Abstract: Identification, characterization and attribution of executable content within and across an enterprise infrastructure (e.g., hosts, subnets, routers, etc.) to provide situational awareness for cyber security for purposes of supporting proactive defense and response. Copies of executable content collected at one or more locations within an infrastructure (e.g., hosts, network edges, etc.) may be passed to a central analysis server whereby various characteristics of the executable content may be extracted or gleaned from the copies such as author marks (e.g., directory names), tool marks (e.g., compiler settings), behaviors (e.g., function extraction), patterns (e.g., byte sequences), text, and/or the like. The characteristics may be analyzed in various manners to build profiles of actors or organizations associated with (e.g., responsible for) executable content within the enterprise infrastructure.

Abstract: Identification, characterization and attribution of executable content within and across an enterprise infrastructure (e.g., hosts, subnets, routers, etc.) to provide situational awareness for cyber security for purposes of supporting proactive defense and response. Copies of executable content collected at one or more locations within an infrastructure (e.g., hosts, network edges, etc.) may be passed to a central analysis server whereby various characteristics of the executable content may be extracted or gleaned from the copies such as author marks (e.g., directory names), tool marks (e.g., compiler settings), behaviors (e.g., function extraction), patterns (e.g., byte sequences), text, and/or the like. The characteristics may be analyzed in various manners to build profiles of actors or organizations associated with (e.g., responsible for) executable content within the enterprise infrastructure.

Abstract: A method, a network node, and a set of instructions are disclosed. A network interface 260 may have a precedent network address to represent the network node 104 in the network 100. A processor 210 may recognize an address hop trigger. The processor 210 may change to a successor network address to represent the network node 104 in the network 100.

Abstract: A method, a network node, and a set of instructions are disclosed. A network interface 260 may have a precedent network address to represent the network node 104 in the network 100. A processor 210 may recognize an address hop trigger. The processor 210 may change to a successor network address to represent the network node 104 in the network 100.

Abstract: Disclosed are exemplary policy deconfliction methods and software for identifying conflicts in policy. The policy deconfliction methods and software may be embodied as an implementation of a subset of RuleML (informal/semi-formal) and Attribute Based Semantic Lattice (formal). The policy deconfliction methods and software act on a semantic representation of policy compiled from specific rule languages (e.g. XACML, RuleML). To detect and correct conflicts, the policy deconfliction methods and software perform a path analysis over the semantic representation of the policy to distinguish between equivalent, new, and overlapping policy (potential conflicts), regardless of policy language.