Abstract: An anomaly detection system is disclosed. In an embodiment, the anomaly detection system includes an anomaly detection module and a warning indicator module. The anomaly detection module includes one or more auto-encoders that receive sensor data from a plurality of sensors. Each of the one or more auto-encoders receives sensor data from at least three different sensors of the plurality of sensors. By receiving data output from at least three of the sensors, the auto-encoder can recognize expected inter-related patterns from the sensor output. The warning indicator module compares an output of a given auto-encoder of the plurality of auto-encoders to an input of the given auto-encoder to obtain an error value, and then compares that error value against an error threshold. In response to the error value exceeding the error threshold, the warning indicator module issues a warning signal associated with the sensor data received by the given auto-encoder.

Abstract: Techniques are provided for cyber warning. One technique includes a cyber warning receiver (CWR). The CWR includes a bus sensing circuit to sense traffic on a communications bus over time, an anomaly detecting circuit to detect anomalous behavior in the sensed bus traffic, a data fusing circuit to fuse the detected anomalous behavior into groups having similar characteristics, a decision making circuit to decide if the fused anomalous behavior is normal or abnormal, and a behavior logging circuit to log the detected anomalous behavior on an electronic storage device. In one embodiment, the CWR further includes a behavior alerting circuit to alert an operator to the fused anomalous behavior identified as abnormal. In one embodiment, the communications bus is an embedded communications bus, such as a MIL-STD-1553 bus, and the CWR is a standalone device configured to connect to the MIL-STD-1553 bus as a bus monitor.

Abstract: A Taint Modeling Function (TMF) finds abstract patterns and uses them to automate the malware detection process. TMF involves the process of statically analyzing a sequence of assembly language instructions and abstracting complex relationships among instruction inputs and outputs into a mathematical function containing a set of algebraic expressions. The set of expressions support fully automating semantic pattern detection in binary code. It deterministically generates outputs given inputs determining code block outputs, for given inputs, without executing the code. It detects code patterns automatically to spot bad coding patterns directly from the binary used to detect bugs statically in the entire application space.

Abstract: Techniques are provided for cyber warning. One technique includes a cyber warning receiver (CWR). The CWR includes a bus sensing circuit to sense traffic on a communications bus over time, an anomaly detecting circuit to detect anomalous behavior in the sensed bus traffic, a data fusing circuit to fuse the detected anomalous behavior into groups having similar characteristics, a decision making circuit to decide if the fused anomalous behavior is normal or abnormal, and a behavior logging circuit to log the detected anomalous behavior on an electronic storage device. In one embodiment, the CWR further includes a behavior alerting circuit to alert an operator to the fused anomalous behavior identified as abnormal. In one embodiment, the communications bus is an embedded communications bus, such as a MIL-STD-1553 bus, and the CWR is a standalone device configured to connect to the MIL-STD-1553 bus as a bus monitor.

Abstract: A Taint Modeling Function (TMF) finds abstract patterns and uses them to automate the malware detection process. TMF involves the process of statically analyzing a sequence of assembly language instructions and abstracting complex relationships among instruction inputs and outputs into a mathematical function containing a set of algebraic expressions. The set of expressions support fully automating semantic pattern detection in binary code. It deterministically generates outputs given inputs determining code block outputs, for given inputs, without executing the code. It detects code patterns automatically to spot bad coding patterns directly from the binary used to detect bugs statically in the entire application space.

Abstract: A method for identifying and modifying, in a VLSI chip design, wire routes within a region of wiring congestion that can be routed around that region without inducing timing violations by the insertion and proper placement of inverters. Circuits and nets are examined in the vicinity of the wiring congestion to determine those nets with high potential to drive a route outside the region. Circuit locations are analyzed to determine if the net connecting them creates a path through the region of wiring congestion. Timing slacks are derived from the timing reports for such nets and compared against a timing value representing the additional delay of using an inverter pair to drive the wire route outside the region of wiring congestion. If a net has sufficient timing slack, it is buffered with an inverter pair which is then placed in a manner as to force the wire routes for the modified path around the region of wiring congestion, thereby reducing the wire utilization within the region.

Abstract: A method for identifying and modifying, in a VLSI chip design, wire routes within a region of wiring congestion that can be routed around that region without inducing timing violations by the insertion and proper placement of inverters. Circuits and nets are examined in the vicinity of the wiring congestion to determine those nets with high potential to drive a route outside the region. Circuit locations are analyzed to determine if the net connecting them creates a path through the region of wiring congestion. Timing slacks are derived from the timing reports for such nets and compared against a timing value representing the additional delay of using an inverter pair to drive the wire route outside the region of wiring congestion. If a net has sufficient timing slack, it is buffered with an inverter pair which is then placed in a manner as to force the wire routes for the modified path around the region of wiring congestion, thereby reducing the wire utilization within the region.