Abstract: The present disclosure is directed to data classification. An exemplary computer-enabled method for classifying image data comprises: receiving an input image, wherein the input image is of a second data domain; providing the input image to a preprocessing algorithm to obtain a transformed image, wherein the preprocessing algorithm is trained to transform data of the second data domain to data of a first data domain; providing the transformed image to a trained algorithm to analyze the transformed image, wherein the trained algorithm is trained based on training data of the first data domain.

Abstract: Techniques for determining whether a public encryption key is vulnerable as the result of deficiencies in pseudorandom number generation algorithms are provided. In some embodiments, a system may compile a database of cryptographic information received from a plurality of sources, including databases, and network traffic monitoring tools. RSA public keys extracted from the cryptographic information may be stored in an organized database in association with corresponding metadata. The system may construct a product tree from all unique collected RSA keys, and may then construct a remainder tree from the product tree, wherein each output remainder may be determined to be a greatest common divisor of one of the RSA keys against all other unique RSA keys in the database. The system may then use the greatest common divisors to factor one or more of the RSA keys and to determine that the factored keys are vulnerable to being compromised.

Abstract: Methods for configuring a quantum annealer to solve a QUBO problem comprises receiving data representing an initial graph representing an embedding of a QUBO problem into a qubit architecture of the quantum annealer and causing one or more GPU thread blocks to create and store a best local current graph and update the best local current graph. Updating the best current local graph comprises copying the best local current graph, modifying the best local current graph copy to form a candidate local graph, computing an evaluation rating for the candidate local graph, and, in accordance with a determination that one or more replacement criteria are met, replacing the best local current graph with the candidate local graph. An updated best local current graph may be identified in a local results array as the best global graph. The quantum annealer may be configured based on the best local graph.

Abstract: Systems and methods for mitigating cybersecurity threats are provided. A system for mitigating cybersecurity threats may be configured to identify, based on a model of a system, future states, wherein the model depicts a plurality of states for the system and a plurality of capabilities enabling transitions between the plurality of states. Identifying future states may be based on a current state of the system, and the future states may comprise an undesirable state. The system may determine, based on the model of the system, whether the undesirable state is a reachable state, wherein the determination is based on capabilities possessed by an insider entity. In accordance with a determination that the undesirable state is a reachable state, the system may modify a capability possessed by the insider entity, wherein modifying the capability prevents the insider entity from causing the system to transition to the undesirable state.

Abstract: A genetic algorithm system generates a set of computer programs and executes a process for assessment and conditional modification of the set, repeating the process over a plurality of generations to mutate the population of solutions over time. At each generation, the system scores each program in the set to generate a respective primary score adjustment, a respective secondary score adjustment, and a respective current score. If a current score for a program is less than or equal to a first threshold, the system removes the computer program from the set. If the current score is greater than or equal to a second threshold, the system modifies the computer program to generate one or more offspring programs for use in subsequent generations. If a primary score adjustment for a program is greater than or equal to a third threshold, the system selects the computer program for performance of a task.

Abstract: Systems and methods for simulating cyber-physical systems are disclosed. A plurality of geographic simulation layers representing respective infrastructure sectors of a real-world environment may be generated, and the layers may be linked together with one another to create a multi-layer simulation. The associations between the layers of the simulation may be adjusted, and characteristics of the simulation layers themselves may be adjusted, to ensure that the simulation conforms to characteristics of the real-world environment being simulated. In some embodiments, a multi-user simulation system allows users at separate terminals to execute attack inputs and defense inputs against the simulation to try to destabilize and stabilize the simulation, respectively. Results of the attack inputs and defense inputs may be simultaneously displayed on a plurality of terminals.

Abstract: Techniques for securely encoding, communicating, and comparing genomic information using probabilistic data structures are provided. In some embodiments, genomic information in a secure computing environment may be encoded and/or anonymized by building a probabilistic data structure that represents sub-strings of the genomic information as members of a set; the probabilistic data structure may then be securely transmitted outside the secure computing environment. In some embodiments, a probabilistic data structure representing sub-strings of sensitive genomic information as members of a set may be received in an unsecure computing environment and may be queried to generate output data indicating whether reference sub-strings are probable members of the set.

Abstract: Techniques for detecting anomalies in multispectral image data, and more specifically for detecting presentation attacks by using multispectral image data in biometric security applications, are provided. In some embodiments, a system may receive multispectral image data and generate an estimation of a first image of a plurality of images of the multispectral image data, wherein the estimation is based on other images of the multispectral image data, but not the first image itself. The estimation may then be compared to the first image to generate an indication as to whether the multispectral image data represents a presentation attack. In some embodiments, a system may receive multispectral training image data and may extract features from the data to generate and store a network architecture for predicting relationships of multispectral images of subjects.

Abstract: Portable biosurveillance kits for sequencing and sample identification are provided, and techniques for configuring said kits are provided. A system for configuring a kit may receive data representing a first and second set of nucleic acid sequences, and may generate and store first and second indexes representing the respective sets. The system may then use the indexes to identify conserved-signature sequences that satisfy abundance criteria with respect to the first set and sparsity criteria with respect to the second set. The identified conserved-signature sequences may be stored on (or represented in storage on) a portable sequencing and sample-identification kit, which may compare the conserved-signature sequence to a sample sequence in order to identify the sample sequence.

Abstract: Techniques for determining whether a public encryption key is vulnerable as the result of deficiencies in pseudorandom number generation algorithms are provided. In some embodiments, a system may compile a database of cryptographic information received from a plurality of sources, including databases, and network traffic monitoring tools. RSA public keys extracted from the cryptographic information may be stored in an organized database in association with corresponding metadata. The system may construct a product tree from all unique collected RSA keys, and may then construct a remainder tree from the product tree, wherein each output remainder may be determined to be a greatest common divisor of one of the RSA keys against all other unique RSA keys in the database. The system may then use the greatest common divisors to factor one or more of the RSA keys and to determine that the factored keys are vulnerable to being compromised.

Abstract: Disclosed herein are systems and methods for path planning for UAVs. A set of UAVs is logically arranged into a plurality of swarms, each having a swarm-leader UAV. A first path planning algorithm is applied to determine navigation instructions to steer the swarm-leader UAVs towards respective destinations for the swarms and to deconflict the swarm-leader UAVs from one another. A set of second path planning algorithms is applied to determine navigation instructions to steer non-swarm-leader UAVs in each swarm toward their respective swarm leaders and to deconflict the UAVs from other UAVs in the swarm. Separate QUBO path planning algorithms may be used for the first path planning algorithm and the set of second path planning algorithms. If merging criteria for combining two swarms are met, a single QUBO may be used to control all non-swarm-leader UAVs in merged swarms.

Abstract: Systems and methods for simulating cyber-physical systems are disclosed. A plurality of geographic simulation layers representing respective infrastructure sectors of a real-world environment may be generated, and the layers may be linked together with one another to create a multi-layer simulation. The associations between the layers of the simulation may be adjusted, and characteristics of the simulation layers themselves may be adjusted, to ensure that the simulation conforms to characteristics of the real-world environment being simulated. In some embodiments, a multi-user simulation system allows users at separate terminals to execute attack inputs and defense inputs against the simulation to try to destabilize and stabilize the simulation, respectively. Results of the attack inputs and defense inputs may be simultaneously displayed on a plurality of terminals.

Abstract: Techniques for providing data loss prevention, including data exfiltration prevention and crypto-ransomware prevention, are provided. In some embodiments, a slack-space file system is created by using a modified packing algorithm to increase and/or optimize an amount of slack space created by files stored in a standard file system. A program for accessing and indexing the slack-space file system may be stored, and requests by a user to store data on a storage medium of a computer system may cause the information to be stored in the slack-space file system, where it may be protected from destructive malware that operates solely on the standard file system. In some embodiments, sensitive information may be hidden by storing the information in an alternate data stream of a file and by replacing the information in the unnamed data stream of the file with non-sensitive information that may appear to be sensitive.

Abstract: Methods for improving the prediction accuracy for an ensemble machine learning model are described. In some instances, the methods comprise: (i) receiving data characterizing levels of trust in one or more machine learning models that form the ensemble machine learning model; (ii) calculating a prediction error estimate for each of the one or more machine learning models based on a trust score for that machine learning model and relative weights calculated for the data points in a training data set used to train that machine learning model; (iii) calculating a normalized weight for each of the one or more machine learning models using the prediction error estimate calculated for each; and (iv) adjusting an output prediction equation for the ensemble machine learning model, where the adjustment is based, at least in part, on the normalized weights calculated in for each of the one or more machine learning models.

Abstract: Data investigations are performed by querying a plurality of data sources. A system receives an investigation input and queries a plurality of data sources in accordance with the received input. The system receives, in response to the querying, response data from the plurality of data sources, and generates and stores a data structure representing relationships between the first investigation input and the first response data. The data structure may be in the form of a knowledge graph. The system may generate and display a visualization of the data structure. The system may generate and store a record of investigation steps used to generate the data structure, such that the investigation steps may be applied in future instances, for example using different inputs, to generate new data structures.

Abstract: Disclosed herein are systems and methods for simulating an environment over a plurality of intervals of in-simulation time by using a two-part data structure to represent agents or entities in the simulation. A system may create and store a data structure representing an agent in the simulation, wherein a first portion of the data structure represents characteristics of the agent at a present interval and a second portion of data structure represents characteristics of the agent at a future interval of the simulation. Also disclosed herein are systems and methods for executing a multi-agent simulation using multiple processing threads. A system may group a plurality of agents in the simulated environment into subsets associated respectively with nodes of the simulated environment, assign the subsets to respective separate processors of the system, and execute the simulation using separate processing threads associated respectively with the separate processors.

Abstract: An adversarial reinforcement learning system is used to simulate a spatial environment. The system includes a simulation engine configured to simulate a spatial environment and various objects therein. The system further includes a first model configured to control objects in the simulation and a second model configured to control objects in the simulation. The first model generates a threat-mitigation input to control one or more objects in the simulation, and the second model generates a threat input to control one or more objects in the simulation. The system then executes a first portion of the simulation based at least in part of the threat mitigation input and the threat input.

Abstract: Systems and methods for password discovery are provided. A system receives a first password data set comprising known passwords and applies a rule-set to the first data set to generate a second password data set comprising passwords that are believed to be likely to be human-generated. The system trains a generative adversarial network, for generating predicted passwords, using the second data set, for example by incentivizing the GAN to favor passwords in the second data set. The system applies the generative adversarial network to generate a third password data set comprising predicted passwords. The system compares the third password data set to a data corpus to identify a string in the data corpus determined to match one of the predicted passwords in the first plurality of predicted passwords. The identified string may thus be identified as a previously undiscovered password, which may be applied to unlock password-protected systems and/or to further improve password discovery systems.

Abstract: The present disclosure relates to capturing the routing topology of a network (e.g., the Internet covering the entire IPv4 address space). An exemplary method comprises: obtaining a first bit array indicative of a plurality of target IP addresses; assigning a first subset of the plurality of target IP addresses to a first source device; assigning a second subset of the plurality of target IP addresses to a second source device; causing the first source device to transmit a first plurality of probing packets to the first subset of the plurality of target IP addresses and receive a first plurality of returned packets, causing the second source device to transmit a second plurality of probing packets to the second subset of the plurality of target IP addresses and receive a second plurality of returned packets, and generating a data structure representing a routing topology of the network.

Abstract: Techniques for determining whether a public encryption key is vulnerable as the result of deficiencies in pseudorandom number generation algorithms are provided. In some embodiments, a system may compile a database of cryptographic information received from a plurality of sources, including databases, and network traffic monitoring tools. RSA public keys extracted from the cryptographic information may be stored in an organized database in association with corresponding metadata. The system may construct a product tree from all unique collected RSA keys, and may then construct a remainder tree from the product tree, wherein each output remainder may be determined to be a greatest common divisor of one of the RSA keys against all other unique RSA keys in the database. The system may then use the greatest common divisors to factor one or more of the RSA keys and to determine that the factored keys are vulnerable to being compromised.