Abstract: In general, the techniques of this disclosure describe a method that includes receiving, by a computing device, a user interaction for identifying one or more undesired features of a software program to be removed. The software program is provisioned on the computing device as a software binary. The method further including identifying, by the computing device, one or more execution paths of the software binary that implement the one or more undesired features. Identifying the one or more execution paths includes outputting an indication directing the user to interact with the one or more undesired features, generating undesired feature information of an execution log, and determining the one or more execution paths using the execution log. The method further includes removing, by the computing device, the one or more execution paths to generate a modified software binary.

Abstract: In general, this disclosure describes media stream transmission techniques for a field computing device and a central computing device. The central computing device may capture an image of a local background environment. The central computing device may record a first media stream that includes at least a portion of the image of the background environment and at least one movement of at least one object through the background environment. The central computing device may remove the image of the background environment from the first media stream to create a second media stream that includes the movement of the object through the background environment without the image of the background environment. The second media stream may also include timing information that can be synchronized to timing information for a media stream originating at the field computing device such that the second media stream may be superimposed on the field media stream.

Abstract: An example method includes generating, by a computing system, first unique configuration information, generating, by the computing system and based on the first unique configuration information, a first unique instance of a software component, generating second unique configuration information, wherein the second unique configuration information is different from the first unique configuration information, and generating, based on the second unique configuration information, a second unique instance of the software component that is executable on the runtime computing system. The first and second unique instances of the software component comprise different instances of the same software component that each are configured to have uniquely different operating characteristics during execution on the runtime computing system.

Abstract: An example method includes, during execution of a software application in a computing system comprising a plurality of processing units, identifying platform-independent instructions that are configured to perform at least one computational task, wherein the plurality of processing units comprises a heterogeneous group, and wherein the platform-independent instructions have a format that is not specific to any particular processing unit in the plurality of processing units, determining one or more scheduling criteria that are associated with the platform-independent instructions, and selecting, from the heterogeneous group of processing units and based on the scheduling criteria, a processing unit to perform the at least one computational task.

Abstract: A network node includes enhanced functionality to fight through cyber-attacks. A plurality of virtual machines run at the network node. The network node receives a plurality of transaction requests and distributes a copy of each of the transaction requests to the plurality of virtual machines over a plurality of time steps. Based on the first virtual machine having executed (n) transaction requests in the plurality of transaction requests, the node detects whether any of the virtual machines has been compromised. In response to detecting the plurality of virtual machines includes a compromised virtual machine, the network node isolates the compromised virtual machine. Furthermore, after isolating the compromised virtual machine, the network node may receive a subsequent transaction request and dispatch the subsequent transaction request to the compromised virtual machine. The compromised virtual machine may execute the subsequent transaction request.

Abstract: A server system receives messages from client computing devices. Each of the messages corresponds to a transaction. The server system assigns each respective transaction to a respective fresh virtual machine. Furthermore, the server system performs, as part of a respective virtual machine processing a respective transaction, a modification associated with the respective transaction to a shared database. The shared database is persisted independently of the plurality of virtual machines. In response to determining that processing of the respective transaction is complete, the server system discards the respective virtual machine. In response to a trigger, such as determining that the respective transaction is associated with a cyber-attack, the server system uses checkpoint data associated with the respective transaction to roll back the modifications associated with the respective transaction to the shared database.

Abstract: An example method includes selecting, based at least on first and second policies, first and second containers in which to execute first and second applications, respectively. The example method further includes isolating execution of the first application in the first container, and isolating execution of the second application in the second container. The example method also includes applying, based at least on the first policy, a first group of security controls to the first application executing in the first container, wherein the first container defines a first domain in which the first application is executed, and applying, based at least on the second policy, a second group of security controls to the second application executing in the second container, wherein the second container defines a second domain in which the second application is executed.

Abstract: An example method includes generating, by a computing system, first unique configuration information, generating, by the computing system and based on the first unique configuration information, a first unique instance of a software component, generating second unique configuration information, wherein the second unique configuration information is different from the first unique configuration information, and generating, based on the second unique configuration information, a second unique instance of the software component that is executable on the runtime computing system. The first and second unique instances of the software component comprise different instances of the same software component that each are configured to have uniquely different operating characteristics during execution on the runtime computing system.

Abstract: In general, this disclosure describes media stream transmission techniques for a field computing device and a central computing device. The central computing device may capture an image of a local background environment. The central computing device may record a first media stream that includes at least a portion of the image of the background environment and at least one movement of at least one object through the background environment. The central computing device may remove the image of the background environment from the first media stream to create a second media stream that includes the movement of the object through the background environment without the image of the background environment. The second media stream may also include timing information that can be synchronized to timing information for a media stream originating at the field computing device such that the second media stream may be superimposed on the field media stream.

Abstract: A network node includes enhanced functionality to fight through cyber-attacks. A plurality of virtual machines run at the network node. The network node receives a plurality of transaction requests and distributes a copy of each of the transaction requests to the plurality of virtual machines over a plurality of time steps. Based on the first virtual machine having executed (n) transaction requests in the plurality of transaction requests, the node detects whether any of the virtual machines has been compromised. In response to detecting the plurality of virtual machines includes a compromised virtual machine, the network node isolates the compromised virtual machine. Furthermore, after isolating the compromised virtual machine, the network node may receive a subsequent transaction request and dispatch the subsequent transaction request to the compromised virtual machine. The compromised virtual machine may execute the subsequent transaction request.

Abstract: An example method includes, during execution of a software application in a computing system comprising a plurality of processing units, identifying platform-independent instructions that are configured to perform at least one computational task, wherein the plurality of processing units comprises a heterogeneous group, and wherein the platform-independent instructions have a format that is not specific to any particular processing unit in the plurality of processing units, determining one or more scheduling criteria that are associated with the platform-independent instructions, and selecting, from the heterogeneous group of processing units and based on the scheduling criteria, a processing unit to perform the at least one computational task.

Abstract: An example method includes identifying a software package that is associated with a software application, wherein the software package includes platform-independent instructions that are configured to perform at least one computational task upon execution, and wherein the platform-independent instructions have a format that is not specific to any particular hardware platform.

Abstract: A server system receives messages from client computing devices. Each of the messages corresponds to a transaction. The server system assigns each respective transaction to a respective fresh virtual machine. Furthermore, the server system performs, as part of a respective virtual machine processing a respective transaction, a modification associated with the respective transaction to a shared database. The shared database is persisted independently of the plurality of virtual machines. In response to determining that processing of the respective transaction is complete, the server system discards the respective virtual machine. In response to a trigger, such as determining that the respective transaction is associated with a cyber-attack, the server system uses checkpoint data associated with the respective transaction to roll back the modifications associated with the respective transaction to the shared database.

Abstract: In an example, an apparatus includes a memory storing a hypervisor, where the hypervisor is configured to determine whether one or more universal serial bus (USB) devices in communication with the hypervisor are authorized to communicate with a guest operating system of the hypervisor and, after determining that the one or more USB devices are authorized to communicate with the guest, virtualize the one or more USB devices at the guest operating system and transfer messages between the one or more USB devices and the virtualized USB device.

Abstract: A network defense system is described that provides network sensor infrastructure and a framework for managing and executing advanced cyber security algorithms specialized for detecting highly-distributed, stealth network attacks. In one example, a system includes a data collection and storage subsystem that provides a central repository to store network traffic data received from sensors positioned within geographically separate networks. Cyber defense algorithms analyze the network traffic data and detect centrally-controlled malware that is configured to perform distributed network attacks (“botnet attacks”) from devices within the geographically separate networks. A visualization and decision-making subsystem generates a user interface that presents an electronic map of geographic locations of source devices and target devices of the botnet attacks. The data collection and storage subsystem stores a manifest of parameters for the network traffic data to be analyzed by each of the cyber defense algorithms.

Abstract: In an example, an apparatus includes a memory storing a hypervisor, where the hypervisor is configured to determine whether one or more universal serial bus (USB) devices in communication with the hypervisor are authorized to communicate with a guest operating system of the hypervisor and, after determining that the one or more USB devices are authorized to communicate with the guest, virtualize the one or more USB devices at the guest operating system and transfer messages between the one or more USB devices and the virtualized USB device.

Abstract: An apparatus for mediating communication between a universal serial bus (USB) device and a host computing device is described. In an example, the apparatus includes a USB host interface configured to be connected to a downstream USB device, and a USB device interface configured to be connected to an upstream host computing device. The apparatus also includes a mediation module positioned between the USB host interface and the USB device interface and configured to determine whether the USB device is authorized to communicate with the host computing device.

Abstract: An apparatus for mediating communication between a universal serial bus (USB) device and a host computing device is described. In an example, the apparatus includes a USB host interface configured to be connected to a downstream USB device, and a USB device interface configured to be connected to an upstream host computing device. The apparatus also includes a mediation module positioned between the USB host interface and the USB device interface and configured to determine whether the USB device is authorized to communicate with the host computing device.

Abstract: In general, the invention provides for analyzing a target computer for computer crimes such as illegal sharing of files or sharing of illegal files on peer-to-peer clients. The target computer may have software for a plurality of peer-to-peer clients. Only one extensible forensic device may be necessary to analyze the plurality of peer-to-peer clients for downloaded or shared files. For example, the invention may provide for a method comprising determining whether one or more peer-to-peer clients are or have been installed on a target device by identifying information associated with one or more peer-to-peer modules, wherein each module is associated with a different one of the one or more peer-to-peer clients. The method further includes, gathering usage information for the one or more peer-to-peer clients that had been determined to be installed on the target computer, analyzing the usage information, and automatically generating a report of the analyzed usage information.

Abstract: Examples disclosed herein are directed to techniques for automatically retrieving and processing forensic data from network devices connected to a communications network without requiring device-specific knowledge or training. A mobile forensic device includes and extensible forensic analysis tool that allows on-scene forensic investigators to quickly and automatically acquire data from network devices without device-specific knowledge. The extensible forensic analysis tool is designed for use on handheld mobile computers, enabling on-scene investigators to quickly and easily acquire forensic data from network devices in the field without losing volatile data or shutting down the network.