Abstract: Described is a cyber security system for digital artifact genetic modeling and forensic analysis. The system identifies the provenance (origin) of a digital artifact by first receiving a plurality of digital artifacts, each digital artifact possessing features. Raw features are extracted from the digital artifacts. The raw features are classified into descriptive genotype-phonotype structures. Finally, lineage, heredity, and provenance of the digital artifacts are determined based on mapping of the genotype-phenotype structures.

Abstract: A controller area network (CAN) has a plurality of CAN elements including a communication bus and controllers. A method for monitoring the controller area network CAN includes identifying active and inactive controllers based upon signal communications on the communication bus and identifying a candidate fault associated with one of the CAN elements based upon the identified inactive controllers.

Abstract: The present invention is directed to a data processing apparatus and a computer implemented method for modeling and analyzing relational data represented in a network that includes a plurality of nodes and a plurality of connections between the nodes. The method includes assigning at least one weight to a connection between two nodes in the network. A set of possible dendrograms is then generated for the network, and a likelihood of each dendrogram in the set is determined. The determination of the likelihood is based on at least the one weight of the connection. One of the dendrograms from the set is selected as an optimal dendrogram based on the determined likelihood. The selected dendrogram is then output via an output device. The dendrogram may be used to predict missing links or identify any possible false-positive (noisy) links within a relational dataset.

Abstract: Described is a system for detecting insider threats in a network. In detecting the insider threat, the system receives data from the network relevant to network activity and extracts observable actions from the data relevant to a mission. The observable actions are combined to provide contextual cues and reasoning results. Based on the observable actions and reasoning results, proposed security policy updates are proposed to force insiders into using more observable actions. Finally, the system detects potential insider threats through analyzing the observable actions and reasoning results.

Abstract: Described is a system for catastrophe prediction. The system generates a time series of observables at multiple time steps from data observed from a complex system. A surrogate time series based on the time series of observables is then generated. Inferred network structures for both the time series of observables and the surrogate time series are reconstructed. Next, spatial autocorrelation for each inferred network structure in both the time series of observables and the surrogate time series is computed. A statistical test of a detected trend between the time series of observables and the surrogate time series is computed to determine if the detected trend occurred by chance. Finally, an early warning signal of the detected trend occurring by chance is generated.

Abstract: Described is a system for explosive network attack and mitigation analysis. A network structure is received as input. A network attack method that applies an Achlioptas process is selected. Then, an explosive mitigation strategy is selected. An attack-mitigation competing process is simulated for the network structure. A sequence of network structures under competing processes is generated. The effectiveness of the selected explosive mitigation strategy against the selected network attack method is quantified by analyzing the sequence of network structures under competing processes.

Abstract: Described is a system for content recognition, search, and retrieval in visual data. The system is configured to perform operations of receiving visual data as an input, processing the visual data, and extracting distinct activity-agnostic content descriptors from the visual data at each level of a hierarchical content descriptor module. The resulting content descriptors are then indexed with a hierarchical content indexing module, wherein each level of the content indexing module comprises a distinct set of indexed content descriptors. The visual data, generated content descriptors, and indexed content descriptors are then stored in a storage module. Finally, based on a content-based query by a user, the storage module is searched, and visual data containing the content of interest is retrieved and presented to the user. A method and computer program product for content recognition, search, and retrieval in visual data are also described.

Abstract: Methods and systems are provided for monitoring a vehicle. In one embodiment, the method includes, but is not limited to, receiving traffic data from a vehicle communication bus. The method further includes, but is not limited to, identifying, by a processor, net-motifs from the traffic data. The method still further includes, but is not limited to, detecting a mode of components of the vehicle based on the net-motifs.

Abstract: A system and method for identifying a monitoring point in an electrical and electronic system (EES) in a vehicle. The method includes defining a network model of the EES where potential monitoring point locations in the model are identified as targets, such as nodes. The method then computes a betweenness centrality metric for each target in the model as a summation of a ratio of a number of shortest paths between each pair of targets in the model that pass through the target whose betweenness centrality metric is being determined to a total number of shortest paths between each pair of targets. The method identifies which of the betweenness centrality metrics are greater than a threshold that defines a minimum acceptable metric and determines which of those targets meets a predetermined model coverage. The monitoring point is selected as the target that best satisfies the minimum metric and the desired coverage.

Abstract: A system and method for identifying a monitoring point in an electrical and electronic system (EES) in a vehicle. The method includes defining a network model of the EES where potential monitoring point locations in the model are identified as targets, such as nodes. The method then computes a betweenness centrality metric for each target in the model as a summation of a ratio of a total number of shortest paths between each pair of targets and a number of shortest paths that pass through the target whose betweenness centrality metric is being determined. The method identifies which of the betweenness centrality metrics are greater than a threshold that defines a minimum acceptable metric and determines which of those targets meets a predetermined model coverage. The monitoring point is selected as the target that best satisfies the minimum metric and the desired coverage.

Abstract: A method and system for a directed area search using cognitive swarm vision and cognitive Bayesian reasoning is disclosed. The system comprises a domain knowledge database, a top-down reasoning module, and a bottom-up module. The domain knowledge database is configured to store Bayesian network models comprising visual features and observables associated with various sets of entities. The top-down module is configured to receive a search goal, generate a plan of action using Bayesian network models, and partition the plan into a set of tasks/observables to be located in the imagery. The bottom-up module is configured to select relevant feature/attention models for the observables, and search the visual imagery using a cognitive swarm for the at least one observable. The system further provides for operator feedback and updating of the domain knowledge database to perform better future searches.

Abstract: A method and computer program product to capture expert knowledge and data using probabilistic models. A custom layered structure and nodes reduce the complexity of the model, allowing for representation of the model using tables. An editor is used for entry and verification of expert knowledge and data into tables and a probabilistic model is generated from the tables.