Abstract: Systems and methods are disclosed for determining whether a mission has occurred. The disclosed systems and methods utilize event models that represent a sequence of tasks that an entity could or must take in order to successfully complete the mission. As a specific example, an event model may represent the sequence of tasks a malicious insider may complete in order to exfiltrate sensitive information. Most event models include certain tasks that must be accomplished in order for the insider to successfully exfiltrate an organization's sensitive information. Many of the observable tasks in the attack models can be monitored using relatively little information, such as the source, time, and type of the communication. The monitored information is utilized in a traceback search through the event model for occurrences of the tasks of the event model to determine whether the mission that the event model represents occurred.

Abstract: A system comprising a plurality of nodes forming a network, the plurality of nodes comprising source nodes and destination nodes; wherein a propagation limit restricts the travel of link-state information transmitted by the sources nodes to a subset of destination nodes within the network. A network-layer protocol provided at a layer above that of the network facilitates communication between nodes within and outside of this subset of nodes.

Abstract: A system comprising a plurality of nodes forming a network, the plurality of nodes comprising source nodes and destination nodes; wherein a propagation limit restricts the travel of link-state information transmitted by the sources nodes to a subset of destination nodes within the network. A network-layer protocol provided at a layer above that of the network facilitates communication between nodes within and outside of this subset of nodes.