Abstract: Presented herein are systems and methods for operating a flight plan based distributed ledger system implemented on an aviation communications network. According to an aspect, data associated with communication transmissions occurring between communications elements of the aviation communications network may be recorded on the distributed ledger system. The communications elements involved in the distributed ledger system may be determined using a received flight plan. The flight plan information may be used to initialize the ledger information at each communications element involved in the distributed ledger system. The distributed ledger system may be updated to add or remove communications elements if the flight deviates from the original flight plan. After the flight plan is executed, the distributed ledger system may inactivate the ledger and store the ledger information in a centralized repository.

Abstract: Disclosed are systems and methods for securing a network including one or more network nodes connecting a plurality of network connected devices of the network. A method may include: receiving and temporarily storing a plurality of data packets in a shared buffer of a network node; receiving requests from a first processing engine and a second processing engine to access a temporarily stored data packet; generating a first pointer and a second pointer to the temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same temporarily stored data packet; and enabling the first processing engine to use the generated first pointer to access the temporarily stored data packet and the second processing engine to use the generated second pointer to access the temporarily stored data packet.

Abstract: Disclosed are systems and methods for securing a network including one or more network nodes connecting a plurality of network connected devices of the network. A method may include: receiving and temporarily storing a plurality of data packets in a shared buffer of a network node; receiving requests from a first processing engine and a second processing engine to access a temporarily stored data packet; generating a first pointer and a second pointer to the temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same temporarily stored data packet; and enabling the first processing engine to use the generated first pointer to access the temporarily stored data packet and the second processing engine to use the generated second pointer to access the temporarily stored data packet.

Abstract: Presented herein are systems and methods for operating a flight plan based distributed ledger system implemented on an aviation communications network. According to an aspect, data associated with communication transmissions occurring between communications elements of the aviation communications network may be recorded on the distributed ledger system. The communications elements involved in the distributed ledger system may be determined using a received flight plan. The flight plan information may be used to initialize the ledger information at each communications element involved in the distributed ledger system. The distributed ledger system may be updated to add or remove communications elements if the flight deviates from the original flight plan. After the flight plan is executed, the distributed ledger system may inactivate the ledger and store the ledger information in a centralized repository.

Abstract: Disclosed are systems and methods for securing a network. A method may include obtaining, by a detection engine, an encapsulated image defining an action for a predetermined data packet of interest; determining, by the detection engine, that the action defined by the encapsulated image should be applied to one or more data packets accessed by the detection engine; generating and deploying, by the detection engine, an action state including one or more attributes associated with the accessed data packet and the encapsulated image; determining, at a first execution engine executing parallel with the detection engine, that the one or more data packets comprises attributes matching the one or more attributes included in the deployed action state; and executing, by the first execution engine, the action included in the deployed action state on a received data packet to generate a processed data packet.

Abstract: Disclosed are systems and methods for securing a network including one or more network nodes connecting a plurality of network connected devices of the network. A method may include: receiving and temporarily storing a plurality of data packets in a shared buffer of a network node; receiving requests from a first processing engine and a second processing engine to access a temporarily stored data packet; generating a first pointer and a second pointer to the temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same temporarily stored data packet; and enabling the first processing engine to use the generated first pointer to access the temporarily stored data packet and the second processing engine to use the generated second pointer to access the temporarily stored data packet.

Abstract: Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.

Abstract: Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.

Abstract: Disclosed are systems and methods for securing a network. A method may include obtaining, by a detection engine, an encapsulated image defining an action for a predetermined data packet of interest; determining, by the detection engine, that the action defined by the encapsulated image should be applied to one or more data packets accessed by the detection engine; generating and deploying, by the detection engine, an action state including one or more attributes associated with the accessed data packet and the encapsulated image; determining, at a first execution engine executing parallel with the detection engine, that the one or more data packets comprises attributes matching the one or more attributes included in the deployed action state; and executing, by the first execution engine, the action included in the deployed action state on a received data packet to generate a processed data packet.

Abstract: Disclosed are systems and methods for securing a network including one or more network nodes connecting a plurality of network connected devices of the network. A method may include: receiving and temporarily storing a plurality of data packets in a shared buffer of a network node; receiving requests from a first processing engine and a second processing engine to access a temporarily stored data packet; generating a first pointer and a second pointer to the temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same temporarily stored data packet; and enabling the first processing engine to use the generated first pointer to access the temporarily stored data packet and the second processing engine to use the generated second pointer to access the temporarily stored data packet.

Abstract: Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.

Abstract: Apparatus and methods described herein relate to a processor that can convert intelligence data into a data structure, and that can store the data structure in a data store. The processor can calculate an identity value for the data structure. The data structure can be immutable such that data represented in the data structure is not modified. A query engine implemented by the processor can receive a request for intelligence status data, and can query an index data store for a set of identity values correlated with data included in the request. The query engine can retrieve, from the data store, intelligence status data correlated with each identity value in the set of identity values. The query engine can also return a snapshot data structure representing at least a portion of the intelligence status data correlated with each identity value in the set of identity values, in response to the request.

Abstract: Apparatus and methods described herein relate to a global workspace management compute device that can generate a workspace hierarchy tree representing a hierarchy of a set of workspaces in a network. A local workspace management compute device operatively coupled to the global workspace management compute device can, when operative, calculate workspace cyber-threat data for a local workspace in the set of workspaces based on data from a global workspace, and can provide the calculated workspace cyber-threat data to a local workspace interface so that the local workspace interface displays a representation of the set of workspaces in the network. After receiving modifications of portions of the local workspace cyber-threat data, the local workspace management compute device can define a child node of the local workspace based on the modifications. The local workspace interface can modify the representation of the set of workspaces in the network based on the child node.

Abstract: Apparatus and methods described herein relate to a processor that can convert intelligence data into a data structure, and that can store the data structure in a data store. The processor can calculate an identity value for the data structure. The data structure can be immutable such that data represented in the data structure is not modified. A query engine implemented by the processor can receive a request for intelligence status data, and can query an index data store for a set of identity values correlated with data included in the request. The query engine can retrieve, from the data store, intelligence status data correlated with each identity value in the set of identity values. The query engine can also return a snapshot data structure representing at least a portion of the intelligence status data correlated with each identity value in the set of identity values, in response to the request.

Abstract: Apparatus and methods described herein relate to a global workspace management compute device that can generate a workspace hierarchy tree representing a hierarchy of a set of workspaces in a network. A local workspace management compute device operatively coupled to the global workspace management compute device can, when operative, calculate workspace cyber-threat data for a local workspace in the set of workspaces based on data from a global workspace, and can provide the calculated workspace cyber-threat data to a local workspace interface so that the local workspace interface displays a representation of the set of workspaces in the network. After receiving modifications of portions of the local workspace cyber-threat data, the local workspace management compute device can define a child node of the local workspace based on the modifications. The local workspace interface can modify the representation of the set of workspaces in the network based on the child node.