the memory, the processing circuitry being configured to;

determine a cell of the grid of cells to which a first feature and a second feature of user data maps;

identify the cell type of the cell; and

provide cyber chaff based on the cyber chaff data in either (a) one or more cells of the inactive cell type or (b) one or more cells of the sub-process cell type.

2. The system of claim 1, wherein the processing circuitry is further configured to alter a type of one or more cells of the inactive cell type and one or more cells of the active cell type based on a number of cells contiguous with the cell that are of the active cell type.

3. The system of claim 1, wherein the processing circuitry is further configured to, in response to identifying that the type of the cell is an active cell or inactive cell type, provide data from one or more of the active cells in the cyber chaff.

4. The system of claim 1, wherein the processing circuitry is further configured to, in response to identifying that the type of the cell is a sub-process cell, provide data from the sub-process cell in the cyber chaff.

5. The system of claim 1, wherein the processing circuitry is further configured to, in response to identifying the type of the cell is a sub-process cell, provide data from other contiguous cells of the sub-process cell type in the cyber chaff.

6. The system of claim 1, wherein:

the grid of cells is one of a plurality of grids of cells;

the memory includes data indicating, for each grid of cells, a program identification indicating a process; and

the processing circuitry is further configured to determine a second process associated with the user data and determine a cell of the grid of cells associated with a process that matches the second process to which a first feature and a second feature of user data maps.

7. The system of claim 1, wherein the memory further includes, for each cell of a sub-process cell type, data indicating a data format that defines an arrangement of the data of the cyber chaff and wherein the processing circuitry is further configured to arrange the data from the sub-process cell types or the active cell types in conformance with the defined arrangement.

8. A non-transitory machine-readable medium including instructions that, when executed by a machine, configure the machine to perform operations comprising:

determining a cell of a grid of cells to which a first feature and a second feature of user data maps;

identifying a cell type of the cell, the cell type indicating whether the cell is an active cell, an inactive cell, or a sub-process cell; and

providing cyber chaff based on cyber chaff data associated with either (a) one or more cells of the inactive cell type or (b) one or more cells of the sub-process cell type.

9. The non-transitory machine-readable medium of claim 8, wherein the operations further include altering a type of one or more cells of the inactive cell type and one or more cells of the active cell type based on a number of cells contiguous with the cell that are of the active cell type.

10. The non-transitory machine-readable medium of claim 8, wherein the operations further include, in response to identifying that the type of the cell is an active cell or inactive cell type, providing data from one or more of the active cells in the cyber chaff.

11. The non-transitory machine-readable medium of claim 8, wherein the operations further include, in response to identifying that the type of the cell is a sub-process cell, providing data from the sub-process cell in the cyber chaff.

12. The non-transitory machine-readable medium of claim 8, wherein the operations further include, in response to identifying the type of the cell is a sub-process cell, providing data from other contiguous cells of the sub-process cell type in the cyber chaff.

13. The non-transitory machine-readable medium of claim 8, wherein:

the grid of cells is one of a plurality of grids of cells and each grid of cells is associated with a program identification indicating a process; and

the operations further include determining a second process associated with the user data and determine a cell of the grid of cells associated with a process that matches the second process to which a first feature and a second feature of user data maps.

14. The non-transitory machine-readable medium of claim 8, wherein:

each cell of a sub-process cell type is associated with data indicating a data format that defines an arrangement of the data of the cyber chaff; and

the operations further include arranging the data from the sub-process cell types or the active cell types in conformance with the defined arrangement.

15. A method comprising:

determining a cell of a grid of cells to which a first feature and a second feature of user data maps;

identifying a cell type of the cell, the cell type indicating whether the cell is an active cell, an inactive cell, or a sub-process cell; and

providing cyber chaff based on cyber chaff data associated with either (a) one or more cells of the inactive cell type or (b) one or more cells of the sub-process cell type.

16. The method of claim 15, further comprising altering a type of one or more cells of the inactive cell type and one or more cells of the active cell type based on a number of cells contiguous with the cell that are of the active cell type.

17. The method of claim 15, further comprising, in response to identifying that the type of the cell is an active cell or inactive cell type, providing data from one or more of the active cells in the cyber chaff.

18. The method of claim 15, further comprising, in response to identifying that the type of the cell is a sub-process cell, providing data from the sub-process cell in the cyber chaff.

19. The method of claim 15, further comprising, in response to identifying the type of the cell is a sub-process cell, providing data from other contiguous cells of the sub-process cell type in the cyber chaff.

20. The method of claim 15, wherein:

the grid of cells is one of a plurality of grids of cells and each grid of cells is associated with a program identification indicating a process; and

the method further includes determining a second process associated with the user data and determine a cell of the grid of cells associated with a process that matches the second process to which a first feature and a second feature of user data maps.