Abstract: A method for accurately determining whether a response tool will be effective for responding to a given enemy threat object. Embodiments described herein provide a method and system for responding to a threat object, for example, negating missile threats. Embodiments may include validating effectiveness of a response to the threat object. Other embodiments may include verifying the continued effectiveness of a response to the threat object. Further embodiments may include providing feedback to re-perform the method for responding to the threat object. The system may include a mathematical method, and associated algorithms, to assess, in an automated fashion, the performance of non-kinetic techniques with respect to negating the threat object.

Abstract: A method of rapidly producing a new cyber response tool (e.g., in near-real-time) by matching vulnerabilities of enemy threats (e.g., a missile and/or a tank) to corresponding portions of other response tools that effectively exploit the matched vulnerability. An iterative framework may be utilized to repeatedly prioritize a set of cyber response tools based on a corresponding probability of success. For example, a computer or computer network may implement the iterative framework to carry out the probability computation and corresponding cyber response tool prioritization. If a total probability of success is below a given threshold (e.g., 95%), then creation of one or more new cyber response tools may be initiated. The probability of success may be a function of time (e.g., ten minutes before an expected launch) and/or a function of a phase of a lifecycle of the enemy threat (e.g., a launch phase).

Abstract: In one embodiment, packets are sent a packet switching mechanism of a packet switching device, which includes partitioning each particular packet into a plurality of cells with each particular packet and cell derived therefrom associated with a same particular timestamp and a same particular ingress point identifier representing an ingress point of a plurality of ingress points of the packet switching mechanism. These cells are sent through the packet switching mechanism by selecting and forwarding, at each of a plurality of points within the packet switching mechanism. A tie-breaking value is determined based on a manipulation of ingress point identifier associated with said identifiable cell in a manner to vary the tie-breaking selection ordering of ingress point identifiers for different timestamp values. The tie-breaking value is used in selecting a next cell to forward when cells are associated with a same timestamp.

Abstract: In one embodiment, cells of a same packet are sent among multiple paths within a packet switching device. Each of these cells is associated with a same drop value for use in determining whether to drop or forward the cell at multiple positions within a packet switching fabric of a packet switching device in light of a current congestion measurement. In one embodiment, the drop value is calculated at each of these multiple positions based on fields of the cell that are packet variant, but not cell variant, so a same drop value is calculated by each cell of a packet. In one embodiment, at least one of these fields provides entropy (e.g., a timestamp of the packet) such that a produced drop value has, or approximately has, an equal probability of being any value within a predetermined range for fairness purposes.

Abstract: In one embodiment, packets are sent a packet switching mechanism of a packet switching device, which includes partitioning each particular packet into a plurality of cells with each particular packet and cell derived therefrom associated with a same particular timestamp and a same particular ingress point identifier representing an ingress point of a plurality of ingress points of the packet switching mechanism. These cells are sent through the packet switching mechanism by selecting and forwarding, at each of a plurality of points within the packet switching mechanism. A tie-breaking value is determined based on a manipulation of ingress point identifier associated with said identifiable cell in a manner to vary the tie-breaking selection ordering of ingress point identifiers for different timestamp values. The tie-breaking value is used in selecting a next cell to forward when cells are associated with a same timestamp.

Abstract: A method of rapidly producing a new cyber response tool (e.g., in near-real-time) by matching vulnerabilities of enemy threats (e.g., a missile and/or a tank) to corresponding portions of other response tools that effectively exploit the matched vulnerability. An iterative framework may be utilized to repeatedly prioritize a set of cyber response tools based on a corresponding probability of success. For example, a computer or computer network may implement the iterative framework to carry out the probability computation and corresponding cyber response tool prioritization. If a total probability of success is below a given threshold (e.g., 95%), then creation of one or more new cyber response tools may be initiated. The probability of success may be a function of time (e.g., ten minutes before an expected launch) and/or a function of a phase of a lifecycle of the enemy threat (e.g., a launch phase).

Abstract: Optimizing a bitmap data tree and a corresponding lookup operation in the bit map data tree may be provided. A number of branches for each search node of a data tree may be counted. The data tree may comprise a plurality of search nodes. Then an optimum depth for the plurality of search nodes may be identified based on the number of branches in the data tree. Next, a hash node may be added to replace a search node of the data tree when a number of branches for the search node is greater than the identified optimum depth.

Abstract: A method for accurately determining whether a response tool will be effective for responding to a given enemy threat object. Embodiments described herein provide a method and system for responding to a threat object, for example, negating missile threats. Embodiments may include validating effectiveness of a response to the threat object. Other embodiments may include verifying the continued effectiveness of a response to the threat object. Further embodiments may include providing feedback to re-perform the method for responding to the threat object. The system may include a mathematical method, and associated algorithms, to assess, in an automated fashion, the performance of non-kinetic techniques with respect to negating the threat object.

Abstract: A method of fusing sensor detection probabilities. The fusing of detection probabilities may allow a first force to detect an imminent threat from a second force, with enough time to counter the threat. The detection probabilities may include accuracy probability of one or more sensors and an available time probability of the one or more sensors. The detection probabilities allow a determination of accuracy of intelligence gathered by each of the sensors. Also, the detection probabilities allow a determination of a probable benefit of an additional platform, sensor, or processing method. The detection probabilities allow a system or mission analyst to quickly decompose a problem space and build a detailed analysis of a scenario under different conditions including technology and environmental factors.

Abstract: Optimizing a bitmap data tree and a corresponding lookup operation in the bit map data tree may be provided. A number of branches for each search node of a data tree may be counted. The data tree may comprise a plurality of search nodes. Then an optimum depth for the plurality of search nodes may be identified based on the number of branches in the data tree. Next, a hash node may be added to replace a search node of the data tree when a number of branches for the search node is greater than the identified optimum depth.

Abstract: The present invention provides a network multithreaded processor, such as a network processor, including a thread interleaver that implements fine-grained thread decisions to avoid underutilization of instruction execution resources in spite of large communication latencies. In an upper pipeline, an instruction unit determines an-instruction fetch sequence responsive to an instruction queue depth on a per thread basis. In a lower pipeline, a thread interleaver determines a thread interleave sequence responsive to thread conditions including thread latency conditions. The thread interleaver selects threads using a two-level round robin arbitration. Thread latency signals are active responsive to thread latencies such as thread stalls, cache misses, and interlocks. During the subsequent one or more clock cycles, the thread is ineligible for arbitration. In one embodiment, other thread conditions affect selection decisions such as local priority, global stalls, and late stalls.

Abstract: Disclosed are, inter alia, methods, apparatus, computer-storage media, mechanisms, and means associated with cooperative flow locks distributed among multiple components, such as on different application-specific integrated circuits in a packet switching device. Flow locks are typically used for maintaining the order of packets and operations performed thereon by the coordination of a context (e.g., the processing of a packet by a packet processor) with a corresponding flow lock interface, and by the manner of communication performed among the flow lock interface and the distributed flow locks.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, mechanisms, and means for a storage controller (e.g., memory controller, disk controller, etc.) performing a set of multiple operations on cached data with a no-miss guarantee until the multiple operations are complete, which may, for example, be used by a packet processor to quickly update multiple statistics values (e.g., byte, packet, error counts, etc.) based on processed packets. Operations to be performed on data at the same address and/or in a common data structure are grouped together and burst so that they arrive at the storage system in contiguous succession for the storage controller to perform. By not allowing the storage controller to flush the data from its cache until all of the operations are performed, even a tiny cache attached to the storage controller can reduce the bandwidth and latency of updating the data.

Abstract: A hierarchical tree of deterministic finite automata (DFA) is traversed and/or generated based on a set of regular expressions. The hierarchical DFA includes a root DFA linked together with a set of leaf DFAs, and possibly a set of branch DFAs. The root DFA is always active and is responsive to an input string, as are any currently active branch and leaf DFAs. When a final state or arc is reached or traversed in any active DFA, a regular expression has been matched. The branch and leaf DFAs are activated in response to the root DFA or a branch DFA reaching or traversing an activation state or arc corresponding to the branch or leaf DFA. Active branch and leaf DFAs will become inactive when a termination state or arc is reached or traversed within the branch or leaf DFA. State explosion in the hierarchical DFA can typically be avoided by selectively grouping similar portions of the regular expressions together in branch and leaf DFAs.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for identifying matches to a series of regular expressions, with the series of regular expressions including a first regular expression followed by a second regular expression, which avoids the potential overlap of characters used in matching the first and second regular expressions, while allowing individual deterministic finite automata (DFAs) to be used, whether standalone or as a merged DFA, which decreases the number of states required to represent the series of regular expressions. This potential overlap of characters can be avoided by adding marking states in a merged DFA as “divergent” in order to mask (e.g., ignore) a matching of the second regular expression for the potential overlap, or by using another DFA corresponding to the second regular expression for use during this divergent period.

Abstract: Sequences of items may be maintained using ordered locks. These items may correspond to anything, but using ordered locks to maintain sequences of packets, especially for maintaining requisite packet orderings when distributing packets to be processed to different packet processing engines, may be particularly useful. For example, in response to a particular packet processing engine completing processing of a particular packet, a gather instruction is attached to the particular identifier of a particular ordered lock associated with the particular packet. If no longer needed for further processing, the packet processing engine is immediately released to be able to process another packet or perform another function. The gather instruction is typically performed in response to the particular ordered lock being acquired by the particular identifier, with the gather instruction causing the processed particular packet to be sent.

Abstract: Disclosed are, inter alia, methods, apparatus, computer-storage media, mechanisms, and means associated with cooperative flow locks distributed among multiple components, such as on different application-specific integrated circuits in a packet switching device. Flow locks are typically used for maintaining the order of packets and operations performed thereon by the coordination of a context (e.g., the processing of a packet by a packet processor) with a corresponding flow lock interface, and by the manner of communication performed among the flow lock interface and the distributed flow locks.

Abstract: Sequences of items may be maintained using ordered locks. These items may correspond to anything, but using ordered locks to maintain sequences of packets may be particularly useful. One implementation uses a locking request, acceptance, and release protocol. One implementation associates instructions with locking requests such that when a lock is acquired, the locking mechanism executes or causes to be executed the associated instructions as an acceptance request of the lock is implied by the association of instructions (or may be explicitly requested). In some applications, the ordering of the entire sequence of packets is not required to be preserved, but rather only among certain sub-sequences of the entire sequence of items, which can be accomplished by converting an initial root ordered lock (maintaining the sequence of the entire stream of items) to various other locks (each maintaining a sequence of different sub-streams of items).

Abstract: Data is protected using locks, with the protected data sometimes being included in the locking messages, which may reduce overall processing latency, and/or reduce a bandwidth requirement for and/or number of storage operations accessing the native storage of the protected data. For example, the lock manager receives lock requests from each of the requesters, and selectively grants the lock requests. The protected data is typically communicated in the locking messages when the lock is highly contested, or at least two request for access to the data are pending. The lock manager initiates the sequence by indicating in a grant message to a requester to include the protected data in its release message. The lock manager then copies this data received in the release message to its grant message to the next requestor.

Abstract: Methods and apparatus are disclosed using a random indication to map items to paths and to recirculate or delay the sending of a particular item when a destination over its mapped path is unreachable, including, but not limited to the context of sending of packets across multiple paths in a packet switching system. In one implementation, a set of items is buffered, with the set of items including a first and second sets of items. The items in the first set of items are forwarded over a set of paths in a first configuration. The set of paths is reconfigured into a second configuration, and the items in the second set of items are forwarded over the set of paths in the second configuration. In one implementation, a recirculation buffer is used to hold items not immediately sent. In one implementation, the paths are reconfigured in a random fashion.