Abstract: An adaptive training system configured to implement a virtual training environment includes a control platform, which in turn includes a processor, and a non-transitory, computer readable storage medium having encoded thereon, machine instruction executable by the processor. The system further includes media devices in communication with the processor, with native sensors implemented on each of the media devices, each native sensor operating under control of a corresponding native sensor agent; and non-native sensors implemented outside the media devices, each non-native sensor operating under control of a corresponding non-native sensor agent. The machine instructions include instructions to deploy the non-native sensor agents, activate the native sensor agents, receive and process outputs from the native sensors and the non-native sensors, and adapt, in real-time, a training exercise by changing the difficulty, fidelity, and complexity of the training exercise.

Abstract: A contained radiation power metering system for measuring power of a radiation source of an additive manufacturing machine includes a base configured to fit within the additive manufacturing machine, a radiation sensor connected to the base and configured to receive radiation from the radiation source and output a radiation power signal, and a wireless module disposed on the base configured to receive the radiation power signal and transmit the radiation power signal from the system to a separate wireless receiver.

Abstract: The methods and systems disclosed herein generally relate to automated execution and evaluation of computer network training exercises, such as in a virtual environment. A server executes a first attack action by a virtual attack machine against a virtual target machine based on a cyber-attack scenario, wherein the virtual target machine is configured to be controlled by the user computer. The server receives a user response to the first attack action, determines, using a decision tree, a first proposed attack action based on the user response, and executes an artificial intelligence model to determine a second proposed attack action based on the user response. The server selects a subsequent attack action from the first proposed attack action and the second proposed attack action and executes the subsequent attack action by the virtual attack machine against the virtual target machine.

Abstract: Embodiments disclosed herein describe systems and methods for assessing vulnerabilities of embedded non-IP devices. In an illustrative embodiment, a system of assessing the vulnerabilities of embedded non-IP devices may be within a portable device. The portable device may include a plurality of wired connectors for various wired communication/data transfer protocols. The portable device may include tools for analyzing the firmware binaries of the embedded non-IP devices, such as disassemblers and modules for concrete and symbolic (concolic) execution. Based upon the disassembly and the concolic execution, the portable device may identify vulnerabilities such as buffer overflows and programming flaws in the firmware binaries.

Abstract: A method for improving efficiency of a training program begins with a processor monitoring and adapting execution of a training exercise of the training program. The processor determines a training program effectiveness measure including determining trainee skill improvement demonstrated during the training exercise, and monitoring and determining correctness and timeliness of trainee actions during the training exercise. The processor then determines a training program cost measure by determining a first monetary cost for the execution of the at least one training exercise, determining a second monetary cost associated with trainee man-hours for the training exercise, and generating the training program cost measure based on the first and second monetary costs. The processor then computes a ratio of the training program effectiveness measure to the training program cost measure.

Abstract: A method for detecting, identifying, and mitigating advanced persistent threats in a computer network having one or more computers includes a processor in the computer network: receiving a request to access a resource in the computer network; identifying the request as originating from an application executing on the computer network; executing an anomaly operation to determine a behavior of the application is one of anomalous and not anomalous; executing a privilege operation to determine the request is one of permanently allowed and not-permanently allowed; granting access to the resource for both a non-anomalous-behaving application and a permanently allowed request; and generating and displaying, on a graphical user interface of the computer network, and prompt for either an anomalous-behaving application or a not-permanently allowed request.

Abstract: Disclosed herein are embodiments of systems, methods, and products that execute tools to identify non-malicious faults in source codes introduced by engineers and programmers. The tools may execute a machine learning model on the source codes to perform sentiment analysis and pattern analysis on information associated with the source codes to generate annotated source code files identifying anomalies based on the sentiment analysis and the pattern analysis. One or more threat levels are then identified and ranked based on the one or more anomalies and a ranked list of the one or more threat levels is displayed on a graphical user interface of a computer.

Abstract: A computer-implemented adaptive group training method a computer accessing a virtual system and initiating a group training exercise for training a trainee group comprising one or more trainees, the group training exercise including one or more challenges to the virtual system, each of the one or more challenges including a pre-defined sequence of one or more injectable events; the computer controlling subsequent execution of the group training exercise comprising injecting the injectable events; and the computer evaluating performance of the trainee group during the subsequent execution of the group training exercise, including analyzing actions taken by the trainee group in response to each of the injections, and attributing one or more of the actions taken to a trainee.

Abstract: A method for improving efficiency of a training program begins with a processor monitoring and adapting execution of a training exercise of the training program. The processor determines a training program effectiveness measure including determining trainee skill improvement demonstrated during the training exercise, and monitoring and determining correctness and timeliness of trainee actions during the training exercise. The processor then determines a training program cost measure by determining a first monetary cost for the execution of the at least one training exercise, determining a second monetary cost associated with trainee manhours for the training exercise, and generating the training program cost measure based on the first and second monetary costs. The processor then computes a ratio of the training program effectiveness measure to the training program cost measure.

Abstract: The methods and systems disclosed herein generally relate to automated execution and evaluation of computer network training exercises, such as in a virtual environment. A server generates a training system having a virtual attack machine and a virtual target machine where the virtual target machine is operatively controlled by a trainee computer. The server then executes a simulated cyber-attack and monitors/collects actions and responses by the trainee. The server then executes an artificial intelligence model to evaluate the trainee's action and to identify a subsequent simulated cyber-attack (e.g., a next step to the simulated cyber-attack). The server may then train the artificial intelligence model using various machine-learning techniques using the collected data during the exercise.

Abstract: Embodiments disclosed herein describe systems and methods for assessing vulnerabilities of embedded non-IP devices. In an illustrative embodiment, a system of assessing the vulnerabilities of embedded non-IP devices may be within a portable device. The portable device may include a plurality of wired connectors for various wired communication/data transfer protocols. The portable device may include tools for analyzing the firmware binaries of the embedded non-IP devices, such as disassemblers and modules for concrete and symbolic (concolic) execution. Based upon the disassembly and the concolic execution, the portable device may identify vulnerabilities such as buffer overflows and programming flaws in the firmware binaries.

Abstract: A computer-implemented adaptive group training method a computer accessing a virtual system and initiating a group training exercise for training a trainee group comprising one or more trainees, the group training exercise including one or more challenges to the virtual system, each of the one or more challenges including a pre-defined sequence of one or more injectable events; the computer controlling subsequent execution of the group training exercise comprising injecting the injectable events; and the computer evaluating performance of the trainee group during the subsequent execution of the group training exercise, including analyzing actions taken by the trainee group in response to each of the injections, and attributing one or more of the actions taken to a trainee.

Abstract: A method for detecting, identifying, and mitigating advanced persistent threats in a computer network having one or more computers includes a processor in the computer network: receiving a request to access a resource in the computer network; identifying the request as originating from an application executing on the computer network; executing an anomaly operation to determine a behavior of the application is one of anomalous and not anomalous; executing a privilege operation to determine the request is one of permanently allowed and not-permanently allowed; granting access to the resource for both a non-anomalous-behaving application and a permanently allowed request; and generating and displaying, on a graphical user interface of the computer network, and prompt for either an anomalous-behaving application or a not-permanently allowed request.

Abstract: A computer-implemented adaptive group training method a computer accessing a virtual system and initiating a group training exercise for training a trainee group comprising one or more trainees, the group training exercise including one or more challenges to the virtual system, each of the one or more challenges including a pre-defined sequence of one or more injectable events; the computer controlling subsequent execution of the group training exercise comprising injecting the injectable events; and the computer evaluating performance of the trainee group during the subsequent execution of the group training exercise, including analyzing actions taken by the trainee group in response to each of the injections, and attributing one or more of the actions taken to a trainee.

Abstract: An intake manifold for an additive manufacturing system includes a body defining a flow channel therein. The body includes an inlet end defining an inlet configured to intake gas and/or particles from a build area of the additive manufacturing system, and an outlet end defining an outlet that is fluidly connected to the inlet through the flow channel. The outlet is configured to be in fluid communication with an uptake manifold of the additive manufacturing system. The intake manifold also includes at least one mount extending from the outlet end of the body that is configured to rotatably mount the body to the uptake manifold.

Abstract: A system for removing powder from an additively manufactured article includes a powder removal mechanism. The powder removal mechanism can include a build plate holder configured to hold a build plate at a distal end thereof. The powder removal mechanism can also include a first actuator that is configured to angle the build plate holder relative to gravity and a second actuator that is configured to rotate the build plate holder about a central axis of the build plate holder.

Abstract: A method for improving efficiency of a training program begins with a processor monitoring and adapting execution of a training exercise of the training program. The processor determines a training program effectiveness measure including determining trainee skill improvement demonstrated during the training exercise, and monitoring and determining correctness and timeliness of trainee actions during the training exercise. The processor then determines a training program cost measure by determining a first monetary cost for the execution of the at least one training exercise, determining a second monetary cost associated with trainee manhours for the training exercise, and generating the training program cost measure based on the first and second monetary costs. The processor then computes a ratio of the training program effectiveness measure to the training program cost measure.

Abstract: Disclosed herein are embodiments of systems, methods, and products that execute tools to identify non-malicious faults in source codes introduced by engineers and programmers. The tools may execute a machine learning model on the source codes to perform sentiment analysis and pattern analysis on information associated with the source codes to generate annotated source code files identifying anomalies based on the sentiment analysis and the pattern analysis. One or more threat levels are then identified and ranked based on the one or more anomalies and a ranked list of the one or more threat levels is displayed on a graphical user interface of a computer.

Abstract: An integrated adaptive learning system provides the functions of scenario development, exercise execution, exercise monitoring, exercise evaluation, exercise adaptation, and scenario feedback, which may be implemented in one or more of a scenario builder module, an exercise test module, an exercise controller module, an exercise performance monitor module, an exercise evaluation module, an exercise adaption module, and an exercise reporting and scenario feedback module. The modules, and other components of the integrated adaptive learning system may be implemented as a standalone physical training system, a training overlay to an existing physical system, and a virtual training system, or combinations thereof. In an aspect, the integrated adaptive learning system may be implemented as a physical or a virtual variable-fidelity cyber range.

Abstract: A method for detecting, identifying, and mitigating advanced persistent threats in a computer network having one or more computers includes a processor in the computer network: receiving a request to access a resource in the computer network; identifying the request as originating from an application executing on the computer network; executing an anomaly operation to determine a behavior of the application is one of anomalous and not anomalous; executing a privilege operation to determine the request is one of permanently allowed and not-permanently allowed; granting access to the resource for both a non-anomalous-behaving application and a permanently allowed request; and generating and displaying, on a graphical user interface of the computer network, and prompt for either an anomalous-behaving application or a not-permanently allowed request.