Abstract: The Mission Centric Network Defense System (MCNDS) is a deployable network defense system that monitors network activities, generates and maintains situational awareness of operational activities, and uses this joint situational awareness of networked and operational activities to predict the mission impact of alterations and disruptions of networked resources. The MCNDS uses its predictive capability to rank information operation (IO) courses-of-action (COAs) and interpret network alarms and intrusion detections in terms of expected operational mission impact.

Abstract: The Mission Centric Network Defense System (MCNDS) is a deployable network defense system that monitors network activities, generates and maintains situational awareness of operational activities, and uses this joint situational awareness of networked and operational activities to predict the mission impact of alterations and disruptions of networked resources. The MCNDS uses its predictive capability to rank information operation (IO) courses-of-action (COAs) and interpret network alarms and intrusion detections in terms of expected operational mission impact.

Abstract: A method for converting an n-dimensional vector to a two-dimensional vector to enable visualization of the n-dimensional vector. The method includes obtaining an n-dimensional reference vector and determining a difference in length and angle between the n-dimensional vector and the reference vector; and determining two-dimensional coordinates of the two-dimensional vector based on the difference in length and angle.

Abstract: An intrusion detection system comprising a hierarchy of neural networks that functions as a true anomaly detector is disclosed. Detection of an anomaly is achieved by monitoring selected areas of network behavior, such as protocols, that are predictable in advance. The neural networks are trained using data that spans the space of network or system inputs. The desired neural network output used during training is determined using the known properties of the network behavior. The trained detector recognizes attacks that were not specifically presented during training. In fact, using small detectors in a hierarchy structure provides gives a better result than a single large detector.

Abstract: A hierarchical neural network for monitoring network functions and that functions as a true anomaly detector is disclosed. Detection of an anomaly is achieved by monitoring selected areas of network behavior, such as protocols, that are predictable in advance. Combining outputs of neural networks within the hierarchical network yields satisfactory anomaly detection.

Abstract: An efficient hardware cache manager controls the top-of-stack data underflow/overflow. A processor chip includes a processor, a stack buffer and the invented cache management hardware. The processor chip communicates with a remove overflow stack through an address/data bus. The cache management hardware efficiently manages overflow and underflow to and from the processor chip in such a manner less than 1% of the processor's time is spent managing the stack cache.