Abstract: Techniques are described for implementing a system that deploys and monitors training simulations and exercises across a network, and that enables the development and execution of virtual training. An example system outputs, for display in a web browser of a trainee computing system, a graphical user interface that includes one or more training exercises, and initiates execution of software agent(s) associated with skill(s) to be demonstrated by a trainee. The example system outputs, at the trainee computing system, content corresponding to scene(s) of an at least partially virtual environment for a training exercise, where the content is rendered for display at least in the web browser of the trainee computing system. After receiving interaction data collected by the software agent(s) during the training exercise, the example system determines, based on the interaction data, that the skill(s) associated with the training exercise have been demonstrated.

Abstract: Disclosed herein are embodiments for managing a task including one or more skills. A server stores a virtual environment, software agents configured to collect data generated when a user interacts with the virtual environment to perform the task, and a predictive machine learning model. The server generates virtual entities during the performance of the task, and executes the predictive machine learning model to configure the virtual entities based upon data generated when the user interacts with the virtual environment. The server generates the virtual environment and the virtual entities configured for interaction with the user during display by the client device, and receives the data collected by the software agents. The system displays a user interface at the client device to indicate a measurement of each of the skills during performance of the task. The server trains the predictive machine learning model using this measurement of skills during task performance.

Abstract: Disclosed herein are embodiments of systems, methods, and products that provide adversary detection and threat hunting. A server may comprise a user side virtual machine facing the cyber protection users, a collection virtual machine facing the at-risk network, and a data repository. The server may receive user requests requesting status data from the at-risk network via the user side virtual machine. The server may collect status data from the at-risk network via the collection virtual machine and store the collected data into the data repository. Different users may request duplicate information from the at-risk network. The server may retrieve the requested information from the data repository for duplicate requests and return the responses immediately for such requests. Because the server does not query the at-risk network for duplicate requests, the server may reduce the amount of bandwidth needed to acquire and distribute the requested information.

Abstract: A warehouse management system may receive a predictive analytics request associated with one or more warehouses and may, in response, input data associated with the one or more warehouses into a warehouse management model to determine one or more predictive analytics associated with the one or more warehouses, where the warehouse management model is trained via machine learning to determine the predictive analytics. The warehouse management system may perform simulations of operations of the one or more warehouses based on the one or more predictive analytics to determine one or more warehouse actions to meet one or more operational requirements. The warehouse management system may communicate the one or more warehouse actions to one or more devices associated with the one or more warehouses to enable the one or more devices to operate according to the one or more warehouse actions to meet the one or more operational requirements.

Abstract: Disclosed herein are embodiments for managing a task including one or more skills. A server stores a virtual environment, software agents configured to collect data generated when a user interacts with the virtual environment to perform the task, and a predictive machine learning model. The server generates virtual entities during the performance of the task, and executes the predictive machine learning model to configure the virtual entities based upon data generated when the user interacts with the virtual environment. The server generates the virtual environment and the virtual entities configured for interaction with the user during display by the client device, and receives the data collected by the software agents. The system displays a user interface at the client device to indicate a measurement of each of the skills during performance of the task. The server trains the predictive machine learning model using this measurement of skills during task performance.

Abstract: An example network security and threat assessment system is configured to determine, based on one or more events that have occurred during execution of one or more applications, a potential security vulnerability of a target computing system, where the one or more events correspond to a node represented in the hierarchical risk model. The system is further configured to identify, based on a mapping of the node represented in the hierarchical risk model to a node represented in a hierarchical game tree model, one or more actions that are associated with the potential security vulnerability and that correspond to the node represented in the hierarchical game tree model, and to output, for display in a graphical user interface, a graphical representation of the potential security vulnerability and the one or more actions associated with the potential security vulnerability.

Abstract: An attack tree model for an aviation system comprises a plurality of tree nodes organized as a tree. For each tree node of the attack tree model model, the tree node corresponds to a respective event that may befall aviation system. An analysis computing system generates one or more attack tree models for the aviation system, wherein the aviation system includes one or more systems, sub-systems, or components. The analysis computing system further performs an assessment of one or more of the system, sub-systems, or components of the aviation system using the one or more attack tree models, and outputs metrics indicative of the assessment.

Abstract: Disclosed herein are embodiments of systems, methods, and products that execute tools to identify non-malicious faults in source codes introduced by engineers and programmers. The tools may execute a machine learning model on the source codes to perform sentiment analysis and pattern analysis on information associated with the source codes to generate annotated source code files identifying anomalies based on the sentiment analysis and the pattern analysis. One or more threat levels are then identified and ranked based on the one or more anomalies and a ranked list of the one or more threat levels is displayed on a graphical user interface of a computer.

Abstract: Disclosed herein are embodiments of systems, methods, and products that provide adversary detection and threat hunting. A server may comprise a user side virtual machine facing the cyber protection users, a collection virtual machine facing the at-risk network, and a data repository. The server may receive user requests requesting status data from the at-risk network via the user side virtual machine. The server may collect status data from the at-risk network via the collection virtual machine and store the collected data into the data repository. Different users may request duplicate information from the at-risk network. The server may retrieve the requested information from the data repository for duplicate requests and return the responses immediately for such requests. Because the server does not query the at-risk network for duplicate requests, the server may reduce the amount of bandwidth needed to acquire and distribute the requested information.

Abstract: For each respective virtual machine (VM) of a plurality of VMs, a distributed computing system generates a unique Application Binary Interface (ABI) for an operating system for the respective VM, compiles a software application to use the unique ABI, and installs the operating system and the compiled software application on the respective VM. A dispatcher node dispatches, to one or more VMs of the plurality of VMs that provide a service and are in the active mode, request messages for the service. Furthermore, a first host device may determine, in response to software in the first VM invoking a system call in a manner inconsistent with the unique ABI for the operating system of the first VM, that a failover event has occurred. Responsive to the failover event, the distributed computing system fails over from the first VM to a second VM.

Abstract: Disclosed herein are embodiments for managing a virtual reality (VR) training exercise via a management server. The management server outputs a graphical dashboard including one or more skill nodes, and selects one or more software agents associated with the skill nodes. The management server provides the software agents to at least one host computing system communicatively coupled to a near-to-eye display device. The near-to-eye display device is configured to display a virtual three dimensional (3D) training environment including a plurality of interactive 3D virtual objects. The software agents are configured to collect VR observables data while the trainee performs actions within the virtual 3D training environment. Based on the VR observables data collected, the management server determines that one or more skills have been demonstrated during the training exercise, and updates the one or more skill nodes to graphically indicate the one or more skills demonstrated by the trainee.

Abstract: Disclosed herein are embodiments for managing a task including one or more skills. A server stores a virtual environment, software agents configured to collect data generated when a user interacts with the virtual environment to perform the task, and a predictive machine learning model. The server generates virtual entities during the performance of the task, and executes the predictive machine learning model to configure the virtual entities based upon data generated when the user interacts with the virtual environment. The server generates the virtual environment and the virtual entities configured for interaction with the user during display by the client device, and receives the data collected by the software agents. The system displays a user interface at the client device to indicate a measurement of each of the skills during performance of the task. The server trains the predictive machine learning model using this measurement of skills during task performance.

Abstract: An example method includes initializing, by an obfuscation computing system, communications with nodes in a distributed computing platform, the nodes including one or more compute nodes and a controller node, and performing at least one of: (a) code-level obfuscation for the distributed computing platform to obfuscate interactions between an external user computing system and the nodes, wherein performing the code-level obfuscation comprises obfuscating data associated with one or more commands provided by the user computing system and sending one or more obfuscated commands to at least one of the nodes in the distributed computing platform; or (b) system-level obfuscation for the distributed computing platform, wherein performing the system-level obfuscation comprises at least one of obfuscating system management tasks that are performed to manage the nodes or obfuscating network traffic data that is exchanged between the nodes.

Abstract: Disclosed herein are embodiments of systems, methods, and products that provide adversary detection and threat hunting. A server may comprise a user side virtual machine facing the cyber protection users, a collection virtual machine facing the at-risk network, and a data repository. The server may receive user requests requesting status data from the at-risk network via the user side virtual machine. The server may collect status data from the at-risk network via the collection virtual machine and store the collected data into the data repository. Different users may request duplicate information from the at-risk network. The server may retrieve the requested information from the data repository for duplicate requests and return the responses immediately for such requests. Because the server does not query the at-risk network for duplicate requests, the server may reduce the amount of bandwidth needed to acquire and distribute the requested information.

Abstract: An example technique includes initializing, by an obfuscation computing system, communications with nodes in a distributed computing platform. The nodes include compute nodes that provide resources in the distributed computing platform and a controller node that performs resource management of the resources. The obfuscation computing system serves as an intermediary between the controller node and the compute nodes. The technique further includes outputting an interactive user interface (UI) providing a selection between a first privilege level and a second privilege level, and performing one of: based on the selection being for the first privilege level, a first obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between a user computing system and the nodes, or based on the selection being for the second privilege level, a second obfuscation mechanism for the distributed computing platform to obfuscate digital traffic between the user computing system and the nodes.

Abstract: This disclosure provides example techniques to invoke one or more tools, with an investigative tool. The investigative tool provides a common framework that allows investigators to invoke their own trusted tools or third-party generated tools. The investigative tool described herein seamlessly and transparently invokes the tools in accordance with an investigative profile created by the investigator.

Abstract: An example method includes monitoring execution of one or more applications on a runtime computing system that includes a plurality of processing units, receiving, from the runtime computing system during execution of the applications, monitoring information that includes at least one of function call data or application programming interface call data associated with operations performed by the plurality of processing units during execution of the applications, importing the monitoring information into a risk model, analyzing the monitoring information within the risk model to determine one or more potential vulnerabilities and one or more impacts of the one or more vulnerabilities in the runtime computing system, and outputting, for display in a graphical user interface, a graphical representation of the one or more potential vulnerabilities and the one or more impacts within the risk model.

Abstract: An example method includes storing a scenario event list that defines one or more events associated with a training exercise, and configuring, based on the events defined in the scenario event list, one or more software agents to emulate one or more cyber-attacks against a host computing system during the training exercise, which includes configuring the software agents to save a state of one or more resources of the host computing system prior to emulating the cyber-attacks and to restore the state of the resources upon conclusion of the cyber-attacks. The example method further includes deploying the software agents for execution on the host computing system during the training exercise to emulate the cyber-attacks against the host computing system using one or more operational networks.

Abstract: An example network security and threat assessment system is configured to determine, based on one or more events that have occurred during execution of one or more applications, a potential security vulnerability of a target computing system, where the one or more events correspond to a node represented in the hierarchical risk model. The system is further configured to identify, based on a mapping of the node represented in the hierarchical risk model to a node represented in a hierarchical game tree model, one or more actions that are associated with the potential security vulnerability and that correspond to the node represented in the hierarchical game tree model, and to output, for display in a graphical user interface, a graphical representation of the potential security vulnerability and the one or more actions associated with the potential security vulnerability.

Abstract: For each respective virtual machine (VM) of a plurality of VMs, a distributed computing system generates a unique Application Binary Interface (ABI) for an operating system for the respective VM, compiles a software application to use the unique ABI, and installs the operating system and the compiled software application on the respective VM. A dispatcher node dispatches, to one or more VMs of the plurality of VMs that provide a service and are in the active mode, request messages for the service. Furthermore, a first host device may determine, in response to software in the first VM invoking a system call in a manner inconsistent with the unique ABI for the operating system of the first VM, that a failover event has occurred. Responsive to the failover event, the distributed computing system fails over from the first VM to a second VM.