Abstract: A threat intelligence gateway (TIG) may protect TCP/IP networks from network (e.g., Internet) threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies may be composed of packet filtering rules with packet-matching criteria derived from cyber threat intelligence (CTI) associated with Internet threats. These CTI-derived packet-filtering rules may be created offline by policy creation and management servers, which may distribute the policies to subscribing TIGs that subsequently enforce the policies on in-transit packets. Each packet filtering rule may specify a disposition that may be applied to a matching in-transit packet, such as deny/block/drop the in-transit packet or pass/allow/forward the in-transit packet, and also may specify directives that may be applied to a matching in-transit packet, such as log, capture, spoof-tcp-rst, etc.

Abstract: A packet-filtering network appliance such as a threat intelligence gateway (TIG) protects TCP/IP networks from Internet threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies are composed of packet filtering rules derived from cyber threat intelligence (CTI). Logs of rule-matching packets and their associated flows are sent to cyberanalysis applications located at security operations centers (SOCs) and operated by cyberanalysts. Some cyber threats/attacks, or incidents, are composed of many different flows occurring at a very high rate, which generates a flood of logs that may overwhelm computer, storage, network, and cyberanalysis resources, thereby compromising cyber defenses.

Abstract: An apparatus and method measures power of channels generated by a multiple-carrier transmitter that upconverts a plurality of baseband signals to a corresponding plurality of assigned carrier frequencies to generate an RF wideband signal. A measurement module's input interface receives a selected baseband signal and a corresponding assigned carrier frequency as well as the RF wideband signal. An undersampling component undersamples the RF wideband signal for a sampling interval to generate a plurality of measured aliased samples. A determination component determines a plurality of determined aliased samples based on the selected baseband signal upconverted to the corresponding assigned carrier frequency. A correlator correlates the plurality of measured aliased samples with the plurality of determined aliased samples to produce a correlation result.

Abstract: An apparatus and method measures power of channels generated by a multiple-carrier transmitter that upconverts a plurality of baseband signals to a corresponding plurality of assigned carrier frequencies to generate an RF wideband signal. A measurement module's input interface receives a selected baseband signal and a corresponding assigned carrier frequency as well as the RF wideband signal. An undersampling component undersamples the RF wideband signal for a sampling interval to generate a plurality of measured aliased samples. A determination component determines a plurality of determined aliased samples based on the selected baseband signal upconverted to the corresponding assigned carrier frequency. A correlator correlates the plurality of measured aliased samples with the plurality of determined aliased samples to produce a correlation result.