Abstract: Described are systems, methods, and computer-program product embodiments for providing Session Initiation Protocol (SIP) network security. In some embodiments, a SIP processing system includes a SIP device configured to establish and control a SIP communication session between SIP user agents. In some embodiments, the SIP processing system includes a SIP device that establishes a recording session with a first server to receive SIP messages relayed in the SIP communication session. The first server decodes the SIP messages based on metadata in the SIP messages to extract multimedia content. Then, the first server opens a socket connection to establish a security session with a security system configured to determine whether the portion is associated with a detected threat and transmits a portion of the decoded multimedia to the security system. Based on a threat status generated by and received from the security system, the first server controls the SIP communication session.

Abstract: The present disclosure relates to enabling a radar system relates to identify airborne and spaceborne objects in a nuclear-scintillated environment. In some embodiments, the radar system transmits a plurality of narrowband signals corresponding to a plurality of consecutive segments of a linear frequency modulated (LFM) waveform. The radar system receives a plurality of echo signals corresponding to the plurality of narrowband signals being reflected from an airborne or spaceborne object. Upon processing the plurality of echo signals to generate a plurality of waveform segments, the radar system combines the plurality of waveform segments to produce a composite waveform. Then, the radar system applies a matched filter to the composite waveform using the LFM waveform to identify the airborne or spaceborne object.

Abstract: An RF congestion monitoring system and method is provided. In one or more examples, the RF congestion monitoring system can include a modified aircraft transponder capable of receiving signals associated with Air Traffic Control and Traffic Collision Avoidance Systems, analyzing the received signals to determine the presence on one or more events occurring in the received signals, and generating an event count that identifies the types of signals associated with the events being received. A processor can receive the generated event count and based on the received count can calculate a transponder occupancy percentage metric indicative of the amount of RF congestion in a given air space. In one or more examples, the modified transponder can be configured to receive various radar signals in the 1030 and 1090 MHz frequency signal bands and process those signals to determine the amount of RF congestion in the airspace.

Abstract: Described are methods, systems, and computer-program product embodiments for deriving a model of computation of a cyber-physical system (CPS). In some embodiments, a method includes receiving, from the CPS network, network-events data corresponding to a process performed by the CPS and including network events and associated group IDs. A plurality of events logs for a plurality of selections of group IDs are generated with each events log including a sequence of network events selected from the network events based on the selection of group IDs for that events log. A plurality of directed graphs for the plurality of events logs are generated with each directed graph generated based on the sequence of network events in the events log. A plurality of group IDs can be determined based on a directed graph selected from the plurality of directed graphs based on a complexity score calculated for each directed graph.

Abstract: A system and method for test a mobile device software application is provided. In one example, a mobile application can interface with an emulation environment or mobile device that has been loaded with a kernel module that is configured to intercept certain system calls made by the mobile application, log the system calls, and generate a report based on the logged system calls. A user of the test environment can interface with the environment via a web browser that can also be used to load one or more tests that can be applied to the mobile device software application.

Abstract: A low profile phased array antenna that is configured to be manufactured using additive manufacturing techniques is provided. In one or more embodiments, the phased array can include a plurality of signal ears, ground ears, and clustered pillars that can be arranged in relation to a base plate such that each component of the antenna can be manufactured from a single piece of material, thereby allowing for the use of additive manufacturing techniques which can substantially reduce the cost and time of the manufacturing process. The phased array can include a signal ear that include one or more posts that interface with an airgap located within a base plate of the array, wherein the size of the airgap in relation to the size of the post is configured to achieve an optimal level of impedance matching.

Abstract: The present disclosure generally relates to systems and methods for evaluating radar vectoring aptitude of an individual. An exemplary computer-implemented method comprises: displaying a graphic representation of an aircraft; displaying a predetermined shape of a plurality of predetermined shapes, wherein each of the plurality of predetermined shapes is associated with a facility type; providing an instruction for controlling the aircraft; receiving a plurality of audio inputs from a user; performing a speech-to-text analysis to each of the plurality of audio inputs to obtain a plurality of corresponding text strings; identifying, based on the plurality of corresponding text strings, a plurality of vectoring clearances associated with the aircraft; displaying an animation of the aircraft based on the plurality of vectoring clearances; and based on the plurality of vectoring clearances, calculating a facility-specific aptitude score of the user.

Abstract: Described are methods, systems, and computer-program product embodiments for selecting a face image based on a name. In some embodiments, a method includes receiving the name. Based on the name, a name vector is selected from a plurality of name vectors in a dataset that maps a plurality of names to a plurality of corresponding name vectors in a vector space, where each name vector includes representations associated with a plurality of words associated with each name. A plurality of face vectors corresponding to a plurality of face images is received. A face vector is selected from the plurality of face vectors based on a plurality of similarity scores calculated for the plurality of corresponding face vectors, where for each name vector, a similarity score is calculated based on the name vector and each face vector. The face image is output based on the selected face vector.

Abstract: A system and method for implementing a software emulation environment is provided. In one example, a mobile application can interface with an emulation environment that can be used to test whether the mobile application includes malware that can compromise the security and integrity of an enterprise's computing infrastructure. When the mobile application issues a call for data, a device mimic module can intercept the call and determine if the call includes a call for one or more checkable artifacts that can reveal the existence of the emulation environment. If such a call for data occurs, the device mimic module can provide one or more spoofed checkable artifacts that have been recorded from a real-world mobile device. In this way, the existence of the emulation environment can be concealed so as to allow for a more thorough analysis of a mobile application for potential hidden malware.

Abstract: A system and method for implementing a distributed source coding quantization scheme is provided. In one example, two independent but statistically correlated data sources can be asymmetrically compressed so that one source is compressed at a higher ratio than the other. The resulting signals are transmitted and decoded by a receiver. The highly compressed source can utilize the non-highly compressed source as side information so as to minimize the compression loss associated with the higher compression ratio. A conditional codebook can be created that not only depends on the highly compressed quantizer, but also depends on the quantized symbol received from the non-highly compressed data source.

Abstract: Described are systems and methods for detecting an anomaly among a plurality of components operating in a system. In some embodiments, a method includes monitoring a plurality of metrics for the plurality of components across a plurality of time periods. For each time period, the plurality of components is clustered into a plurality of clusters based on measurement information corresponding to the plurality of metrics received for the time period. For each component, a plurality of correspondences is determined between the clusters in which the component is grouped for a plurality of pairs of adjacent time periods. Then, whether each component is operating anomalously can be determined based on the plurality of determined correspondences.

Abstract: A graphical user interface configured to facilitate replay debugging in distributed software programs is provided. The graphical user interface can allow the user to provide watchpoints and can allow the user to visualize variables that are contained within the log files. The watchpoints can represent one or more conditions. The user defined watchpoints can be converted into regex expressions and applied to the log files to determine if they meet the condition specified in the watchpoint, and if the log files meet the condition, a visual indication can be provided on a visual progress bar.

Abstract: Disclosed herein are system, method, and computer program product embodiments for a GNSS interference and spoofing fast detection and mitigation system. A RF signal associated with a PNT device, such as a GNSS receiver, is received. The received RF signal is split into a plurality of sub-data signals. The received RF signal is re-routed by sending each of the plurality of sub-data signals to at least one of a processing module and a switching module. An anomaly associated with a second sub-data signal is detected. The anomaly is detected during a capture period of an adversarial attack on the PNT device, prior to corruption of any associated system depending on outputs from the PNT device. An output of a first sub-data signal of the plurality of sub-data signals is terminated based on the anomaly detected with the second sub-data signal.

Abstract: Disclosed herein are system, method, and computer program product embodiments for detecting spoofing of a navigation device. A plurality of anti-spoofing techniques are provided. The plurality of anti-spoofing techniques detect interference with data provided by one or more navigation devices for a plurality of threat situations. Positioning, timing and frequency characteristics associated with the one or more navigation devices are analyzed in order to identify a threat situation among the plurality of threat situations. Based on the identified threat situation one or more of the anti-spoofing techniques are executed. The one or more anti-spoofing techniques can be executed in parallel in order to provide various anti-spoofing detection techniques at the same time.

Abstract: An RF congestion monitoring system and method is provided. In one or more examples, the RF congestion monitoring system can include a modified aircraft transponder capable of receiving signals associated with Air Traffic Control and Traffic Collision Avoidance Systems, analyzing the received signals to determine the presence on one or more events occurring in the received signals, and generating an event count that identifies the types of signals associated with the events being received. A processor can receive the generated event count and based on the received count can calculate a transponder occupancy percentage metric indicative of the amount of RF congestion in a given air space. In one or more examples, the modified transponder can be configured to receive various radar signals in the 1030 and 1090 MHz frequency signal bands and process those signals to determine the amount of RF congestion in the airspace.

Abstract: The present disclosure relates to suppressing malicious transmissions by overriding frames on a Controller Area Network (CAN) bus. In an embodiment, a method operates by determining when a frame arrives at a CAN bus. A determination of whether to override the frame is made based on an arbitration ID of the frame received from the CAN bus. In response to determining to override the frame, a predetermined sequence of bits is transmitted on the CAN bus during transmission of a data length code (DLC) field in the frame. A message to complete the frame is generated based on the predetermined sequence of bits. Then, the message is transmitted on the CAN bus.

Abstract: A multi-band helix antenna including one or more first arms extending helically about an axis at a first distance from the axis; and one or more second arms extending helically about the axis at a second distance from the axis that is greater than the first distance, wherein each of the one or more second arms comprises at least one trap circuit configured to have a first impedance at a resonant frequency of the one or more first arms and a second impedance at a resonant frequency of the one or more second arms, and the first impedance is greater than the second impedance.

Abstract: Cavity backed slot antenna arrays for conformal antenna applications are provided. A cavity backed slot antenna array may include an aperture, first and second feed structures, and a backing cavity configured to support the aperture and the first and second feed structures. The aperture may have a dielectric layer and a metal layer disposed on the dielectric layer. The metal layer may have first and second annular regions. The first annular region may have a first slot region and the second annular region may have a second slot region, where the second slot region may partially overlap the first slot region. The metal layer may further include first and second radiating elements configured to radiate energy. Each of the first and second feed structures may include a central portion and a plurality of fin structures arranged radially around the central portion.

Abstract: Method, systems, and techniques for determining the age of an underground space are provided. In some embodiments, determining the age of an underground space comprises taking soil samples from a plurality of surface locations within a second underground space, analyzing the soil samples from the plurality of surface locations to determine an amount of a chemical compound for each soil sample, and determining an age of the second underground space using one or more relationships based on amounts of the chemical compound measured in a plurality of soil samples taken over a period of time in a first underground space and a baseline amount of the chemical compound at one or more locations remote from both the first underground space and the second underground space.

Abstract: A system for generating reflectance values for a target that includes a plurality of electromagnetic radiation sources for irradiating the target, an imager for generating a plurality of digital representations of the target that includes an array of filter elements for filtering electromagnetic radiation reflected by the target through an array of filter elements, and a detector for detecting the filtered electromagnetic radiation at an array of detection elements. The system includes processors for determining a set of reflectance values for a portion of the target based on a first digital representation of the target generated in response to irradiation of the target with radiation of a first wavelength band and a second digital representation of the target generated in response to irradiation of the target with radiation of a second wavelength band.