Abstract: An adaptive deception system is provided for defending a production network against cyber-attacks utilizing deception devices on the production network. The adaptive deception system includes a deception management system. The deception management system includes monitors for making observations regarding the deception devices including observations of an attacker's interaction with the deception device. The adaptive deception system further incudes a control system having sensors that receive the observations of the deception management system. The control system is configured to provide an adaption specification in response to the observations made. Actuators of the control system are activated in order to provide the adaption specification to the deception management system where monitors of the deception management system implement the specified adaption. Implementation of the adaption adapts the properties of the deception devices to interfere with the cyber-attacker.

Abstract: A system and related methods that generate encryption keys using two inputs. The first input is random data measured or supplied at the time the encryption keys are created. The second input is predetermined data held by the server and device. Given knowledge of the predetermined data and the random data, the UxS will be able to regenerate its previous encryption keys and also to re-establish communication by the server and device.

Abstract: A method for hiding information in executable code comprising: identifying a set of pairs of interchangeable instructions, wherein each pair has an instruction order of execution that is reversible without changing a functionality of the executable code; organizing the pairs into a plurality of matrices based on a set of random seeds; for each matrix, inverting a submatrix consisting of a subset of columns from each matrix to identify a subset of pairs; identifying a matrix that has full column rank on a subset of columns that is a function of the pairs' location; storing an index of the identified matrix's associated seed in a secure data storage location; and encoding data into the executable code by reversing the order of execution of the subset of pairs and treating each pair having reversed instructions as a “1” and each pair of non-reversed instructions as a “0” or vice versa.

Abstract: A method for hiding information in executable code comprising: identifying a set of pairs of interchangeable instructions, wherein each pair has an instruction order of execution that is reversible without changing a functionality of the executable code; organizing the pairs into a plurality of matrices based on a set of random seeds; for each matrix, inverting a submatrix consisting of a subset of columns from each matrix to identify a subset of pairs; identifying a matrix that has full column rank on a subset of columns that is a function of the pairs' location; storing an index of the identified matrix's associated seed in a secure data storage location; and encoding data into the executable code by reversing the order of execution of the subset of pairs and treating each pair having reversed instructions as a “1” and each pair of non-reversed instructions as a “0” or vice versa.

Abstract: An egress man-in-the-middle (MITM) system comprising: a trusted computing asset disposed in a first local subnet and connected to a computer network; and an egress MITM effector disposed in the first local subnet and configured to passively monitor incoming network traffic to the trusted computing asset, and further configured to obfuscate true information regarding the trusted computing asset to other computing assets on the computer network by transmitting, as if from the trusted computing asset, a spoofed response in answer to selected incoming network traffic, wherein the spoofed response comprises false or misleading information regarding the trusted computing asset thereby protecting the trusted computing asset from attack.

Abstract: An egress man-in-the-middle (MITM) system comprising: a trusted computing asset disposed in a first local subnet and connected to a computer network; and an egress MITM effector disposed in the first local subnet and configured to passively monitor incoming network traffic to the trusted computing asset, and further configured to obfuscate true information regarding the trusted computing asset to other computing assets on the computer network by transmitting, as if from the trusted computing asset, a spoofed response in answer to selected incoming network traffic, wherein the spoofed response comprises false or misleading information regarding the trusted computing asset thereby protecting the trusted computing asset from attack.

Abstract: A method comprising the steps of: displaying primary data having a first sensitivity level on a first display screen that is operatively coupled to a first computer; capturing an image of the first display screen with an image capture device that is operatively coupled to a second computer that is communicatively isolated from the first computer such that no data is shared between the first and second computers; executing with the second computer a display recognition and characterization algorithm to recognize the primary data based only on the captured image of the first display screen; and augmenting the primary data by displaying secondary data on a second display, wherein the secondary data is related to, and has a higher sensitivity level than, the primary data.

Abstract: A method comprising the steps of: displaying primary data having a first sensitivity level on a first display screen that is operatively coupled to a first computer; capturing an image of the first display screen with an image capture device that is operatively coupled to a second computer that is communicatively isolated from the first computer such that no data is shared between the first and second computers; executing with the second computer a display recognition and characterization algorithm to recognize the primary data based only on the captured image of the first display screen; and augmenting the primary data by displaying secondary data on a second display, wherein the secondary data is related to, and has a higher sensitivity level than, the primary data.