WO2017127850A1 - Computer security based on artificial intelligence - Google Patents

Computer security based on artificial intelligence Download PDF

Info

Publication number
WO2017127850A1
WO2017127850A1 PCT/US2017/014699 US2017014699W WO2017127850A1 WO 2017127850 A1 WO2017127850 A1 WO 2017127850A1 US 2017014699 W US2017014699 W US 2017014699W WO 2017127850 A1 WO2017127850 A1 WO 2017127850A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
code
security
information
perception
Prior art date
Application number
PCT/US2017/014699
Other languages
English (en)
French (fr)
Inventor
Syed Kamran HASAN
Original Assignee
Hasan Syed Kamran
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US15/145,800 external-priority patent/US20160330219A1/en
Priority claimed from US15/264,744 external-priority patent/US20170076391A1/en
Priority to IL260711A priority Critical patent/IL260711B2/en
Priority to JP2018538714A priority patent/JP2019511030A/ja
Priority to AU2017210132A priority patent/AU2017210132A1/en
Priority to CA3051164A priority patent/CA3051164A1/en
Priority to IL306075A priority patent/IL306075A/en
Priority to BR112018015014A priority patent/BR112018015014A2/pt
Priority to CN202210557303.8A priority patent/CN115062297A/zh
Priority to KR1020187024400A priority patent/KR20180105688A/ko
Application filed by Hasan Syed Kamran filed Critical Hasan Syed Kamran
Priority to EP17742143.5A priority patent/EP3405911A4/en
Priority to CN201780019904.0A priority patent/CN109313687B/zh
Priority to SG11201806117TA priority patent/SG11201806117TA/en
Priority to MYPI2018702527A priority patent/MY195524A/en
Priority to MX2018009079A priority patent/MX2018009079A/es
Priority to RU2018129947A priority patent/RU2750554C2/ru
Publication of WO2017127850A1 publication Critical patent/WO2017127850A1/en
Priority to ZA2018/05385A priority patent/ZA201805385B/en
Priority to AU2022202786A priority patent/AU2022202786A1/en
Priority to JP2022121072A priority patent/JP2022141966A/ja
Priority to AU2024202003A priority patent/AU2024202003A1/en

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/564—Static detection by virus signature recognition
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/30—Creation or generation of source code
    • G06F8/31—Programming languages or programming paradigms
    • G06F8/311—Functional or applicative languages; Rewrite languages
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/30—Creation or generation of source code
    • G06F8/31—Programming languages or programming paradigms
    • G06F8/313—Logic programming, e.g. PROLOG programming language
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/02—Knowledge representation; Symbolic representation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/02—Knowledge representation; Symbolic representation
    • G06N5/022—Knowledge engineering; Knowledge acquisition
    • G06N5/025—Extracting rules from data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/04—Inference or reasoning models
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present invention Is related to a system of computer security based on artificial Intelligence.
  • Sub-systems include Critical infrastructure Protection & Retribution (CIPR) through Cioud & Tiered Information Security (CTIS), Machine Clandestine Intelligence MACINT) & Retribution through Covert Operations in Cyberspace, Logically inferred Zero-database A ⁇ priori Realtime Defense (LIZARD), Critical Thinking Memory & Perception (CTMP), Lexical Objectivity Mining ⁇ LOM ⁇ , Linear Atomic Quantum information Transfer (LAQ!T) and Universal 8CHASN Everything Connections (UBEC) system with Base Connection Harmonization Attaching
  • COSVIPUTER SECURITY SYSTEM BASED ON ARTIFICIAL INTELLIGENCE wherein the system having a memory that stores programmed instructions, a processor that is coupled to the memory and executes the programmed instructions and at least one database, wherein the system comprising a computer implemented. system of providing designated function.
  • the computer implemented system is Critical Infrastructure Protection & Retribution (CIPR) through Cloud & Tiered information Security (CTIS), further comprising:
  • Trusted Platform which comprises network of agents that report hacker activity
  • MN5P Managed Network & Security Services Provider
  • VPN virtual private network
  • AST Artificial Security Threat
  • Creativity Module which performs process of intelligently creating new hybrid forms out of prior forms
  • Conspiracy Detection which discerns information collaboration and extracts patterns of security related behavior and provides a routine background check for multiple conspiratorial security events, and attempts to determine patterns and correlations between seemingly unrelated security events;
  • CTMP Critical Thinking, Memory, Perception
  • a LIZARD Lite Client is adapted to operate in a device of the enterprise network, securely communicates with the LIZARD in the MNSP.
  • fOOOSJ Demilitarized Zone comprises a subnetwork which contains an HTTP server which has a higher security liabilit than a normal computer so that th rest of the enterprise network is not exposed to such a security liability.
  • Th i 3 GE comprises iterative Evolution, in which parallel evolutionary pathways are matured and selected, iterative generations adapt to the same Artificial Security Threats (AST), and the pathway with the best personality traits ends up resisting the security threats the most.
  • AST Artificial Security Threats
  • Syntax Module which provides a framework for reading & writing computer code
  • b) Purpose Module which uses the Syntax Module to derive a purpose from code, and outputs the purpose in its complex purpose format
  • c) Virtual Obf uscation in which the enterprise network and database is cloned in a virtual environment, and sensitive data is replaced with mock (fake) data, wherein depending on the behavior of a target, the environment can by dynamically altered in real time to include more fake elements or more real elements of the system at large;
  • Need Map Matching which is a mapped hierarchy of need & purpose and is referenced to decide if foreign code fits in the overall objective of the system
  • the Signal Mimicry uses the Syntax Module to understand a malware'' s communicative syntax with Its hackers, then hijacks such communication to give malware the false impression that it successfully sent sensitive data back to the hackers, wherei the hackers are also sent the malware's error code by LIZARD, making it look like it came from the malware;
  • the Foreign Code Rewrite builds the codeset using the derived Purpose whereby ensuring that only the desired and understood purpose of the foreign code is executed within the enterprise, and any unintended function executions do not gain access to the system.
  • Combination Method compares and matches Declared Purpose with Derived Purpose, wherein the Purpose Module is used to manipulate Complex Purpose Format, wherein with the Derived Purpose, the Need Map Matching keeps a hierarchical structure to maintain jurisdiction of all enterprises needs whereby th purpose of a block of code can be defined and justified, depending on vacancies in the jurisdictionaliy orientated Need Map, wherein Input Purpose is the intake for Recursive Debugging process, [0012J The Recursive Debugging loops through code segments to test for bugs and applies bug fixes, wherein if a bug persists, the entire code segment is replaced with the original foreign code segment, wherein the angina!
  • Need Map Matching validates the justification for the code/function to perform within the Enterprise System, wherein a master copy of the Hierarchical Map is stored on LIZARD Cloud in the MNSP, wherein Need index within the Need Map Matching is calculated by referencing the master copy, wherein then the pre-optimized Need Index is distributed among all accessible endpoint clients, wherein the Meed Map
  • Matching receives a Need Request for the most appropriate need of the system at large, wherein the corresponding output is a Complex Purpose Format that represents the appropriate need,
  • Malware Root Signature is provided to the AST so that iterations/variations of the Malware Root Signature is formed, wherein Poiymorphic Variations of malware are provided as output from ! 2 GE and transferred to Malware Detection.
  • the Malware Detection is deployed on all three levels of a computer's composition, which includes User Space, Kernel Space and Firmware/Hardware Space, wherein ail the Spaces are monitored by Lizard Lite agents.
  • the computer implemented system is Machine Clandestine intelligence (MAG NT) &
  • a CM comprises
  • Configuration and Deployment Service which comprises ars interface for deploying new enterprise network devices with predetermined security configuration and connectivity setup and for managing deployment of new user accounts;
  • Exploit Scan identifies capabilities and characteristics of criminal assets and the resulting scan results are managed by Expioit, which is a program sent by the Trusted Platform via the Retribution Exploits Database that infiltrates target criminal System, wherein the Retribution Exploits Database contains a means of exploiting criminal activities that are provided by Hardware Vendors in the forms of established backdoors and known vulnerabilities, wherein Unified Forensic Evidence Database contains compiled forensic evidence from multiple sources that spans multiple enterprises,
  • a firewall When a sleeper agent from a criminal system captures a file of an enterprise network, a firewall generates log, which is forwarded to Log Aggregation, wherein Log Aggregation separates the data categorically for Long-Term/Deep Scan and a Real-Time/Surface Scan, [0021
  • the Deep Scan contributes to and engages with Big Data whilst leveraging Conspiracy Detection sub-algorithm and Foreign Entities Management sub-algorithm; wherein standard logs from security checkpoints are aggregated and selected with Sow restriction filters at Log Aggregation; wherein Event index + ⁇ Tracking stores event details; wherein Anomaly Detection uses Event Index and Security Behavior in accordance with the intermediate data provided by the Deep Scan module to determine any potential risk events; wherein Foreign Entities Management and Conspiracy Detection are involved in analysis of events.
  • the Trusted Platform looks up an Arbitrary Computer to check if it or its server relatives/neighbors [other servers it connects to) are previously established double or triple agents for the Trusted Platform; wherein the agent lookup check is performed at Trusted Double Agent Index + Tracking Cloud and Trusted Triple Agent index + Tracking Cloud; wherein a double agent, which is trusted by the arbitrary computer, pushes an Expioit through its trusted channel, wherein the Expioit attempts to find the Sensitive File, quarantines ft, sends its exact state back to the Trusted Platform, and then attempts to secure erase it from the criminal Computer.
  • ISP API request is mad via the Trusted Platform and at Network Oversight network logs for the Arbitrary System and a potential file transfer to criminal Computer are found, wherein metadata is used to decide with significant confidence which computer the File was sent to, wherein the Network Oversight discovers the network details of criminal Computer and reroutes such information to the Trusted Platform, wherein the Trusted Platform is used to engage security APIs provided by Software and Hardware vendors to exploit any established backdoors that can aide the judicial investigation,
  • the Trusted Platform pushes a software or firmware Update to the criminal Computer to establish a new backdoor, wherein a Placebo Update is pushed to nearby similar machines to maintain stealth, wherein Target Identity Details are sent to the Trusted Platform, wherein the Trusted PSatform communicates with a Software/Firmware fylaintainer to push Placebo
  • the Backdoor Update introduces a ne backdoor into the Criminal Computer's system by the using the pre- established software update system installed on th Computer, wherein the Placebo Update omits the backdoor, wherein the Maintainor transfers the Backdoor to the target, as well as to computers which have an above average amount of exposure to the target, wherein upon implementation of the Exploit via the Backdoor Update the Sensitive File Is quarantined and copied so that its metadata usage history can be later analyzed, wherein any supplemental forensic data is gathered and sent to the exploit's point of contact at the Trusted Platform.
  • a long-term priority flag is pushed onto the Trusted Platform to monitor the criminal System for any and all changes/updates, wherein the Enterprise System submits a Target to Warrant Module, which scans ail affiliate Systems Input for any associations of the defined Target, wherein if there are any matches, the information is passed onto the Enterprise System, which defined the warrant and seeks to infiltrate the Target, wherein the input is transferred to Desired Analytical Module, which synchronizes mutually beneficial security information.
  • the computer implemented system is Logically Inferred Zero-database A-priori Realtime Defense (LIZARD), further comprising:
  • Static-Corpse which comprises predominantly fixed program modules
  • iteration Module which modifies, creates and destroys modules on Dynamic Shell, wherein the Iteration Module uses AST for a reference of security performance and uses Iteration Core to process the automatic code writing methodology;
  • the system further comprises:
  • Need Map Matching which comprises a mapped hierarchy of need and purpose that are referenced to decide if foreign code fits in the overall objective of the system;
  • Data manager which is the middleman interface between entity and data coming from outside of the virtual environment
  • the system further comprises Purpose Comparison Module, in which four different types of Purpose are compared to ensure that the entity's existenc and behavior are merited and understood by LiZARD in being productive towards the system's overall objectives.
  • the iteration Module uses the SC to syntactically modify the code base of DS according to the defined purpose in from the Data Return Relay (DRR), wherein the modified version of LiZARD is stress tested in parallel with multiple and varying security scenarios by the AST.
  • DRR Data Return Relay
  • Complex Purpose Format is a storage format for storing interconnected sub- purposes that represent an overall purpose
  • Outer Core is formed by the Syntax and Purpose modules which work together to derive a logical purpose to unknown foreign code, and to produce executable code from a stated function code goal;
  • Foreign Code is code that is unknown to UZARP and the functionality and intended purpose is unknown and the Foreign Code is the input to the inner core and Derived purpose Is the output, wherein the Derived Purpose is the intention of th given Code as estimated by the Purpose Module, wherein the Derived Purpose is returned in the Complex Purpose Format
  • the I uses AST for a reference of security performance and uses th iteration Core to process the automatic code writing methodology., wherein at the DRR data on malicious attacks and bad actors is relayed to the AST when LIZARD had to resort to making a decision with low confidence; wherein inside the Iteration Core, Differential Modifier Algorithm (DMA) receives Syntax/Purpose Programming Abilities and System Objective Guidance from the inner Core, and uses such a codeset to modify the Base iteration according to the flaws the AST 17 found; wherein Security Result Flaws are presented visually as to indicate the security threats that passed through the Base Iteration whilst running the Virtual Execution Environment.
  • DMA Differential Modifier Algorithm
  • Attack Vector acts as a symbolic demonstratio for a cybersecurity threat, wherein Direction, size, and color all correlate to hypothetical security properties like attack vector, size of malware, and type of maiware, wherein the Attack Vector symbolically bounces off of the codeset to represent the security response of the codeset;
  • Correct State represents the final result of the D A's process for yielding the desired security response from a block of code of the Dynamic Shell, wherein differences between the Current State and Correct State result in different Attack Vector responses;
  • AST provides Known Security flaws along with Correct Security Response
  • Logic Deduction Algorithm uses prior Iterations of the DS to produce a superior and better equipped Iteration of the Dynamic Shell known as Correct Security Response Program.
  • questionable Code is covertly allocated to an environment in which half of the data is intelligently mixed with mock data, wherein any subjects operating within Real System can be easily and covertly transferred to a Partially or Fully fvlock Data Environment due to Virtual Isolation; wherein Mock Data Generator uses the Real Data Synchronizer as a template for creating counterfeit & useless data; wherein perceived risk of confidence in perception of the incoming Foreign Code will influence the level of Obfuscation that LIZARD chooses; wherein High confidence in the code being malicious will invoke allocatio to an environment that contains large amounts of Mock Data; wherein Low confidence in the code being malicious can invoke either allocation to a Real System or the 100% Mock Data Environment,
  • Data Recall Tracking keeps track of a!i information uploaded from and downloaded to the Suspicious Entity; wherein in the case that fvlock Data had been sent to a legitimate enterprise entity, a callback is performed which calls back all of the Mock Data, and the Real Data is sent as a replacement; wherein a callback trigger is Implemented so that a legitimate enterprise entity will hold back on acting on certai information until there is a confirmation that the data is not fake.
  • Behavioral Analysis tracks the download and upload behavior of the Suspicious Entity to determine potential Corrective Action
  • the Real System contains the original Real Data that exists entirely outside of the virtualized environment, wherein Real Data that Replaces Mock Data is where Real data is provided unfiltered to the Data Recall Tracking whereby a Real Data Patch can be made to replace the mock data with real data on the formerly Suspicious Entity; wherein the Data Manager, which Is submerged in the Virtually Isolated Environment, receives a Real Data Patch from the Data Recall Tracking; wherein when Harmless Code has been cleared by Behavioral Analysis to bein malicious, Corrective Action is performed to replace the Mock Data In the Formerly Suspicious Entity with the Real Data that it represents; wherei Secret Token is a security string that is generated and assigned by LIZARD allows the Entity that is indeed harmless to not proceed with its job; wherein if the Toke Is Missing, this indicates the likely scenario that this legitimate entity has been accidentaily piaced in a partially Mock Data
  • Purpose Map Is a hierarchy of System Objectives which grants purpose to the entire Enterprise System, wherein the Declared, Activity and Codebase Purposes are compared to the innate system need for whatever the Suspicious Entit is allegedly doing; wherein with Activity Monitoring the suspicious entity's Storage, CPU
  • the Syntax Module understands coding syntax and reduces programming code and code activity to an intermediate Map of Interconnected Functions, wherein the Purpose Module produces the perceived Intentions of the Suspicious Entity, the outputs Codebase Purpose and Activity Purpose, wherein the Codebase Purpose contains the known purpose, function, jurisdiction and authority of Entity as derived by LIZARD'S syntactical programming capabilities, wherein the Activity Purpose contains the known purpose, function, jurisdiction and authority of Entity as understood by LIZARD'S understanding of its storage, processing and network Acti vity, wherein the Declared Purpose is the assumed purpose, function, jurisdiction, and authority of Entity as declared by the Entity itself, wherein the Needed Purpose contains the expected purpose, function, jurisdiction and authority the Enterprise System requires, wherein all the purposes are compared in the Comparison fvlodule, wherein an
  • the computer implemented system is Critical Thinking Memory & Perception ⁇ CTSVIP), The system further comprises:
  • CRSE Critical Rule Scope Extender
  • the RE comprises a checkerboard plane which is used to track the
  • the system further comprises: a) Subjective opinion decisions, which decision provided by Selected Pattern Matching Algorithm (SPMA);
  • Raw Perception Production which receives metadata logs from the SPMA, wherein the logs are parsed and a perception is formed that represents the perception of such algorithm, wherein the perception is stored in a Perception Compiex Format (PCF), and is emulated by the POE; wherei Applied Angles of Perception indicates angles of perception that have already been applied and utilised by the SPMA;
  • PCF Perception Compiex Format
  • APDM Automated Perception Discover Mechanism
  • Creativity Module which produces hybridized perceptions that are formed according to the input provided by Applied Angles of Perception whereby the perception's scope can be increased
  • SC D Self-Critical Knowledge Density
  • SPMA is Juxtaposed against the Critical Thinking performed by CTMP via perceptions and rules.
  • the system further comprises:
  • RMA Resource Management & Allocation
  • Metadata Categorization Module ⁇ MCM ⁇ in which the debugging and algorithm traces are separated Into distinct categories using synta based information categorization, wherein the categories are used to organize and produce distinct allocation responses with a correlation to risks and opportunities;
  • Metric Combination which separates angles of perception into categories of metrics
  • Metric Conversion which reverses individual metrics back into whole angles of perception
  • ME Metric Expansion
  • Comparable Variable Format Generator which converts a stream of information into Comparable Variable Format (CVF).
  • the system further comprises:
  • MR Memory Recognition
  • a Chaotic Field 613 is formed from input data
  • c Memory Concept Indexing, in which the whole concepts are individually optimized into indexes, wherein the indexes are used by the letter scanners to interact with the Chaotic Field
  • d Rule Fulfillment Parser ⁇ Rf P), which receives the individual parts of the rule with a tag of recognition, wherein each part is marked as either having been found, or not found in the Chaotic Fieid by Memory Recognition; wherein the RFF iogicaiiy deduces which whole rules, the combination of al l of their parts, have been suffidentiy recognized i n the Chaotic Fieid to merit the RE;
  • RSFS Rule Syntax Format Separation
  • RSFS Rule Syntax Format Separation
  • Metric Context Analysis which analyzes the interconnected relationships within the perceptions of metrics, wherein certain metrics can depend on others with varying degrees of magnitude, wherein this contextualization is used to supplement the mirrored interconnected relationship that rules have within the 'digital' ru!eset format;
  • Actions indicates an action that may have already been performed, will be performed, is being considered for activation, wherein Properties indicates some property-like attribute which describes something else, be it an Action, Condition or Object, wherein
  • Conditions indicates a logical operation or operator, wherein Objects indicates a target which cars have attributes applied to it;
  • RSFS RSFS Separation
  • MR Memory Recognition
  • the system further comprises:
  • Metric Statistics provides statistical information from Perception Storage, Error Management parses syntax and/or logical errors stemming from any of the individual metrics, Separate Metrics Isolates each individual metric since they used to be combined in a single unit which was the Input Perception, Node
  • Comparison Algorithm ⁇ NCA ⁇ receives the node makeup of two or more CVfs, wherein Each node of a CVF represents the degree of magnitude of a property, wherein a similarity comparison is performed on an individual node basis, and the aggregate variance is calculated, wherein a smaller variance number represents a closer match,
  • the system of claim further comprises;
  • Unfulfilled Rules are rulesets that have not been sufficiently recognized in the Chaotic Field according to their logical dependencies
  • Fulfilled Rules are rulesets that have been recognized as sufficiently available in the Chaotic Field 613 according to their logical dependencies;
  • Queue Management leverages the Syntactical Relationship
  • Seuentsal Memory Organization is an optimized information storage for " ' chains-' of sequenced information, wherein in Points of Memory Access, the width of each of the Nodes ⁇ blocks ⁇ represent the direct accessibility of the observer to the memorised object ⁇ node ⁇ , wherein with Scope of Accessibility each Setter represents its point of direct memory access to the observer, wherein a wider scope of accessibility indicates that there are more points of accessibilit per sequence node, wherein the more a sequence would be referenced only n order' and not from any randomly selected node, the more narrow the scope of accessibility ⁇ relative to sequence size, wherein with Nested Sub-Sequence Layers, a sequence that exhibits strong non-uniformity is made up of a series of smaller sub-sequences that interconnec
  • Non-Sequential Memory Organizatio deals with the information storage of nonsequential ⁇ related Items, wherein reversibility indicates a non-sequential arrangement and a uniform scope, wherein non-sequential relation is indicated by the relatively wide point of access per node, wherein the same uniformity exists when the order of the nodes is shuffled, wherein in Nucleus Topic and Associations, the same series of nodes are repeated but with a different nucleus (the center object), wherein the nucleus represents the primary topic, to which the remaining nodes act as memory neighbours to which they can be accessed easier as opposed to if there were no nucleus topic defined.
  • Memory Recognition ⁇ M scans Chaotic Field to recognize known concepts, wherein the Chaotic Field is a 'field' of concepts arbitrarily submersed in 'white noise' information, wherein Memory Concept Retention stores recognizable concepts that are ready to be indexed and referenced for field examination, wherein 3 Letter Scanner scans the Chaotic Fieid and checks against 3 letter segments that correspond to a target, wherein 5 letter Scanner scans the Chaotic Field and checks against S Setter segments that correspond to a target but this tim the segment that is checked with every advancement throughout the fieid is the entire word, wherein the Chaotic field is segmented for scanning in different proportions, wherein as the scope of the scanning decreases, the accuracy increases, wherein as the field territory of th scanner increases, a larger Setter scanner is more eff icient for performing recognitions, at the expense of accuracy, wherein Memory Concept Indexing ⁇ MCI ⁇ alternates the size of the scanner in response to their being unprocessed memory concepts left, wherein MCf 500
  • Field interpretation Logic ⁇ Fit, ⁇ operates the logistics for managing scanners of differing widths, wherein General Scope Scan begins with a large letter scan, and sifts through a large scope of field with fewer resources, at the expense of small scale accuracy, wherein Specific Scope Scan is used when an area of significance has been located, and needs to be 'zoomed in' on whereby ensuring that an expensively accurate scan isn't performed in a redundant and unyielding location, wherein receiving additional recognition of memory concepts in the Chaotic Field indicates that Field Scope contains a dense saturation of memory concepts, [0047] in Automated Perception Discovery Mechanism (APDM), Angle of Perceptions are defined in composition by multiple metrics including Scope, Type, Intensity and Consistency, which define multiple aspects of perception that compose the overall perception, wherein Creativity module produces complex variations of Perception, wherein the Perception Weight defines how much relative influence a Perception has whilst emulated by the PQE, wherein the weights of both
  • Data Batch is an Arbitrary Collectio of data that represents the data that must be represented by the node makeup of the generated CVF, wherein a sequential advancement is performed through each of the individual units defined by Data Batch, wherein the data unit is converted to a Node format, which has the same composition of information as referenced by the final CVF, wherein the converted Nodes are then temporarily stored in the Node Holdout upon checking for their existence at Stage, wherein if they are not found then they are created and updated with statistical information including occurrence and usage, wherein all the Nodes with the Holdout are assembied and pushed as modular output as a CVF.
  • Node Comparison Algorithm compares two Nod Makeups, which have been read from the raw CVF, wherein with Partial Match Mode (P ), if there is an active node in one CVF and it is not found in its comparison candidate (the node is dormant), then the comparison is not penalized, wherein wit Whole Match Mode W , If there is an active node In one CVF and it is not found in its comparison candidate (the node is dormant), then the comparison is penalized.
  • Partial Match Mode P
  • System Metadata Separation ⁇ Sfv S ⁇ separates Input System Metadata into meaningful security cause-effect relationships, wherein with Subject Scan/Assimilation, the subject/suspect of a security situation is extracted from the system metadata using premade category containers and raw analysis from the Categorization Module, wherein the subject is used as the main reference point for deriving a security response/variable relationship, wherein with Risk Scan/Assimilation, the risk factors of a security situation are extracted from the system metadata using premade category containers and raw analysis from the Categorization Module, wherein the risk is associated with the target subject which exhibits or is exposed to such risk, wherein with Response Scan/Assimilation, the response of a security situation made by the input algorithm is extracted from the system metadata using premade category containers and raw analysis from the Categorization Module, wherein the response is associated with the security subject which allegedly deserves such a response.
  • Subject Scan/Assimilation the subject/suspect of a security situation is extracted from the system
  • Security Response X represents a series of factors that contribute to the resultant security response chosen by th SPMA, wherein the initial weight is determined by the SPMA, wherei Perception Deduction (PD) uses a part of the security response and its corresponding system metadata to replicate the original perception of the security response, wherei Perception Interpretations of the Dimensional Series displays how PD will take the Security Response of the SPMA and associate the relevant input System
  • PD Perception Deduction
  • Security Response X is forwarded as input into justification/Reasoning Calculation, which determines the justification of th security response of the SPM by leveraging the intent supply of the input/Output Reduction (ICR) module, wherein the IOR moduie uses the separated input and output of the various function caiis listed in the metadata, wherein the metadata separation is performed by the MCM.
  • ICR input/Output Reduction
  • input System Metadata is the initial input that is used by Raw Perception Production (RP2) to produce perceptions in CVF, wherein with Storage Search (SS) the CVF derived f rom the data enhanced togs is used as criteria in a database iookup of the Perception Storage ⁇ PS ⁇ , wherein in Ranking, the perceptions are ordered according to their final weight, wherein the Data Enhanced Logs are applied to the perceptions to produce biock/approve recommendations, wherein the SC D tags the logs to define the expected upper scope of unknown knowledge, wherein Data Parsing does a basic interpretation of the Data Enhanced Logs and the input System Metadata to output the original Approve or Block Decision as decided by the original SPMA, wherein CT P criticizes decisions in the POE according to perceptions., and in Rule Execution (RE) according to logically defined rules,
  • RP2 Raw Perception Production
  • SS Storage Search
  • the CVF derived f rom the data enhanced togs is used as criteria in a database iookup of
  • the outer bound of the circle represents the peak of known knowledge concerning the individual metric, wherein the outer edge of the circle represents more metric complexity, whilst the center represents less metric complexity, wherein th center light grey represents the metric combination of the current batch of Applied Angles of Perception, and the outer dark grey represents metric compiexity that is stored and known by the system in general, wherein the goal of ID Is to increase the complexity of relevant metrics, so that Angles of Perception can be multiplied in compiexity and quantity, wherein the dark grey surface area represents the total scope of the current batch of Applied Angles of
  • Metric Complexity which is passed as input of Metric Conversion, which reverses individual to whole Angles of Perception whereby the final output is assembled as Implied Angles of Perception.
  • Known Data Categorization categorically separates known information from input so that an appropriate DB analogy query can be performed and separates the information into categories, wherein the separate categories individually provide input to the CVFG, which outputs the categoricai information in CVF format, which is used by Storage Search (SS) to cheek for similarities in the Known Data Scope DB, wherein each category is tagged with its relevant scope of known data according to the SS results, wherein the tagged scopes of unknow information per category are reassembled back nto the same stream of original input at the Unknown Data Combiner (UDC).
  • SS Storage Search
  • the computer implemented system is Lexical Objectivity Mining ⁇ LOivl), The system further comprises:
  • H Hierarchical Mapping
  • KV Knowledge Validation
  • h Accept Response, which is a choice given to the Human Subject to either accept the response of LOIV or to appeal it with a criticism, wherein if the response is accepted, then it is processed by KV so that it can be stored in CKR as confirmed (high confidence ⁇ knowledge, wherein should the Human Subject not accept the response, they are forwarded to the RA, which checks and criticizes the reasons of appeal given by Human;
  • fv AISP Managed Artificially Intelligent Services Provider
  • Front End Services include Artificially Intelligent Personal Assistants, Communication Applications and Protocols, Home Automation and Medical Applications, wherein Back End Services include online shopping, online transportation, Medical Prescription ordering, wherein Front End and Back End Services interact with LOW via a documented APS infrastructure, which enables standardization of information transfers and protocols, wherein LOM retrieves knowledge from external Information Sources via the Automated Research Mechanism (ARM).
  • ARM Automated Research Mechanism
  • Linguistic Construction interprets raw question/assertion Input from the Human Subject and parallel modules to produce a logical separation of linguistic syntax; wherein Concept Discovery (CD) receives points of interest within the Clarified Question/Assertion and derives associated concepts by leveraging CKR; wherein Concept Prioritization (CP) receives relevant concepts and orders them in logical tiers that represent specificity and generality; wherein Response Separation Logic (RSI) leverages the LC to understand the Human Response and associate a relevant and valid response with the initial clarification request whereby accomplishing the objective of SC; wherein the LC is then re-leveraged during the output phase to -arnend the original Question/Assertion to n lude the supplemental information received by the SC; wherein Context Construction (CC) uses metadata from Assertion Construction ⁇ AC) and evidence from the Human subject to give raw facts to CTIvlP for critical thinking; wherein Decision Comparison (DC) determines the overlap between the p re-criticized
  • LC receives the original Question /Assertion; the question is linguistieaih/ separated and SQR processes each individual word/phras at a time leveraging the CKR;
  • CKR !QR considers the potential options that are possible considering the ambiguity of the word/phrase.
  • Survey Clarification receives input from iQR, wherein the input contains series of Requested Clarifications that are to be answered by the Human Subject for an objective answer to the origi nal Question/Assertion to be reached, wherein provided response to the
  • Hierarchical Mapping f HSVl ⁇ as modular input, wherein in a parallel transfer of information H receives the Points of Interest, which are processed by its dependency module Concept Interaction ⁇ CI ⁇ , wherei CI assigns attributes to the Points of interest by accessing th indexed information at CKR, wherein upon Hlvl completing Its internal process, its final output is returned to AC after the derived concepts have been tasted for compatibility and the benefits/risks of a stance are weighed and returned.
  • Concept Interaction ⁇ CI ⁇ Concept Interaction
  • CI assigns attributes to the Points of interest by accessing th indexed information at CKR, wherein upon Hlvl completing Its internal process, its final output is returned to AC after the derived concepts have been tasted for compatibility and the benefits/risks of a stance are weighed and returned.
  • CI provides input to CCD which discerns the compatibility/conflict level between two concepts, wherein the compatibility/conflict data is forwarded to BRC, which translates the compatibilities and conflicts into benefits and risks concerning taking a holistic uniform stance on the issue, wherein the stances, along with their risk/benefit factors, are forwarded to AG as Modular Output, wherein the system contains loops of information flow indicates gradients of intelligence being gradually supplemented as th subjective nature of th question/assertion a gradually built objective response; wherein Ci receives Points of Interest and interprets each one according to the top tier of prioritized concepts,
  • Core Logic processes the converted linguistic text, and returns result, wherein if the Result is High Confidence, the result is passed onto Knowledge Validation ( Vj for proper assimilation into CKR, wherein if the Result is Low Confidence, the result is passed onto AC to continue the cycle of self-criticism, wherein Core Logic receives input from LC in the form of a Pre-Criticized Decision without linguistic elements, wherein the Decision is forwarded to CTMP as the Subjective Opinion, wherein Decision is also forwarded to Context Construction (CC ⁇ which uses metadata from AC and potential evidence from the Human Subject to give raw facts to CTiviP as input 'Objective Fact', wherein ith CTMP having received its two mandatory inputs, such information is processed to output it's best attempt of reaching 'Objective Opinion/ wherein the opinion is treated internaiiy within A as the Post-Criticized Decision, wherein both Pre-Criticized and Post-Criticized decisions are forwarded to Decision Comparison
  • U F Unit Knowledge Format
  • SF ⁇ is a set of syntactical standards for keeping track of references rules, wherei multiple units of rules within the RSF can be leveraged to describ a single object or action
  • Source attribution is a collection of complex data that keeps track of claimed sources of information
  • a UKF Cluster is composed of a chain of UKF variants finked to define jurisdictionalSy separate information
  • UKF2 contains the main targeted information
  • UKFl contains Timestamp information and hence omits the timestamp field itself to avoid an infinite regress
  • UKF3 contains Source Attribution information and hence omits the source field itself to avoid an infinite regress
  • every UKF2 must be accompanied by at least one UKFl and one UKF3, or else the clyster ⁇ sequence) is considered incomplete and the information therein cannot be processed yet by LOM Systernwide General Logic; wherei
  • PIP Personal Intelligence Profile
  • CKR is where an individual's personal information is stored via multiple potential end-points and front-ends, wherein their information is isolated from CKR, yet is available for LOfv S stem wide General Logic, wherein Personal information relating to Artificial i ntelligence a lications are encrypted a d stored in the Personal UKF Clust r Pool in UKF format, wherein with information Anonymfeation Process ⁇ IAP informatio is supplemented to CKR after being stripped of any personally identifiable information, wherein with Cross-Reference Analysis (CRA) information received Is compared to and constructed considering pre-existing knowledge from CKR.
  • CRA Cross-Reference Analysis
  • LAA Life Administration & Automation
  • ADfvl Active Decision Making
  • FARM Fund Appropriations Rules St Management
  • FARM receives human input definin criteria, limits and scope to the module to inform ADM for what it's jurisdiction of activity is, wherein cryptocurrency funds is deposited into the Digital Wallet, wherein the IoT interaction Module ⁇ ii ⁇ maintains a database of what IoT devices are available, wherein Data Feeds represents when IoT enabled devices send information to LAA.
  • the system further comprises Behavior Monitoring (BM) which monitors personally identifiable data requests from users to check for unethical and/or illegal materia!, wherein with Metadata Aggregation (MDA) user related data is aggregated from external services so that the digital identity of the user can be established, wherein such information is transferred to induction/Deduction, and eventually PCD, where a sophisticated analysis is performed with corroborating factors from the M HSP; wherein all information from the authenticated user that Is destined for P!P passes through Information Tracking (iT) and is checked against the Behavior Blacklist, wherein at Pre-trime Detection (PCD) Deduction and induction information is merged and analyzed for pre-crime conclusions, wherein PCD makes use of CTMP, which directly references the Behavior Blacklist to verify the stances produced by Induction and Deduction, wherein the Blacklist Maintenance Authority (B A) operates within the Cloud Service
  • LOM is configured to manage a personalized portfolio on an individual's l fe., wherein LQM receives an initial Question which leads to conclusion via to 's Interna! Deliberation Process, wherein it is connected to connect to the LAA mod ule wh ich connects to internet enabled devices which LOM can receive data from and control, wherein with Contextualization LOM deduces the missing links in constructing an argument, wherein LOM has deciphers with its logic that to solve the dilemma posed by the original assertion it must first know or assume certain variables about the situation.
  • the computer implemented system is Linear Atomic Quantum Information Transfer (LAQ!T).
  • LAQ!T Linear Atomic Quantum Information Transfer
  • the color sequence when structuring the 'base' layer of the alphabet, the color sequence is used with a shortened and unequal weight on the coior channel and leftover space for syntax definitions withi the color channel is reserved for future use and expansion;
  • a complex algorithm reports its log events and status reports with LAOjT, status/log reports are automatically generated, wherein the status/log reports are converted to a transportable text-based LAGS! syntax, wherein syntactically insecure information is transferred over digitally, wherein the transportable text-based syntax is converted to highly readable LAQST visual syntax ⁇ linear mode), wherein Key is optimized for human memorization and Is based on relatively short sequence of shapes; wherein locally non-secure text is entered by the sender for submission to the Recipient, wherein the text is converted to a transportable encrypted text-based LAQIT syntax, wherein syntacticaliy secure information is transferred over digitally, wherein the data is converted to a visually encrypted LAQiT syntax;
  • Incremental Recognition Effect is a channel of information transfer, and recognizes the fuil form of a unit of information before it has been fuliy delivered, wherein this effect of a predictive index is incorporated by displaying the transitions between word to word
  • Proximal Recognition Effect Is a channel of information transfer, and recognizes the full form of a unit of information whilst it is either corrupted, mixed up or changed:
  • a Block shows the 'Basse Rendering' version of linear mode and a Point displays its absence of encryption
  • Word Separator the coior of the shape represents the character that follows the word and acts as a separation between it and the next word
  • Single Viewin Zone incorporates a smaller viewing zone with larger letters and hence less information per pixel
  • Double Viewing Zone there are more active letters per pixel
  • Shade Cover makes incoming and outgoing letters dull so that the primary focus of the observer is on the viewing zone
  • the Base main character reference will specify the general of which letter is being defined, wherein a Kicker exists with the same color range as the bases, and defines the specific character exactly, wherein with Reading Direction, the information delivery reading begins on the top square of orbital ring one, wherein once an orbital ring has been completed, reading continues from the top square of the next sequential orbital ring, wherein the Entry/Exit Portals are the points of creation and destruction of a character ⁇ its base), wherein a new character, belon ing to the relevant orbital, will emerge from the porta! and slide to its position clockwise, wherein the Atomic Nucleus defines the character that follows the word;
  • each block represents an entire word (or multiple words in molecular mode) on the left side of the screen, wherein when a word is displayed, the respective block moves outwards to the right, and when that word is complete the block retreats back, wherein the color/shape of the navigation block is the same color/shape as th base of the first Setter of the word;
  • each block represents a cluster of words, wherein a cluster is the maximum amount of words that can fit on the word navigation pane;
  • Atomic State Creation is a transition that induces the Incremental Recognition Effect (IRE), wherein with such a transition Bases emerge from the Entry/Exit Portals, with their Kickers hidden, and move clockwise to assume their positions.;
  • Atomic State Expansion is a transition that induces the Proximal Recognition Effect (PRE), wherein once the Bases have reached their position, they move outwards in the 'expand' sequence of the information state presentation, which reveais the Kick
  • Redirection Bonds a bond connects two letters together and alters the flow of reading, wherein whilst beginning with the typical clockwise reading pattern, encountering a bond that launches (starts with) and Sands on fends with) le itimate/non-dud Setters will divert the reading pattern to resume on the Sanding Setter;
  • Radioactive - Elements some elements can 'rattle' which can inverse the evaluation of if a letter is a dud or not, wherein Shapes shows the shapes available for encryption, wherein Center Elements shows the center element of the orbital which defines the character that comes immediately after the word.
  • the bonds start on a 'launching' letter and end on a anding' Setter, either of which may or may not be a dud, wherein if none of them are duds, then the bond aSters the reading direction and position, wherein If one or both are duds, then the entire bond must be ignored, or else the message will be decrypted incorrectly, wherein with Bond Key Definition,, if a bond must be followed in the reading of the informations state depends on if it has been specifically defined in the encryption key.
  • Singie Cluster both neighbors are non-radioactive, hence the scope for the cluster is defined, wherein since the key specifies double clusters as being valid, the element is to be treated is if it wasn't radioactive in the first place, wherein with Double Cluster, Key Definition defines double clusters as being active, hence all other sized clusters are to be considered dormant whilst decrypting the message, wherein Incorrect Interpretation shows how the interpreter did not treat the Double Cluster as a reversed sequence (false positive),
  • the computer implemented system is Universal BCHAIN Everything Connections ⁇ USEG ⁇ system with Base Connection Harmonization Attaching Integrated Nodes.
  • the system further comprises:
  • CG Communications Gateway
  • Node Escape Index which tracks the likelihood that a node neighbor will escape a perceiving node's vicinity
  • Node Saturation Index which tracks the amount of nodes in a perceiving node's range of detection
  • Node Consistency Index which tracks the quality of nodes services as interpreted by a perceiving node, wherein a high Node Consistency index indicates that surrounding neighbor nodes tend to have more availability uptime and consistency in performance, wherein nodes that have dual pu poses in usage tend to have a lower Consistency index, wherein nodes that are dedicated to the BCHAiN network exhibit a higher value
  • Node Overlap index which tracks the amount of overlap nodes have with one another as interpreted by a perceiving node.
  • the system further comprises:
  • Customchain Recognition Module CR ⁇ which connects with Customchajns including Appertains- or Mieroc ains that have been previousl registered by the node, wherein CRM informs the rest of the BCHAiN Protocol when an updat has beers detected on an Appchain's section in the Metachairt or a Microchain's Metachaih Emulator;
  • CCD Content Claim Delivery
  • Dynamic Strategy Adaptation DSA which manages th Strategy Creation Module ⁇ SCM) ; which dynamically generates a new Strategy Deployment by using the Creativity Module to hybridize complex strategies that have been preferred by the system via Optimized Strategy Selection Algorithm (OSSA), wherein New Strategies are varied according to input provided by Field Chaos interpretation;
  • SRIA Symbiotic Recursive Intelligence Advancement
  • Figs. 1 - 26 are schematic diagrams showing Critical Infrastructure Protection 8t
  • CiPR/CTiS Cloud & Tiered Information Security
  • Figs. 1 - 2 are schematic diagrams showing how definitions for multiple angles of security interpretation are presented as a methodology for analysis
  • Fig, 3 is a schematic diagram showing Cloud based Managed Encrypted Security Servic Architecture for Secure EF (Extranet, intranet, internet ⁇ Networking;
  • Figs. 4 ⁇ 8 are schematic diagrams showing an overview of the Managed Network & Security Services Provider (MNSP);
  • Fig. 9 is a schematic diagram showing Realtime Security Processing in regards to LIZARD Cloud Based Encrypted Security-
  • Fig. 10 is a schematic diagram showing Critical infrastructure Protection St Retribution (CIPR) through Cloud & Tiered Information Security (CTIS) example in an energy system;
  • CIPR Critical infrastructure Protection St Retribution
  • CIS Cloud & Tiered Information Security
  • Fig. 11 is a schematic diagram showing stage 1— initial system intrusion
  • Fig. 12 is a schematic diagram showing stage 2 - deployment of initial Trojan horse
  • Fig. ,13 is a schematic diagram showing stage 3 - download of advanced executable malware
  • Fig. 14 is a schematic diagram showing stage 4 - compromise of intrusion defense/ prevention systems
  • Fig. 15 is a schematic diagram showing hacker desired behavior and actual security response
  • Fig. 16 is a schematic diagram showing Scheduled Internal Authentication Protocol Access ⁇ SiAPA ⁇ ;
  • Fig. 17 is a schematic diagram showing root level access and standard level access
  • Fig. 18 is a schematic diagram showing Oversight Review
  • Fig. 19 is a schematic diagram showing Iterative Intelligence' Growth / Intelligence Evolution (GE).
  • Fig. 20 is a schematic diagram showing infrastructure System
  • Fig. 21 is a schematic diagram showing criminal System, infrastructure System and Public Infrastructure
  • Fig. 22 and 23 are schematic diagrams showing how Foreign Code Rewrite syntactically reproduces foreign code from scratch to mitigate potentiaiiy undetected malicious expioits;
  • Figs. 24 and 25 are schematic diagrams showing how Recursive Debugging loops through code segments
  • Fig. 26 is a schematic diagram showing inner workings of Need Map Matching
  • Figs. 27 - 42 are schematic diagrams showing Machine Clandestine Intelligence fM&CINT) & Retribution through Covert Operations in Cyberspace; In detail:
  • Fig. 27 is a schematic diagram showing intelligent information management, viewing and control
  • Fig. 28 is a schematic diagram showing actions fay Behavioral Analysis
  • Figs. 29 and 30 are schematic diagrams showing criminal system and retribution against the criminal system
  • Figs. 31 and 32 are schematic diagrams showing flow of AC1NT
  • Fig. 33 is a schematic diagram showing M AO NT covert operations overview and how criminals exploit an enterprise system
  • Fig. 34 is a schematic diagram showing details to Long-Term/Deep Scan which uses Big
  • Fig. 35 is a schematic diagram showing how Arbitrary Computer is looked up on Trusted Piatform
  • Fig. 36 is a schematic diagram showing how known double or triple agents from the Trusted Platform are engaged to further the forensic investigation;
  • Fig. 37 is a schematic diagram showing how the Trusted Piatform is used to engage !SP
  • Fig. 3S is a schematic diagram showing how the Trusted Piatform is used to engage security APIs provided by Software and Hardware vendors to eKpioit any established backdoors;
  • Figs. 39 - 41 are schematic diagrams showing how Generic and Customizable Exploits are applied to the Arbitrary and criminal Computers;
  • Fig, 42 is a schematic diagram showing how a Song-term priority flag is pushed onto the Trusted Platform to monitor the criminal System;
  • Figs. 43 - 68 are schematic diagrams showing Logically inferred Zero-database A-priori Realtime Defense (LIZARD); in detail:
  • Figs. 43 arid 44 are schematic diagrams showing the dependency structure of LiZARD
  • Fig, 45 is a schematic diagram showing overview of LIZARD
  • Fig. 46 is a schematic diagram showing overview of the major algorithm functions concerning LIZARD
  • Fig. 47 is a schematic diagram showing the i nner workings of the Static Core (SC).
  • Fig. 48 is a schematic diagram showing how Inner Core houses the essential core functions of the system
  • Fig. 49 is a schematic diagram showing the i nner workings of the Dynamic Shell ⁇ OS ⁇ ;
  • Fig. 50 is a schematic diagram showing the Iteration Module ⁇ 1M ⁇ which intelligently modifies, creates and destroys modules on the Dynamic She!!;
  • Fig. 51 is a schematic diagram showing iteration Core which Is the main logic for iterating code for security improvements;
  • Figs, 52 - 57 are schematic diagrams showing the logical process of the Differential Modifier Algorithm (DMA);
  • Fig. 58 is a schematic diagram showing overview of Virtual Obfuscation
  • Figs. 59 - 61 are schematic diagrams showing the Monitoring and Responding aspect of Virtual Obfuscation
  • Figs. 62 and 63 are schematic diagrams showing Data Recall Tracking that keeps track of all information uploaded from and downloaded to the Suspicious Entity;
  • Fig. 64 and 65 are schematic diagrams showing the inne workings of Data Recall Trigger
  • Fig. 66 Is a schematic diagram showing Data Setection, which filters out highly sensitive data and mixes Real D t ⁇ with Mock Data- Figs, 67 and 68 are schematic diagrams showing the inner workings of Behavioral
  • Figs. 69 - 120 are schematic diagrams showing Critical Thinking Memory & Perception
  • CTMP in detail- Fig. 69 is a schematic diagram showing the main logic of CTMP
  • Fig, 70 is a schematic diagram showing Angles of Perception
  • Figs. 71— 73 are schematic diagrams showing the dependency structure of CTMP
  • Fig. 74 is a schematic diagram showing the final logic for processing intelligent information in CTMP
  • Fig. 75 is a schematic diagram showing the two main inputs of Intuitive/Perceptive and Thinking/Logical assimilating into a singie terminal output which is representative of CTMP;
  • Fig. 76 is a schematic diagram showing the scope of intelligent thinking which occurs in the original Select Pattern Matching Algorithm (SPSvIA);
  • Fig. 77 is a schematic diagram showing the conventional SPMA being juxtaposed against the Critical Thinking performed by CTMP via perceptions and rules
  • Fig. 78 is a schematic diagram showing how Correct Rules are produced in contrast with the conventional Current Rules
  • Figs, 79 and 80 are schematic diagrams showing Perception .Matching ⁇ PM ⁇ module
  • Fig, 81-85 are schematic diagrams showing Rule Syntax Derivation/Generation
  • Figs, 86 - 87 are schematic diagrams showing the workings of the Rule Syntax Format Separation ⁇ RSFS) module
  • Fig. 88 is a schematic diagram showing the workings of the Rule Fulfillment Parser (RFP);
  • Figs. 89 - 90 are schematic diagrams showing Fulfillment Debugger
  • Fig. 31 is a schematic diagram showing Rule Execution
  • Figs. 92 and 93 are schematic diagrams showing Sequential Memory Organization
  • Fig. 94 is a schematic diagram showing Non-Sequential Memory Organization
  • Figs. 95 - 97 are schematic diagrams showing Memory Recognition ⁇ MR
  • Figs. 98 - 99 are schematic diagrams showing Field interpretation Logic (F!L);
  • Figs, 100 - 101 are schematic diagrams showing Automated Perception Discovery Mechanism (APDM);
  • Fig. 102 is a schematic diagram showing Ra Perception Production (RP2)
  • Fig. 103 is a schematic diagram showing the logic flow of the Comparable Variable Format Generator ⁇ CVFG);
  • Fig, 104 is a schematic diagram showing Node Comparison Algorithm (NCA);
  • Figs. 105 and 106 are schematic dsagrams showing System Metadata Separation ⁇ SMS);
  • Figs. 107 and 10S are schematic diagrams showing Metadata Categorization Module fiVtCM).
  • Fig. 109 is a schematic diagram showing Metric Processing (MP).
  • Figs. 110 and 111 are schematic diagrams showing the internai design of Perception Deduction (PD);
  • Figs. 112 - 115 are schematic diagrams showing Perception Observer Emulator (POE);
  • Figs. 116 and 117 are schematic diagrams showing Implication Derivation ⁇ D ⁇ ;
  • Figs. IIS - 120 are schematic diagrams showing Self-Critical Knowledge Density (SC D); Figs. 121 - 165 are schematic diagrams showing Lexical Objectivity Mining (LOfvl); in detaii:
  • Fig. 121 is a schematic diagram showing the main logic for Lexical Objectivity Mining
  • Figs, 122 ⁇ 124 are schematic diagrams showing shows Managed Artificially intelligent Services Provider ⁇ AISP ⁇ ;
  • Figs, 125 - 128 are schematic diagrams showing the Dependency Structure of LOM
  • Figs. 129 and 130 are sehematlc diagrams showing the inner logic of initial Query Reasoning (IC R);
  • Fig, 131 is a schematic diagram showing Survey Clarification (SC);
  • Fig. 132 is a schematic diagram showing Assertion Construction ⁇ AC ⁇ ;
  • Figs. 133 and 134 are schematic diagrams showing the inner details of ho Hierarchical Mapping (HM) works
  • Figs, 135 and 136 are schematic diagrams showing the inner details of Rational Appea!
  • Figs. 137 and 138 are schematic diagrams showing the inner details of Central
  • Fig. 139 is a schematic diagram showing Automated Research Mechanism (ARM).
  • Fig, 140 is a schematic diagram showing Styiometric Scanning (SS);
  • Fig, 141 is a schematic diagram showing Assumptive Override System ⁇ AOS).
  • Fig. 142 is a schematic diagram showing intelligent Information & Configuration
  • Fig. 143 is a schematic diagram showing Persona! Intelligence Profile (PIP);
  • Fig, 144 is a schematic diagram showing shows Life Administration & Automation (LAA);
  • Fig. 145 is a schematic diagram showing Behavior Monitoring ⁇ 8M ⁇
  • Fig. 146 is a schematic diagram showing Ethical Privacy Legal (EPL);
  • Fig. 147 is a schematic diagram showing overview of the LIZARD a!gorithm
  • Fig. 148 is a schematic diagram showing iterative intelligence Growth
  • Figs. 149 and 150 are schematic diagrams showing Iterative Evolution
  • Figs. 151 and 154 are schematic diagrams showing Creativity Module
  • Figs. 155 and 156 are schematic diagrams showing LQM being used as a Persona! Assistant
  • Fig, 157 is a schematic diagram showing IGM being used as a Research Tool
  • Figs, 158 and 159 are schematic diagrams showing LOM exploring the merits and drawbacks of a Proposed theory- Figs, 160 and 161 are schematic diagrams showin LGM performing Po!icy Making for foreign policy war games;
  • Figs. 162 and 163 are schematic diagrams showing LQM performing investigative journalism tasks
  • Figs. 164 and 165 are schematic diagrams showing LOM performing Historical
  • Figs. 166 - 179 are schematic diagrams showing a secure and eff icient digitally-oriented language LAQIT; in detail:
  • Fig, 166 is a schematic diagram showing the concept of LAQIT
  • Fig. 167 is a schematic diagram showing major types of usable languages
  • Figs. 168 and 169 are schematic diagrams showing the Linear mode of LAQiT
  • Figs. 170 and 171 are schematic diagrams showing the characteristics of Atomic Mode
  • Figs. 172 - 174 are schemati diagram showing overview for the encryption feature of Atomic Mode
  • Figs. 175 and 176 are schematic diagrams showing the mechanism of Redirection Bonds
  • Figs. 177 and 17S are schematic diagrams showing the mechanism of Radioactive Elements
  • Fig, 179 is a schematic diagram showing Molecular Mode with Encryption and Streaming enabled
  • Figs. ISO - 184 are schematic diagrams showing a summary of the UBEC Platform and front end which connects to a decentralized information distribution system BCHAS ; in detail;
  • Fig. 180 is a schematic diagram showing a BCHAiN Node which contains and runs the BCHAIN Enabled Application
  • Fig. ,181 is a schematic diagram showing the Core Logic of the BCHA! Protocol
  • Fig. 182 is a schematic diagram showing Dynamic Strategy Adaptation (DSA) that manages Strategy Creation Module (SC );
  • Fig, 183 is a schematic diagram showing Cryptographic Digital Economic Exchange (CDEE) with a variety of Economic Personalities
  • Fig, 184 is a schematic diagram showing Symbiotic Recursive intelligence Advancement SRIA).
  • Figs. 1 - 2 show how definitions for multiple angles of security interpretation are presented as a methodology for analysis.
  • reference numeral 1 an established network of beacons and agents are used to form a map of aggressors and bad actors. When such a map/database is paired with sophisticated predictive algorithms, potential pre-crime threats emerge.
  • I 2 GE 21 leverages big data and malware signature recognition to determine the who factor.
  • Security Behavior 20 storage forms a precedent of security events, their impact, and the appropriate response. Such an appropriate response can be criticized by CTMP 22 ⁇ Critical Thinking, Memory, Perception) as a supplemental layer of security.
  • Reference Numeral 2 refers to what assets ar at risk, what potential damage can be done.
  • a Hydroelectric dam can have all of its floodgates opened which could ventually flood a nearby village and lea to loss of fife and property.
  • Infrastructure D8 3 refers to a generic database containing sensitive and norssensitive information pertaining to a public or private company involved with national infrastructure work.
  • Controls 4 potentially technical, digital, and/or mechanical means of controlling industrial inf rastructure equipment such as dam flood gates, electric wattage on the national electric grid etc.
  • S traffic patterns are analyzed to highlight times of potential blind spots. Such attacks could be easily masked to blend with and underneath legitimate traffic. The question is asked: are there are any
  • Fig, 3 shows the Cloud based Managed Encrypted Security Service Architecture for Secure El 2 (Extranet, Intranet, internet) Networking.
  • Managed Network & Security Services Provider ⁇ fvlNSP Managed Network & Security Services Provider ⁇ fvlNSP 9 provides fvianaged Encrypted Security, Connectivity & Compliance Solutions & Services to critical infrastructure industry segments: Energy, Chemical,, Nuclear, Dam, etc.
  • Trusted Platform 10 is congregation of verified companies and systems that mutually benefit from each other by sharing security information and services.
  • Hardware & Software Vendors 11 ar industry recognized manufacturers of hardware/software (i.e. Intel, Samsung, Microsoft, Symantec, Apple etc).
  • Virtual Private Network (VPN) 12 is an industry standard technology that enables secure and logistica!!y separate communication between the M SP 9, Trusted Platform, and their associated partners.
  • the Extranet allows digital elements to be virtually shared as if they were In the same local vicinity ⁇ le, LAN), Hence the combination of these two technologies promotes efficient and secure communication between partners to enhance the operation of the Trusted Platform.
  • Security Service Providers 13 is a collection of public and/or private companies that offer digital security strategies and solutions. Their solutions/products have been organized contractually so that the Trusted Platform is able to benefit from original security information ⁇ i.e. new maiware signatures) and security analysis. Such an increase in security strength in turn benef its the Security Service Providers themselves as they have access to additional security tools and information. Third Party Threat intelligence f 3PT! Feeds 14 is the mutual sharing o security information ⁇ i.e. new maiware signatures). The Trusted Platform acts as a centralized hub to send, receive and assimilate such security information.
  • Law Enforcement IS refers to the relevant Saw enforcement division whether it be state ⁇ i.e. NYPD), national ⁇ i.e. FBi), or international ⁇ i.e. INTERPOL).
  • Communication is established to receive and send security information to facilitate or accomplish retribution against criminal hackers. Such retribution typically entails locating and arresti ng the appropriate suspects and trying them in a relevant court of law,
  • Figs. 4 - 8 show an overview of the Managed Network & Security Services Provider ⁇ !V!NSP ⁇ S and internal submodufe relationships, LiZARD 16 analyzes threats in and of themselves without referencing prior historical data.
  • Artificial Security Threat ⁇ AST) 17 provides a hypothetical security scenario to test the efficacy of security ruiesets. Security threats ar consistent in severity and type in order to provide a meaningful comparison of security scenarios.
  • Creativity Module 18 performs the process of intelligently creating new hybrid forms out of prior forms, Used as a plug in module to service multiple algorithms. Conspiracy
  • Detection 19 provides a routine background check for multiple 'conspiratorial-' security events, and attempts to determine patterns and correlations between seemingly unrelated security events.
  • Security Behavior 20 Events and their security responses and traits are stored and Indexed for future queries.
  • 2 GE 21 is the big data, retrospective analysis branch of the NSP 9, Among standard signature tracking capabilities, it is able to emulate future potential variations of Mai ware by leveraging the AST with the Creativity Module.
  • CT P 22 leverages cross- references intei!igence from multiple sources (i.e. i3 ⁇ 4E ; LIZARD, Trusted Platform, etc.) and learns about expectations of perceptions and reality.
  • Management Console MC 23 is an intelligent interface for humans to monitor and control complex and semi-automated systems, intelligent Information &
  • Configuration Management (1 2 CM) 24 contains an assortment of functions that contro! the flow of information and authorized system leverage.
  • the Energ Network Exchange 25 is a large private extranet that connects Energy Suppliers, Producers, Purchasers, etc. This enables them: to exchange security information pertaining to their common industry.
  • the Energy Network Exchang then communicates via VPN/Extranet 12 to the MNSP Cloud B.
  • Such cloud communications allows for bidirectional securit analysis i that 1) Important security information data is provided from the Energy Network Exchange to the NSP cloud and 2 ⁇ important security corrective actions are provided from the MNSP cloud to the Energy Network Exchange, All El 2 (Extranet, intranet, internet) networking traffic of Energy Co, is always routed via VPN 12 to the MNSP cloud.
  • Th Intranet 26 Encrypted Layer % VPN maintains a secure internal connection within enterprise (Energy Co.) Private Networks 27. This allows th LIZARD Lite Client 43 to operate within enterprise infrastructure whilst being able to securely communicate wit LIZARD Cloud 16 the exists in the MNSP Cloud 9.
  • Reference numeral 27 represents a local node of a private network.
  • Such private networks exist offer multiple locations (labelled as Locations A, 8, and C), Different technology infrastructure setups can exist within each private network, such as a server cluster (Location C) or a shared employee's office with mobile devices and a private WiR connection ⁇ Location A), Each node of a private network has it's own Management Console ⁇ MC) 23 assigned.
  • Portable Media Devices 28 are configured to securely connect to the private network and hence by extension the intranet 26, and hence they are indirectly connected to the MNSP 9 via a secure VPN/Extranet connection 12. in using this secure connection, ai! traffic is routed via the fv SP for maxima! exposure to deployed realtime and retrospective security analysis algorithms.
  • the Demilitarized Zone (DfvIZ) 29 is a subnetwork which contains an HTTP server which has a higher security liability than a normal computer.
  • the security liability of the server is not out of security negligence, but because of the complex software and hardware makeup of a pu blic server. Because so many points of potential attack exist despite best efforts to tighten security, the server is placed in the DMZ so that the rest of the private network (Location C) is not exposed to such a security liability.
  • the HTTP server is unable to communicate with other devices inside the private network that are not inside the PfvIZ,
  • the t!ZARD Lite Client 43 is able to operate within the DMZ due to it's installation on the HTTP server.
  • An exception is made in the DMZ policy so that C 23 can access the HTTP server and hence the DMZ, Th Lite client communicates with the MNSP via the encrypted channels formed from events 12 and 26,
  • these servers are isolated in the private network yet are not submerged in the DMZ 29, This allows for Inter-communication of devices within the private network. They each have an independent instance of the LiZARD Lite Client 43 and are managed by MC 23.
  • internet 31 is referenced in relation to its being a medium of information transfer between the MNSP 9 and Enterprise Devices 28 that are running the LiZARD Lite client.
  • the internet is the most risk-prone source of security threats to the enterprise device, as opposed to a locally situation threat originating from the Local Area Network (LAN). Because of the high security risks, all information transfer on individual devices ar routed to the MNSP like a proxy. Potential bad actors from th internet will only be able to see encrypted information due to the VPN/Extranet structure 12 in place.
  • Third Party Threat Intelligence (3PTi) Feeds 32 represent custom tuned information inputs provided by third parties and in accordance with pre-existing contractual obligations, iterative Evolution 33: parallel evolutionary pathways are matured and selected, iterative generations adapt to the same Artificial Sec rity Threats (AST), and the pathway with the best personality traits ends up resisting the security threats the most.
  • Evolutionary Pathways 34 A virtually contained and isolated series of ruSeset generations. Evolutionary characteristics and criterion are defined by such Pathway Person a iity X.
  • Fig. 9 shows Realtime Security Processing In regards to LIZARD Cloud Based Encrypted Security.
  • Syntax Module 35 provides a framework for reading & writing computer code. For writing; receives a complex formatted purpose from P , then writes code in arbitrary code syntax, then a helper function can translate that arbitrary code to real executable code ⁇ depending on the desired language). For reading; provide syntactical interpretation of code for PM to derive a purpose for the functionality of such code.
  • Purpose Module 36 uses Syntax Module 35 to derive a purpose from code, & outputs suc a purpose in it's own 'complex purpose format'.
  • Signal Mimicry 3S provides a form of Retribution typically used when the analytical conclusion of Virtual Obfuscation ⁇ Protection ⁇ has been reached. Signal Mimicry uses the Syntax Module to understand a maiware's communicative syntax with it's hackers.
  • Foreign Code Rewrite 40 uses the Syntax and Purpose modules to reduce foreign code to a Complex Purpose Format, it then builds the codeset using the derived Purpose. This ensures that only the desired and understood purpose of the foreign code is executed within the enterprise, and any unintended function executions do not gain access to the system.
  • Covert Code Detection 41 detects code covertly embedded in data St transmission packets. Need Ivlap Matching 42 Is a mapped hierarchy of need & purpose and is referenced to decide if foreign code fits in the overall objective of the system.
  • LIZARD Lite Client 43 is a lightweight version of the LIZARD program which omits resource heavy functions such as Virtuai Obfuscation 208 and Signal Mimicry, !t performs instantaneous and realtime threat assessment with minimal computer resource usage by leveraging an objective a priori threat analysis that does not use a signature database for reference.
  • Logs 44 the Energy Co, System 48 has multiple points of lo creation such as standard software error/access logs, operating system logs, monitoring probes etc. These logs are then fed to Local Pattern Matching Algorithms 46 and CTMP 22 for an in dept and responsive security analysis.
  • Traffic 45 all internal and external traffic that exists in the Energy Co.
  • Local Pattern Matching Algorithms 46 consist of industry-standard softwar that offers an initial layer of security such as anti-viruses, adaptive firewalls etc. Corrective Action 47 is to be undertaken by the Local Pattern Matching Algorithm 46 that is initially understood to solve the security problem/risk, This may include blocking a port, a file transfer, an
  • the energy corporation has it's System 48 isolated from the specialized security algorithms that it sends its logs and traffic information too. This is because these algorithms, LIZARD 16, l 2 GE 21, and CTMP 22 are based in the MNSP Cloud 9. This separation occurs to offer a centralized database model, which leads to a larger pool of security data/trends and hence a more comprehensive analysis.
  • Fig. 11 the criminal System scans for an exploitable channel of entry into th target system. If possible it compromises the channel for delivering a small payload.
  • the criminal System 49 is used by the rogue criminal party to launch a malware attack to the Partner System 51 and hence eventually the Infrastructure System 54.
  • the malware source 50 is the container for the non-active form of the malicious code ⁇ malware ⁇ . Once the code eventually reaches (or attempts to reach) the targeted Infrastructure System 54, the malware is activated to perform its prescribed or on-demand malicious tasks.
  • the Partner System 51 interacts with the infrastructure system as per the contractual agreement between the Infrastructure company ⁇ Energy Co.) and the partner company. Such an agreement reflects some sort of business interest, such as a supply chain management service, or an Inventory tracking exchange.
  • the fvlalware Source 50 on behalf of the malicious party that runs the criminal System 49, attempts to find an exploit in the partner system for infiltration. This way the malware can get to it's final goal of infection which is the Infrastructure System 54. This way the partner system has been used in a proxy infection process originating for the Malware Source 50.
  • this channel 52 has been compromised by the maiware which originated from the malware source SO.
  • Channel/Protocol 53 shows a channel of communication between the Partner System 51 and the infrastructure System 54 which has not been compromised.
  • Such channels can include file system connections, database connections, email routing, VOIP connections etc.
  • Th Infrastruct e System 54 is a crucial element of Energy Co.'s operatio which has direct access to th i frastructure DB 57 and the Infrastructure controls 56,
  • An industry-standard intrusion Defense System 55 is implemented as a standard security procedure
  • the infrastructure Controls 56 are the digital interface that connects to energy related equipment. For example, this could Include the opening and closing of water flow gates in a hydroelectric dam, the angle which an array of solar panels are pointing towards etc.
  • the infrastructure database 57 contains sensitive information that pertains to the core operation of the infrastructure system and Energy Co. at large. Such information can include contact information, employee shift tracking, energy equipment documentation and blueprints etc.
  • the Compromised Channel 52 offers a very narrow window of opportunity for exploitation, hence a very simple Trojan Horse is uploaded onto the target system to expand the exploitation opportunity.
  • a Trojan Horse 58 originates from the aiware Source 50, travels through the Compromised Channel 52 and arrive at it's target the infrastructure system 54. It's purpose is to open up opportunities afforded by exploits so that the advanced executable malware payload (which is more complex and contains the actual malicious code that steals data etc.) can be installed on the target system,
  • Fig. 13 shows how after the trojan horse further exploits the system, a large executable malware package is securely uploaded onto the system via the new open channel created by the Trojan Horse.
  • the Advanced Executable fVSalware 59 is transferred to the infrastructure System 54 and hence the sensitive database 57 and controls 56.
  • the advanced executable maiware uses the digital pathway paved by the previous exploits of the trojan horse to reach it's destination,
  • FIG. 14 shows how the Advanced Executable Maiware 50 compromises the IDS so that sensitive infrastructure information and points of control can be discretely downloaded onto the criminal System undetected.
  • hacker Desired Behavior 60 the Hacker 65 has managed to get aho!d of trusted credentials of a company employee with legitimately authorized access credentials. The hacker intends on using such credentials to gain discreet and inconspicuous access to the IAN that is intended for employee usage only. Thehacker intends on out- maneuvering a typical "too tittle, too Sate" security response.
  • Behavioral Analysis 62 is performed on the hacker 65 based on the elements he interacts with that exist both on the real and virtually cloned LAN i frastructure 64.
  • Compromised Credentials 63 the hacker has obtained access credentials that grant him admin access to the Energy Co.
  • These credentials could have been compromised in the first place due to intercepting unencrypted emails, stealing an unencrypted enterprise device that has the credentials stored locally etc
  • LAN infrastructure 64 represents a series of enterprise devices that are connected via a local network (wired and/or wireless). This can include printers, servers, tablets, phones etc.
  • the entire LAN infrastructure is reconstructed virtually (virtual router !P assignment, virtual printer, virtual server etc) within the MNSP Cloud 9.
  • the hacker is then exposed to elements of both the real LAN infrastructure and the virtual clone version as the system performs behavioral analysis 62. If the result of such analysis indicates risk, then the hacker's exposure to the fake infrastructure (as opposed to the real infrastructure) is increased to mitigate the risk of real data and/or devices becoming compromised.
  • hacker 65 is a malicious actor that intends on accessing and stealing sensitive information via an initial intrusion enabled by Compromised Credentials 63. With Password Set 66, authentication access is assigned with a set of three passwords.
  • the passwords are never stored individually., and always come as a set,
  • the employee must enter a combination of the three passwords according to the temporarily assigned protocol from SIAPA, With Scheduled Internal Authentication Protocol Access ⁇ SIAPA ⁇ 67, the authentication protocol for an individual employee's login portal is altered on a weekly/monthly basis.
  • Such a protoco! can be the selection of Passwords A and C from a set of passwords A, B, and C (which have been pre- assigned for authentication).
  • the employees By scheduling the authentication alteration on a consistent basis ⁇ every Monday or first day of the month), the employees will have gotte accustomed to switching authentication protocois which will minimize false positive events (when a iegttimate employee uses the old protocol and gets stuck In a Mock Data Environment 394), To offset the risks of the new protocol being compromised by a hacker, the employee is only able to view their new protocol once before it is destroyed and unavailable for reviewing. The first and only viewing requires special muiti-factor authentication such as biometric/retina/sms to phone etc. The employee is only required to memorize one or two letters, which represent which of the three passwords he is supposed to enter.
  • Enterprise internal Oversight Department 76 comprises of an administrative committee as well as a technical command center. It Is the top layer for monitoring and approving/blocking potentially malicious behavior.
  • Employees B and D 77 are not rogue (they are exclusively loyal to the interests of the enterprise ⁇ and have been selected as qualified employees for a tri- colSaboration of the approval of a Root Level Function 80.
  • Employee A 7S has not been selected for the tri-coSiaboration process SO. This could be because he did not have sufficient work- experience with the company, technical experience, a criminal record, or he was too much of a close friend to the other employees which might have allowed for a conspiracy against the company etc.
  • Employee C ⁇ Rogue ⁇ 79 attempts to access a root level function/action to be performed for malicious purposes.
  • Root Level Function 80 cannot be performed without the consent and approval of three employees with individual root level access. All three employees are equally liable for the results of such a root level function being performed, despite Employee C being the only one with malicious intentions. This induces a culture of caution and scepticism, and heavily deters employees from malicious behavior in the first place due to foreknowledge of the procedure.
  • Employees E and F 81 have not been selected for the tri-colSaboration process 80 as they do not have root level access to perfo m nor ap rove the requested root level function in the first place.
  • Oversight Review 82 uses the time afforded by the artificial delay to review and criticize the requested action.
  • the Root Level Action 83 is delayed by 1 hour to grant the Oversight department an opportunity to review the action and explicitly approve or block the action. Policy can define a default action ⁇ approve or decline ⁇ incase the Oversight department was unable or unavailable to make a decision.
  • Oversight Review 84 determines what was the reasoning for why a unanimous decision was not achieved.
  • Referring to Root Level Action Performed 85 upon passing the collaboration and oversight monitoring system, the root level action is performed whilst securely maintaining the records for who approved what. This way, a detailed investigation can be launched if the root level action turned out to be against the best interests of the company. At reference numeral 86 the root level action has been cancelled due to the tn-collaboratson failing (unanimous decision not reached ⁇ .
  • the Malware Root Signature 91 is provided to the AST 17 so that iterations/variations of the Signature 91 can be formed.
  • Polymorphic Variations 92 of malware are provided as output from t3 ⁇ 4E and transferred to Malware Detection systems 95.
  • the infrastructure System 93 physically belongs within the infrastructure's premises. This system typically manages an infrastructure! function like a hydroelectric plant, power grid etc.
  • Infrastructure Computer 94 Is the specific computer that performs a function that enables th infrastruetural function from System 93 to be performed.
  • Malware Detection Software 95 is deployed on all three levels of the computer's composition.
  • a form of Malware 96 which has been iterated via the Evolution Pathway 34 Is found in a driver ⁇ which exists within the Kernel Space 99), User Space 97 is for mainstream developer applications. The easiest space to infiltrate with malware, yet also the easiest space to detect and quarantine malware.
  • Alt User Space activity is efficiently monitored by LIZARD Lite, Applications 98 within the User Space can include programs like Microsoft Office, Skype, Quicker! etc.
  • Kernel Space 99 that .is mostly maintained by Operating System vendors, like Apple, Microsoft, and the Linux Foundation. Harder to infiltrate than User Space, but the liability mostly belongs to the vendor unless the respective Infrastructure has undergone kernel modification. All Kernel Activity ⁇ including registry changes ⁇ Microsoft OS), memory
  • LIZARD lite LIZARD management
  • the Agent 104 is planted on Public Infrastructure and monitors known Callback Channels by engaging with their known description (port, protocol type etc.) which are stored in the Trusted Platform Database. The agent checks for Heartbeat Signals and informs the Trusted Platform to gain leverage over the Maiware Source. With Auto Discover and install Lite Client 105, the UZARD Cloud in MNSP 9 detects an endpoint system (i.e. a laptop) that Isn't providing a signal response ⁇ handshake) to UZARD. The endpoint will be synchronized upon discovery and classified through i J CM 24.
  • endpoint system i.e. a laptop
  • LIZARD Cloud detects ⁇ via an SSH remote root shell) that the Lizard Lite Ciient 43 is not installed/activated and by utilizing the root shell it forces the install of the Ciient 43 and ensures it Is properly activated.
  • the Maiware J06A initially enters because the lite Client 43 was not installed on the entr device, Lite Client 43 is installed in almost every instance possible on the system, let alone ail incoming and outgoing traffic is routed through MNSP which contains UZARD Cloud, With Initial Exploit 107 the initial entity of exploitation is detected and potentially blocked in it's entirety before it can establish a Covert Callback Channel 1068.
  • the Channel 10$B is an obscure pathway of communication for the Maiware 106B to discretely communicate with its base.
  • a wide range of Vendors 108 provide valuable resources such as covert access to software, hardware, firewalls, services, finances and critical Infrastructure to allow the planting of Agents 104 in Public Infrastructure 103.
  • the Heartbeat signal is emitted via the Callback Channel 106B at regular intervals at a specific size and frequency by the Malware and directed to it's source of origin/Soya Sty via a Covert Callback Channel,
  • the signai indicates its status/capabilities to enable the Malware Source 50 to decide on future exploits and co-ordinated attacks.
  • Such a Malware Source represents an organization that has hacking capabilities with malicious, intent; whether that be a black-hat hacking syndicate or a nation-state government.
  • the Malware 106A and Heartbeat Signal ⁇ Inside Channel 1068 is detected by LIZARD running in the fvlMSP Cloud 9 as ail incoming and outgoing traffic is routed throug MNSP cSoud/tijard via a VPN tunnel.
  • Figs. 22 - 23 show how Foreign Code Rewrite syntactically reproduces foreign code from scratch to mitigate potentially undetected malicious exploits.
  • Combination Method 113 compares and matches the Declared Purpose 112A ⁇ If available , , might be optional according to Enterprise Policy 147) with Derived Purpose 1128, Uses Purpose Module 36 to manipulate Complex Purpose Format and achieves a resultant match or mismatch case scenario.
  • Derived Purpose 1128 Need Map Matching keep's a hierarchical structure to maintain jurisdiction of all enterprises needs. Hence the purpose of a block of code can be defined and justified, depending on vacancies in the jurisdictionaliy orientated Need Map 114.
  • Purpose 115 is the intake for the Recursive Debugging 119 process ⁇ which leverages Purpose & Syntax Module). Does not merge multiple intakes ⁇ i.e. purposes), a separate and parallel instance is initialized per purpose input.
  • Final Security Check 116 leverages the Syntax 35 and Purpose 36 Modules to do a multi-purpose 'sanity' check to guard any points of exploitation in the programming and transfers the Final Output 117 to the VPN/Extranet 12.
  • Figs, 24 - 25 show how Recursive Debugging 119 loops through code segments to test for bugs and Applies bug fixes 129 (solutions) where possible, !f a bug persists, the entire code segment is Replaced 123 with the original ⁇ foreign ⁇ Code Segment 121.
  • the original code segment is subsequently tagged for facilitating additional security layers such as Virtual Obfuscation and Behavioral Analysis.
  • Foreign Code 120 the original state of the code is Interpreted by the Purpose 36 and Syntax 35 Modules for a code rewrite.
  • the Foreign Code 120 is directly referenced by the debugger in case arc original (foreign) code segment needs to be installed because there was a permanent bug in the rewritten version.
  • Rewritten Code 122 Segments 121 are tested by the Virtual Runtime Environment 131 to check for Coding Bugs 132.
  • Such an Environment 131 executes Code Segments 121, like functions and classes, and checks for runtime errors (syntax errors, buffer overflow, wrong function call etc.). Any coding errors are processed for fixing. With Coding Bug 132, errors produced In the Virtual Runtime
  • Coding Bug 132 will receive a Coding Solution 138 multiple times in a loop, if ail Coding Solutions have been exhausted with resolving the 8ug 132; a solution is Forfeited 137 and the Original Foreign Code Segment 133 is used.
  • a Code Segment 121 can be Tagged 136 as foreign to facilitate the the decision of additional security measures such as Virtual Obfuscation and Behavioral Analysis, For example, if a Rewritten block of code contains a high degree of foreign code segments, it is more prone to being placed in a Mock Data Environment 394.
  • Code Segment Caching 130 Individual Code Segments ⁇ fuftctions cSasses ⁇ are cached and reused across multiple rewrite operations to increase LiZARD Cloud resource efficiency. This cache is highly leveraged since all traffic is centralized via VPN at the cloud.
  • Fig. 26 shows the inner workings of Need Map Matching 114, which verifies purpose jurisdiction, LIZARD Cloud and Lite reference a Hierarchical Map 150 of enterprise jurisdiction branches. This is done to justify code/function purpose, and potentially block such
  • Need Map Matching 114 validates the justification for the code/function to perform within the Enterprise System.
  • the master copy of the Hierarchical Ma 150 is stored on LIZARD Cloud in the fvlNSP 9, on the account of the respective registered enterprise.
  • the Need Index 145 within Need Map Matching 114 is calculated by referencing the master copy. Then the pre-optimized Need Index ⁇ and not the hierarchy itseif) is distributed among all accessible endpoint clients. Need Map Matching receives a Need Request 140 for the most appropriate need of the system at large.
  • the corresponding output is a Complex Purpose Format 325 that represents the appropriate need.
  • Need Map matching approved the request for HR to downloa all the employee CVs, became it is time for an annual review of employee performance according to their capabilities.
  • Initial Parsing 148 each jurisdiction branch is downloaded for need referencing.
  • Calculate Branch Needs 149 Needs are associated with their corresponding department according to the definitions associated with each branch. This way ? permission checks can be performed.
  • Need Map matching approved the request for HR to download all the employee CVs, because it is time for an annual review of employee
  • Fig. 27 shows intelligent information management, viewing and control.
  • Aggregation 152 uses generic level criteria to filter out unimportant and redundant information, whilst merging and tagging streams of information from multiple platforms.
  • Depbyment Service 153 is an interface for deploying new enterprise assets ⁇ computers, laptops, mobi!e phones) with the correct security configuration and connectivity setup. After a device is added and setup, they can be tweaked via the Management Console with the Management Feedback Controls as a middleman.
  • This service aiso manages the deployment of new customer/client user accounts. Such a deployment may include the association of hardware with user accounts, customization of interface, listing of customer/client variables ⁇ i.e. busi ness type, product type etc.).
  • the tagged pooi of information are separated exclusively according to the relevant jurisdiction of the iVlanagement Console User.
  • Threat 1S5 the information is organized according to individual threats.
  • Intelligent ContextuaSization 156 Every type of data is either correlated to a threat (which adds verbosity) or is removed.
  • Intelligent ContextuaSization 156 the remaining data now !ooks like a cluster of islands, each island being a cybersecu ' rity threat. Correlations are made inter-piafforrrs to mature the security analysis.
  • Historical data is accessed (from S3 ⁇ 4E 21 as opposed to LIZARD 16) to understand: threat patterns, and CT P is used for critical thinking analysts.
  • Threat Dilemma Management 157 the cyfaersecurity threat is perceived from a bird's eye view ⁇ big picture). Such a threat is passed onto the management console for a graphical representation.
  • Automated Controls 158 represent algorithm access to controlling management related controls of MNSP 9, TP, 3PS.
  • Management Feedback Controls 159 offers high level controls of all MNSP Cloud, Trusted Platform 10 additional Third Party Services ⁇ BPS ⁇ based services which can be used to facilitate policy making, forensics, threat investigations etc. Such management controls are eventually manifested on the Management Console ⁇ MC), with appropriate customizable visuals and presentation efficiency. This allows for efficient control and manipulation of entire systems (MNSP, TP, 3PS) direct from a single interface that can zoom into details as needed.
  • Manual Controls 160 represent human access to controlling
  • Direct Management 161 levera es manual controls to provide human interface.
  • Category and Jurisdiction 162 the user of the
  • Management Console uses their login credentials which define thei r jurisdiction and scope of Information category access. All Potential Data Vectors 163 are data in motion, data at rest & data in use. Customizable Visuals 164 is for use by various enterprise departments ⁇ accounting, finance, HR, IT. legal, Security/inspector General, privacy/disciosure, union, etc.) and
  • Unified view on ail aspects of security 165 is a collection of visuals that represent perimeter, enterprise, data center, cloud, removable media, mobile devices, etc.
  • Cybersecunty Team 167 is a team of qualified professionals monitor the activity and status of multiple systems across the board. Because intelligent processing of information and A!
  • the Team's primary purpose is for being a fallback layer In verifying that the system is maturing and progressing according to desired criteria whilst performing large scale points of analysis.
  • Behavioral Anaiysis 168 observes the malware's 169 state of being and actions performed whilst it is in the 100% Mock Data Environment 394. Whilst the malware Is interacting with the Fake Data 170, Behavioral Analysis will record patterns observed in activation times (i.e. active only on Sunday's when the office is closed), file access requests, root admin functions requested etc.
  • the Malware 169 has been planted by the hacker 177.
  • the Signal Mimicry functionality of MNSP 9 can emulate a program that behaves iike the hacker 177. This includes the protocol of communication that exists between the Real Maiware 169, the Fake Data 170, and the Fake Hacker 174, With Emulated Signal Response 175, the virtuaiized Fakehacker 174 sends a response signal to the real Maiware 169 to either give it the impression that it has succeeded or failed in its Job.
  • Such a signal could include commands for Ma!ware behavior and/or requests for informational status updates. This is don to further behavioral analysis research, to observe the malwafe's next behavior pattern.
  • the Mock Data Environment 394 with the maiware in it can either be frozen or destroyed.
  • Emulated Response Code 176 the hacker is given a fake response code that is not correlated with the behavior/state of the real maiware.
  • a fake error code or a fake success code can be sent, A fake error code would give the hacker the impression that the maiware is not working ⁇ when In reality it does) and would waste the hacker's time on useless debugging tangents.
  • a success error code would decrease the likelihood that the hacker would divert attention to making a new form of maiware, but instead focus on the current one and any possible incremental Improvements. Since such maiware will have already been compromised and understood by LIZARD, the hacker is wastin energy on a compromised maiware thinking it is succeeding. The hacker 177 still believes that the maiware he planted has successfully infiltrated the target system. In reality the maiware has been isolated within a virtuaiized environment. That same virtuaiized environment has enacted Behavioral Analysis 168 on the maiware to emulate the method and syntax of communication it has with the hacke (whether bi-di ection l or omnidirectional).
  • criminal Assets 178 represents the investments mades via criminal Finances 184 to facilitate the hacking and malicious operations of criminal System 49. Such Assets 178 are typicaily manifested as computing power and internet connectivity as having a strong investment in these two assets enables more advanced and elaborate hacking performances.
  • Criminal Code 179 an exploit scan Is performed by the Trusted Platform's agent, to gather as much forensic evidence as possible.
  • criminal Computer 180 a CPU exploit is performed which overflows the CPU with AVX instructions. This leads to increased heat, increased electricity consumption, more CPU degradation, and less available processing power for criminal processes.
  • An Exploit Scan 181 of the criminal Assets 178 are performed to identify their capabilities and characteristics.
  • the resulting scan results are managed by the Exploit 185 and forwarded to the Trusted Platform 10,
  • the Exploit 185 is a program sent by the Trusted Platform via the Retribution Exploits Databas 187 that infiltrates the target criminal System 49, as enumerated in MAC! NT Figs, 27 - 44, Electric and Cooling expenditures increase significantly which puts a drain on criminal Finances 184. Shutting down the computers will severely hamper the criminal operations. Purchasing new computers would put more strain on criminal Finances, and such new computers are prone to being exploited like the old ones,.
  • Retribution Exploits Database 187 contains a means of exploiting criminal activities that are provided by Hardware Vendors 186 in the forms of established backdoors and known vulnerabilities.
  • the Unified Forensic Evidence Database 188 contains compiled forensic evidence from multiple sources that spans multiple enterprises. This way the strongest possible legal case is built against the criminal Enterprise, to be presented in a relevant court of law.
  • Target Selection 189 a target is only selected for retribution after adequate forensic evidence has been established against it. This may inciude a minimum time requirement for the forensic case to be pending for review by oversight (i.e. 6 months), Evidence must be highly self-corroborating, and isolated events cannot be used to enact retribution out of fear of attacking an innocent target and incurring legal repercussions.
  • Target Verification 190 suspected criminal systems are verified using multiple methods to surpass any potential methods of covertness ⁇ public cafe, TOR Network etc), including:
  • GPS ca be taken advantage of.
  • Cloud services ca aide in corroboration * e. Longterm precedent for Dropbox sign-in location
  • Fig. 33 shows IvlAC! T covert operations overview, how criminals exploit an enterprise system.
  • Enterprise System 228 defines the entire scope and jurisdiction of the enterprise's infrastructure and property.
  • Enterprise Computer 227 is a crucial part of Enterprise System 22$ as is contains Sensitive information 214 and depends on Enterprise Network 219 for it's typicaiiy scheduled tasks.
  • Sleeper Double Agent 215 is malicious software the stays dormant and 'sleeps' on the target Computer 227.
  • the Captured Fiie 214 is passed onto the network infrastructure of Enterprise Network 219 in an attempt to leave the Enterprise System 228 and enter the Arbitrary System 262 and eventually the criminal System 49.
  • a network infrastructure is represented as LAN Router 217 and Firewall 218, which are the last obstacles for the maiware to pass through before being able to transport the Captured File 214 outside of the Enterprise System.
  • Real-Time 222 is inadequately prepared to perform a near instant recognition of the malicious activit to stop it before execution.
  • the Long-Term Scan 221 eventually recognises the malicious behavior because of its advantage of having more time to analyze. The luxury of time allows Long-Term 221 to perform a more thorough search with more complex algorithms and points of data.
  • Sotnet Compromised Sector 225 a computer belonging to the system of an arbitrary third party is used to transfer the Sensitive File 22S to throw off the investigation and frame the arbitrary third party.
  • Thieves receive Sensitive File 226 at criminal Computer 229 whilst maintaining a hidden presence via their Botnet and proceed to use the File for illegal extortion and profit. Potential traces left of the identity (i.e. IP address) of criminal Computer are may onfy be left at Arbitrary Computer 238, which the administrators and investigators of Enterprise System 228 do not have access to.
  • Fig. 34 shows more details to the Long-Term/Deep Scan 230 which uses Big Data 231. Deep Scan 230 contributes to and engages with Big Data 231 whilst leveraging two sub- algorithms, 'Conspiracy Detection' and 'Foreign Entities Management'. The intermediate results are pushed to Anomaly Detection which are responsible for the final results. Standard logs f rom security checkpoints, like firewalls and centra! servers, are aggregated and selected with low restri tion .filters ' at Log Aggregation 220, With Event index + Tracking 235 event details are stored, such as IP address, MAC address, Vendor ID, Serial Number, times, dates, DNS etc.
  • Arbitrary Computer 238 is shown as the resultant Destination server involved in the breach is highlighted, defined by any known characteristics such as MAC Address/last known SP address 239, country and uptime patterns etc.
  • Such an analysis tendsiy involves the Foreign Entities Management 232 moduie. The system is then able to determine the iikeiihood 240 of such a computer being invoived in a botnet.
  • Such an analysis primarily involves Conspiracy Detection 19,
  • [0O95J Fig, 35 shows how the Arbitrary Computer is looked up on the Trusted Platform 10 to check if It or its server relatives/neighbors (other servers it connects to) are previously established double of triple agents for the Trusted Platform 10.
  • Stage 242 represents how known information of th Arbitrary Computer 238 such as MAC Address/iP Address 239 are sent for querying at Event Index + Tracki g 235 and the c oud version 232, Such a cloud versio that operates from the Trusted Platform 10 tracks event details to identify future threats and threat patterns, i.e. MAC address, IP address, timestamps for access etc. The results from such querying 242 are sent to Systems Collection Details 243.
  • Such details include; the original Arbitrary Compute 238 details, computers/systems that receive and/or send packets regularly to Computer 238, and systems that are in physically close proximity to Computer 238. Such details are then forwarded to Stages 246 and 247 which checks if any of the mentioned computers/systems happen to Double Agents 247 or Triple Agents 246. Such an agent lookup check is performed at the Trusted Double Agent index + Tracking Cloud 244 and the Trusted Triple Agent Index + Tracking Cloud 245.
  • the Double Agent I ndex 244 contains a l ist of systems that have sleeper agents installed that are controlled by the Trusted Platform and it's affiliates.
  • the Triple Agent Index 245 contains a list of systems that have been compromised by criminal syndicates (i.e. botnets), but have also been compromised by the Trusted Platform 10 in a discret manner, as to monitor malicious activities and developments. These two clouds then output their results which are gathered at List of Active and Relevant Agents 248.
  • Fig. 36 shows how known double o triple agents from the Trusted Platform 10 are engaged to further the forensic investigation. Being transferred from the list of Agents 248; an appropriate Sleeper Agent 252 is activated 249.
  • the Double Agent Computer 251 which is trusted by the Arbitrary Computer 233, pushes an Exploit 253 through its trusted channel 254.
  • the Exploit 253 tracks the activity of the Sensitive File 241 and learns that it was sent to what is now known to be the criminal Computer 229. It follows the same path that was used to transfer the File 241 the first time 216 at channel 255, and attempts to establish itself on the Crimina! Computer 229.
  • the Exploit 253 attempts to find the Sensitive File 241, quarantines it, sends its exact state back to the Trusted Platform 10, and then attempts to secure erase it from the criminal Computer 229, The Trusted Platform 10 then forwards the quarantined file back to the original Enterprise System 228 (who own the original file ⁇ for forensic purposes, it is not always guaranteed that the Exploit 253 wa able to retrieve the Sensitive File 241, but at the least it is abie to forward identifiable information 239 about the criminal Computer 229 and System 49.
  • Fig, 37 shows how the Trusted Platform 10 Is used to engage ISP ⁇ I ternet Service Provider) 257 APIs concerning the Arbitrary Computer 238. Network Oversight 261 is used to try and compromise the Arbitrary System 262 to further the judicial investigation, The
  • Enterprise System 228 only knows limited, information 259 about the Arbitrary Computer 238, and is seeking information about the criminal Computer 229 and System 49, An ISP 257 API request is made via the Trusted Piatform 10.
  • Network Oversight 261 system network logs for the Arbitrary System 262 are found, and a potential file transfer to (what is later recognised as) the Crimina! Computer 229. The log history isn't detailed enough to have recorded the exact and entire composition of the Sensitive File 241, but is able to use metadata 260 to decide with significant confidence which compute the file was sent to.
  • Network Oversight 261 discovers the network details 258 of criminal Computer 229 and so reroutes such information to the Trusted Platform 10 which in turn informs the Enterprise System 22S.
  • FIG. 38 shows how the Trusted Piatform 10 is used to engage security APIs provided by Software 268 and Hardware 272 vendors to exploit any established backdoors that ca aide th judicial i vestigation.
  • known identity details of criminal Computer 229 are transferred to the Trusted Platform 10 to engage in backdoor APIs. Such details may include MAC address/IP address 239 and Suspected Software + Hardware of Crimina! Computer, Then the Trusted Platform 10 delivers an Exploit 253 to the affiliated Software 268 and Hardware 272 Vendors in a dormant state (the exploitation code is transferred yet not executed).
  • A!so delivered to the vendors is the Suspected Software 269 and Hardware 273 of the Criminal Computer 229 as suspected by the Enterprise System 228 at Stage 263.
  • the vendors maintain a List of Established Software 270 and Hardware 274 backdoors, including such information as to how to invoke them, what measures of authorizations need to be taken, and what are their capabilities and limitations. All such backdoors are internally isolated and confidential from within the vendor, hence Trusted Platform does not receive sensitive information dealing with such backdoors yet provides the Exploit 253 that would benefit f rom them.
  • the Sensitive File 241 is quarantined and copied so that its metadata usage history can be later analyzed.
  • Any remaining copies on the criminal Computer 229 are then securely erased. Any other possible supplemental forensic evidences are gathered. Ail such forensic data is returned to the Exploit's 253 point of contact at the Trusted Platform 10. Thereafter the Forensic Evidence 265 is forward to the Enterprise System 228 which includes the Sensitive Fife 241 as found on the Criminal Computer 229, and Identity Details of those involved with the criminal System that have evidence against them concerning the initial theft of the Fife 241, This way the Enterprise System 228 can restore the File 241 if it was deleted from their system during the initial theft, and the identity Details 264 will enable them to seek retribution in terms of legal damages and disabling criminal System 49 Botnet to mitigate the risk of future attacks.
  • Fig. 39 - 41 shows how Generic 2S2 and Customizable 283 Exploits are applied to the Arbitrary 238 and criminal 229 Computers in the attempt to perform direct compromise without the direct aide of the Trusted Platform 10.
  • Generic Exploits 282 is a collection of software, firmware and hardware exploits organized and assembled by the Enterprise System 2S0 via independent cybersecurity research. With Exploit Customization 283 exploits are customized according to known information about the target. Exploits 253 are delivered with the most likely to succeed first, and with the least likely to succeed last. A collection of available information 284 concerning the criminal Computer 229 is transferred to Customization 283. Such information includes any known computer information such as MAC Address/IP Address 239 and Suspected Software + Hardware 285 being used by the criminal Computer 229.
  • Proxy Management 286 is the combination of an algorithm and a database that intelligently selects proxies to be used for the exploitation attempt.
  • Proxy Network 279 is a series of Proxy Nodes 278 which allow any separate system to mask their originating identity. The Node passes on such digital communication and becomes the apparent originator. Nodes ar intelligently selected by Proxy Management 286 according to overall performance of a Node, availability of a Node, and current workload of a Node, Three potential points of exploitation of the criminal Computer 229 and/or Arbitrary Compute 238 are tried.
  • the Botnet Tunnel 276 is the established means of communication used between the Criminal Computer 229 and the active part of the Botnet 240. Any forensic data that is generated by the Exploit 253 is sent to the Enterprise System 228 at Stage 275.
  • Fig, 41 shows how a special API with the Trusted Platform 10 is used to push a software o firmware U date 289 to the criminal Computer 229 to establish a new backdoor.
  • a Piacebo Update 288 is pushed to nearby similar machines to maintain stealth.
  • the Enterprise System 228 sends the Target identity Details 297 to the Trusted Platform 10. Such details include ivlAC Address/IP Address 239. Trusted Platform 10 communicates with a Software/Firmware
  • a Backdoor Update introduces a new backdoor into the criminal Computer's 229 system by the using the pre-established software update system installed on th Computer. Such an update could be for the operating system, th BIOS ⁇ firmware),, a specific software like a word processor.
  • the Piacebo Update 288 omits th backdoor so that no security compromises are made, yet shows the same details and identification (i.e. update number/code) as the Backdoor Update 289 to evoke an environment that maintains stealth of the Backdoor.
  • Such additional Computers 296 can be those belonging to the Criminal System 49 infrastructure or those that are on the same local network as the criminal Computer 229. Exploiting such additional Computers 296 increases the chances of gaining a path of entry to the criminal Computer 229 in case a direct attack was not possible ⁇ i.e. they turn off updates for the operating system etc). The Exploit 253 wouid then be able to consider different points of entry to the target if it is able to establish itself on nearby
  • Exposure can be understood as sharing a common network (i.e. Virtual Private Network etc) or a common service platform (i.e. file sharing etc.).
  • Involved System 290 may also be strategically tied to criminal System 49, such as being owned fay the same company legal structure etc.
  • Neighbor Computers 293 belonging to a Neighboring System 292 are given the placebo update because of their nearby physical location (same district etc.) to the target criminal Computer 229, Soth Systems Involved 290 and Neighboring 292 are given Placebo Updates 288 to facilitate a time sensitive forensic in vestigation whilst there are no regular updates the Maintainor 287 has planned to deliver in the near future (or whatever is suitable and viable for the investigation), in the case scenario that there is a regula update intended on improving the software/firmware, then involved 290 and Neighboring 292 Systems do not need to be given a placebo update as to validate the perceived legitimacy of the Backdoor 289 Update.
  • the Backdoor 289 can be planted on some of the legitimate updates targeting the criminal Computer 229 and Other Computer 296.
  • the Sensitive File 241 is quarantined and copied so that its metadata usage history can be later analyzed. Any remaining copies on criminal Computer 229 are then securely erased. Any supplemental forensic evidence is gathered. Thereafter forensic data is sent to the exploit's point of contact at the Trusted Platform 10. Upon the data being verified at the Platform 10 it is then forwarded to th
  • Fig. 42 shows how a long-term priority flag is pushed onto the Trusted Platform 10 to monitor the Criminal System 229 for any and all changes/updates. New developments are monitored with priority over the long-term to facilitate the investigation.
  • the Enterprise System 228 submits a Target 297 (which includes identifiable details 239) to the Warrant Module 300 which is a subset of the Trusted Platform 10.
  • the Warrant Module scans all affiliate Systems 303 input 299 for any associations of the defined Target 297, !f there are any matches, the information is passed onto the Enterprise System 228, who defined the warrant and are seeking to infiltrate the Target 297.
  • information input 299 is information that affiliates Systems of the Trusted Platform 10 report, usually to receive some desired analysis, input might also be submitted for the sole purpose of gaining accreditation and reputation with the Trusted Platform 10, affiliate Systems 303 submit their Input to the Trusted Platform 10; which is to the advantage of the Enterprise System 228 seeking to monitor Target 297. This increases the chances that one of these affiliate Systems 303 have enountered Target or a relative of Target, whether that be a positive, neutral, or negative interaction.
  • Such Input 299 is transferred to the Desired Analytical Module 301, which represents the majority function of the Trusted Platform 10 to synchronize mutually beneficial security information.
  • the affiliate Systems 303 post security requests and exchange security information.
  • Warrant Module 300 If information pertaining to Target 297 or any Target relatives are found, the information is also forwarded to the Warrant Module 300 In parallel.
  • the Information Output 302 of th Module 301 is forwarded to the affiliate System 303 to complete their requested task or function. Any useful informatio learnt fay the Warrant Module 300 concerning the Target 297 is forwarded to the Results 298 as part of the Enterprise System's 228 forensic investigation.
  • Figs. 43 and 44 show the dependency structure of LIZARD ⁇ Logically Inferred Zero- database A-priori Realtime Defense ⁇
  • the Static Core 193 is where predominantly fixed program modules have been hard coded by human programmers.
  • the Iteration Module 194 intelligently modifies, creates and destroys modules on the Dynamic Shell 198.
  • Uses Artificial Security Threat (AST) for a reference of security performa ce and uses Iteration Core to process the automatic code writing methodology.
  • the Iteratio Core 195 is the mai logic for Iterating the Dynamic Shell 198 for security improvements as illustrated at Fig. 51.
  • the Differential Modifier Algorithm 196 modifies the Base iteration according to the flaws the AST found.
  • the Logic Deduction Algorithm (IDA) 197 receives known security responses of the Dynamic Shell Iteration in it's Current State from the Artificial Security Threat ⁇ AST). LDA also deduces what codeset makeup i!! achieve the known Correct Response to a security scenario (provided by AST ⁇ ,
  • the Dynamic Sheii 198 contains predominantly dynamic program modules that have been automatically programmed by the Iteration Moduie. Code Quarantine ⁇ 99 isolates foreign code into a restricted virtual environment ⁇ i.e. a petri dish).
  • Covert Code Detection 200 detects code covert!y embedded in data & transmission packets.
  • AST Overflow Relay 201 data is relayed to the AST 17 for future iteration improvement when the system can only perform a Sow confidence decision.
  • Interna! Consistency Check 202 checks if all the internal functions of a block of foreign code make sense. Makes sure there isn't a piece of cod that Is Jnternaliy inconsistent with the purpos of the foreign code as a whoie.
  • Foreign Code Rewrite 203 after deriving foreign code purpose, rewrites either parts or the whoie eode itself and allows only the rewrite to be executed. Mirror test checks to make sure the Input/output dynamic of the rewrite is the same as the original.
  • Need Map Matching 204 is a mapped hierarchy of need St purpose Is referenced to decide if foreign code fits in the overall objective of the system (i.e. a puzzle).
  • the Real Data Synchronizer 205 is one of two layers (the other being Data Manager ⁇ that intelligently selects data to be given to mixed environments and in what priority. This way highly sensitive information is inaccessible to suspected malware, & only available to code that is well known and established to be trustworthy.
  • the Data manager 206 is the middleman interface between entity & data coming from outside of the virtual environment, The
  • Framework Co-ordinator 207 manages all the input, output, thread spawning and diagnostics of the semi-artificial o artificial algorithms.
  • Virtual Obfuscation 208 confuses and restricts code (therefore potential matware ⁇ by gradually and partially submerging them into a virtualszed fake environment.
  • Covert Transportation Moduie 209 transfers malware silently and discretely to a Mock Data Environment 394.
  • Purpose Comparison Moduie 210 four different types of Purpose are compared to ensure that the entity's existence and behavior are merited and understood by LIZARD in being productive towards the system's overall objectives. A potentially wide divergence in purpose indicates malicious behavior.
  • Mock Data Generator 211 creates fake data that is designed to be indistinguishable from the real data, i.e. a batch of SS s
  • Virtual Environment Manager 212 manages the building of the virtual environment, which includes variables such as ratio of mock data, system functions available, network communication options, storage options etc.
  • Data Recall Tracking 213 keeps track of all information upioaded from and downloaded to the Suspicious Entity 415. This is done to mitigate the security risk of sensitive information being potentially transferred to malware. This security check also mitigates the logistical problems of a Iegitimate enterprise process receiving mock (fake) data. In the case that mock data had been sent to a (now known to be ⁇ legitimate enterprise entity, a "callback" is performed which calls back all of the mock data, and the real data (that was originally requested) is sent.
  • LIZARD LogaiSy inferred Zero-database A-priori Realtime Defense
  • LIZARD is a centra! oversight algorithm that is able to block all potential cybersecurity threats in realtime, without the direct aid of a dynamic growing database. Determining whether data/access into the system is permitted is based on a need-to-know, need-to-function, purpose-drivsn-basis, if a block of code or data cannot provide a fu ction/purpose towards achieving the hardcoded goal of the system, then it will be rejected in a covert way that includes virtual isolation and obfuscation, LIZARD is equipped with a syntactical interpreter that can read and write computer code.
  • UZARD has a symbiotic relationship with the iteration Module fl ), SSV1 clones the hardcoded goal-oriented tasks and syntactical comprehension capabilities of LIZARD. It then uses those syntactical capabi lities to modify UZARD to suit the hardcoded goals.
  • the Artificial Security Threat (AST) module is engaged in a parallel virtual environment to stress test differing variations of LIZARD, The variation that scores the best is selected as the next official iteration, LIZARD provides an innovative model that deviates from the status quo of cyber security solutions. With it's advanced logic deduction capabilities it is able to perform instantaneous and accurate security decisions without the "too iittie too late" paradigm of contemporary cyber security defense.
  • LIZARD interacts with three types of data: data in motion, data in use, and data at rest.
  • LiZARD interacts with 6 types of data mediums ⁇ known as vectors); Files, Email, Web, Mobile, Cloud and Removable Media (USB).
  • Enterprise System 228 shows the types of Servers that are running within their infrastruct re such as HTTP and DNS etc.
  • Mobile Devices 305 are shown operating within a Public Coffee Shop 306 whilst being connected to the Enterprise System's 228 digital infrastructure v a the LIZARD Lite Client 43.
  • Such a Client 43 acts as the gateway to the Internet 304 which thereafter connects to the Encrypted LiZARD Cloud 308.
  • Fig. 46 shows an overview of the major algorithm f unctions concerning LIZARD.
  • the Outer Dynamic She!! (DS) 313 of LIZARD is a section of functionality that is more prone to changing via iteration, Modules that require a high degree of complexity to achieve their purpose usually belong at this Shell 313; as they will have surpassed the complexity levels a team of programmers can handle directly.
  • the iteration Module 314 uses the Static Core (SC) 315 to syntactically modify the code base of DS 313 according to the defined purpose in 'Fixed Goals' St data from the Data Return Relay (DRR) 317.
  • SC Static Core
  • Fig. 47 shows the inner workings of the Static Core (SC) 315.
  • Logic Derivation 320 derives logically necessary functions from initially simpler functions. The end result is that an entire tree of function dependencies are built from a stated complex purpose.
  • Code Translation 321 converts arbitrary (generic) code which is understood directly by Syntax Module functions to any chosen known computer language. The inverse of translating known computer languages to arbitrary code is also performed.
  • Rules and Syntax 322 contains static definitions that aid the interpretation and production of syntactical structures. For example, the rule and syntax for the C-M- programming language can be stored In 322.
  • Logic Reduction 323 reduces logic written in code to simpler forms to produce a map of interconnected functions.
  • Complex Purpose Format 325 is a storage format for storing interconnected sub-purposes that represent an overall purpose.
  • Purpose Associations 326 is a hardcoded reference for what functions & types of behavior refer to what kind of purpose. Iterative Expansion 327 adds detail and complexity to evolve a simple goal info a complex purpose by referring to Purpose Associations, Iterative Interpretation 32S loops through all interconnected functions & produces, an interpreted purpose by referring to Purpose Associations 326.
  • the Outer Core 329 is primarily formed by the Syntax and Purpose modules which work together to derive a logical purpose to unknown foreign code, St to produce executable code from a stated function code goal.
  • Foreign Code 330 is code that is unknown to LIZARD and the functionality and Intended purpose is unknown. Whilst Foreign Code 330 is the input to the Inner core.
  • Derived Purpose 331 Is the output. Purpose 331 is the intention of the given Code 330 as estimated by the Purpose Module 36. St is returned in the Complex Purpose Format 325.
  • Fig, 48 shows how Inner Core 334 houses the essential core functions of the system, which are directly and exclusively programmed by relevant Cybersecurity Experts 319 via a Maintenance 318 platform.
  • the Core Code 335 is rudimentary groundwork needed to run LIZARD.
  • Within Core 336 Fundamental Frameworks and Libraries 336 holds all the needed function to operate LIZARD such as compression and comparison functions.
  • Within Core 336 Thread Management and Load Balancing 337 enables LIZARD to scale over a cluster of servers efficiently whilst Communication and encryption Protocols defines the types of encryption sued ⁇ i,e. AES, RSA etc).
  • System Objectives 336 contains Security Policy 340 and Enterprise Goals 341, Policy 340 is manually designed by a cyber security analyst (or many) as a guide that may be referenced for LIZARD to operate according to custom variables. Henc LIZARD has a standard of which to justify what is considered an insecure and prohibited action and what is
  • Enterprise Goals 341 defines more broad characteristics of what kind of general infrastructure the enterprise wants to achieve. Goals 341 is mostly used to guide the self-programming of the Dynamic She!! 313 as to what functionalities LIZARD must have and what capabilities It must perform in regards to the enterprise's infrastructure context.
  • Fig. 49 shows the inner workings of the Dynamic Shell (OS) 313.
  • This section of LIZARD is primarily manipulated b an artificially intelligent programming module (iteration Module).
  • Modules in the Outer Shell 345 are new & experimental modules that possess a light amount of influence on the overall system's decision making.
  • the Inner Shell 344 is the main foody of LIZARD; where most of it's intelligent capabilities operate, fsiew and Experimentai Algorithm 343 'beta' allocated software space, where a functional need for a new module can be programmed and tested by humans, artificial intelligence, or both.
  • Fig. 50 shows the iteration Module (IM) which intelligently modifies, creates and destroys modules on the Dynamic She!! 313.
  • IM iteration Module
  • AST Artificial Security Threat
  • AST 17 uses Artificial Security Threat (AST) 17 for a reference of security performance and uses the Iteration Core 347 to process the automatic code writing methodology.
  • Data Return Relay f DRR Data Return Relay f DRR
  • the AST 17 creates a virtual testing environment with simuiated security threats to enable the iteration process.
  • the artificial evolution of the AST 17 is engaged sufficiently to keep ahead of the organic evolution of criminal malicious cyber activity.
  • Static Core Cloning 346 the Static Core 315, including the semi-dynamic Outer Core 329, is used as a criterion for iteration guidance. Since this iteration, in part, modifies the Outer Core 329; self- programming has come full cycle in a artificially intelligent loop.
  • the iteration Core 347 receives artificial security scenarios & System Objective guidance to alter the Dynamic Sheli 313.
  • the Iteration Core 347 produces many Iterations.
  • the iteration that performs the best In the artificial security tests is uploaded to become the live functioning iteration of the Dynamic Shell at Stage 348.
  • Fig. 51 shows iteration Core 347 which is the main logic for Iterating code for security improvements.
  • Recursiv Iteration 350 a new instance of the iteration Core 347 is called, with the New Iteration 355 replacing the Base Iteration 356.
  • Thread Management 349 which is derived from Thread Management and Load Balancing 337 which is a subset of the Core Code 335.
  • the Differential Modifier Algorithm ⁇ DMA ⁇ 353 receives Syntax/Purpose Programming Abilities 351 and System Objective Guidance 352 from the inner Core 334.
  • Active Security Scenarios 361 the currently active security scenario is testing the Dynamic Shell 313 in an isolated Virtual Execution Environment 357, Such an Environment 357 is a virtual instance that is completely separate from the live system, it perform artificially generation malicious attacks and intrusions.
  • Securit Result Flaws 362 are presented visually as to indicate the security threats that 'passed through' the Base Iteration 356 whilst running the the Virtual Execution Environment 357. Thereafter any Flaws 363 that have beers discovered are forwarded to the DMA 353 to facilitation the generating of a New Iteration 355 which seeks to omit such Flaws.
  • Figs. 52 - 57 show the logical process of the Differential Modifier Algorithm (DMA) 353.
  • Current State 365 represents the Dynamic She!! 313 codeset wit symbolically correlated shapes, sizes and positions. Different configurations of these shapes indicate different configurations of security tnteiiigence and reactions, AST 17 provides any potential responses of the Current State 365 that happened to be incorrect and what the correct response is ⁇ i.e. quarantine this file because it is a virus. ⁇ .
  • Attack Vector 370 (all dotted arrows) acts as a symbolic demonstration for a cybersecurity threat. Direction, size, «& color all correlate to hypothetical security properties like attack vector, size of ma I ware, and type of ma i ware.
  • the Attack Vector symbolically 'bounces' off of the codeset to represent the security response of the codeset, Ref.
  • a 387 shows a specific security configuration that allows an Attack Vector to pass through, which may or may not be the correct security response.
  • Ref , B 368 shows an Attack Vector bouncing off a security configuration which illustrates an alternate response type to Ref. A whilst potentially being correct or incorrect.
  • Ref. C 369 shows a security response which sends the Attack Vector back to it's place of origin, which may or may not be the correct security response.
  • Correct State 354 represents the f inal result of the Differentia! Modifier Algorithm's 353 process for yielding the desired security response from a block of cod of the Dynamic Shell 313.
  • Correct State 354 is produced by recursively iterating 350 new iterations 355 of the Dynamic Sheii 313. Even though there are su btle differences between the Current 365 and Correct 354 States, these differences can result in entirely different Attack Vector 370 responses. Whilst Ref, A 367 allows the Attack Vector to pass straight through, Ref, A 371 (the correct security response) bounces the Attack Vector at a right degree angie. The Attack Vector response for Ref. 8 in both the Cun&nt 365 and Correct 354 States remains unchanged. With Ref. C 373, the Attack Vector is also sent back to its originating source albeit at a different position than Ref. C 369. Ail these Attack Vector presentations illustrate and correspond to logistical management of security threats.
  • Fig. 54 shows AST Security Attack Vector 375 which is the sequence of attacks provided by the AST 17.
  • Correct Security Response 376 shows the desired security response concerning the Attack Vectors 370.
  • the codeset ⁇ shapes) to produce such correct security responses are not shown as at this stage they are not known yet.
  • Fig, 55 shows the Current Dynamic Shell Response Attack 377 which exhibits on inferior security response to the Correct Dynamic Sheii Response Attack 378.
  • Such a Correct Response 378 is produced by the Logic Deduction Algorithm (IDA) 197.
  • Fig. 56 shows how IDA 197 infers the correct security setup to match the Correct Attack Response 378.
  • the Static Core 315 provides System Framework/Guidanc 352 and Syntax/Purpose Automated Programming Abilities 351 to IDA 379 as to enable it to construct a security program that produces the Correct Attack Response 378.
  • the Base iteration 356 of the Dynamic Shell 313 is provided to the IDA 379 at Stage 381. Such an iteration is represented as a Security Response Program 382 that produces substandard an ⁇ ineffective security responses/Such a Program 382 is provided as Input for the IDA 379.
  • IDA uses the Syntax/Purpose Capabilities 351 from the Static Core 315 to build off from the incorrect Security Response Program 382 so that it conforms with the Correct Response Attack 378, Hence the Correct Security Response Program 383 is produced and is considered the New Iteration 355 of the Dynamic Shell 313.
  • the process continues via Recursive Iteration 350 of the Iteration Core 347 will continually upgrade the security capabilities of the Dynamic Shell 313 until it is saturated with all the security information made available by the AST 17.
  • Fig. 57 shows a simplified overview of this process as the AST 17 provides Known Security Flaws 364 along with the Correct Security Response 384.
  • IDA 379 uses prior (base) iterations 356 of the Dynamic Shell 313 to produce a superior and better equipped Iteration 355 of th Dynamic Shell known as Correct Securit Respons
  • Program 385 The usage of the word 'program:' represents the overall functionality of many different function and submodules that operate within the Dynamic Shell 313.
  • JOlllJ Fig. 58 shows an overview of Virtual Obfuscation, The following capabilities of Virtual Obfuscation & Mock Data Generation are deployed on an encrypted cloud platform, to be used by small/medium businesses with little to no cybersecurity employees.
  • the security system can also be installed directly in datacenters for large corporations.
  • ivlaiware 385 comes form the internet 304 and bypasses the industry standard Firewall/intrusion Detection System/Anti-Vtrus etc.
  • LIZARD 16 has a low confidence assessment of the intent/purpose of the incoming block of Code 385. These conditions are assumed as a worst case scenario.
  • the questionable Code 385 is covertly allocated to an environment in which half of the data is intelligently mixed with mock (fake) data.
  • the Real Data Synchronizer 386 is one of two layers ⁇ the other being Data Manager 401 ⁇ that intelligently selects data to be given to mixed environments and in what priority. This way highly sensitive information is inaccessible to suspected malware and only available to code that is well known and established to be trustworthy.
  • the Mock Data Generator 387 uses the Real Data Synchronizer 386 as a template for creating counterfeit & useless data. Attributes such as data type, data format, data density, data detail etc. are mimicked from the Real Data
  • Highly Monitored Network interface 392 is used in environments containing Mock Data 393. Such a secure interface is used to protect the environment from leaking into restricted environments like Real System 388 in conjunction with Virtual isolation 390.
  • Isolation 390 uses virtualization technology to completely separate and protect Random Access Memory (RAM) and CPU Threads from mixing as to isolate each environment to itself.
  • RAM Random Access Memory
  • Figs, 59 - 61 shows the Monitoring and Responding aspect of Virtual Obfuscation.
  • Such a system monitors and manages maiware 385 according to maiware behavior, initially LiZA D perceives, at it's current iteration ievel of sophistication, a block of code that might or might not be maiware, in case it is not maiware, LiZARD pushes it into a virtual cione of the real system that is comprised of 50% Mock Data 391, This is done so that if it turns out to not be maiware, system and enterprise functionality Is not severely hampered (i.e. wrong SSN is provided etc), in the illustrated example, the block of code is actually Maiware 385, but at this stage LIZARD is still unsure because of th new and unknown nature of this th reat and exploitation method.
  • the Data Manager 401 intelligently mixes real data with mock data so that highly sensitive data has no exposure.
  • the Manager 401 Uploads 402 Information generated by the Maiware 385 to Mock Data Storage 400 and Downloads 398 previously stored mock data to blend with the Reai Data 397, This way the Maiware does not have write access to the Real Data Storage 397 and cannot override sensitive information.
  • the Maiware 385 is Virtually Isolated 380 so that it is only exposed to the Data Manager 401.
  • This Virtuai Isolation prohibits the Maiware from being abie to access all of the Real Data 397 by bypassing Data Manager 401.
  • Behavioral Analysis 403 tracks the Download 398 and Upload 402 behavior of the suspicious block of code to determine potential corrective action.
  • the Analysis 403 monitors how the Maiware 385 behaves in it's candid form, to help confirm or deny LIZARD'S original suspicion. Having monitored the Mai ware's Behavior in it's candid form LIZARD has confirmed the initial suspicion that the foreign code is indeed maiware.
  • the Maiware 385 is silently and discreetly transferred to the 100% Mock Data Virtual Environment 394 via the Covert Transportation Module 395. Just incase the Maiware had already multiplied and performed infections in the 50% Mock Data environment 391, the entire virtual environment is securely destroyed
  • Figs, 62 and 63 shows Data Recall Tracking 399 keeps track of ail information uploaded from and downloaded to the Suspicious Entity 415. This is done to mitigate the security risk of sensitive Information being potentially transferred to Maiware. This security check also mitigates the logistical problems of a legitimate enterprise process receiving Mock Data 400- In the case that Mock Data had been sent to a (now known to be) legitimate enterprise entity, a "callback" is performed which ca!is back ail of the Mock Data,, and th Real Data (that was originally requested) is sent as a replacement.
  • a callback trig er is implemented so that a legitimate enterprise entity wi!i hold back on acting on certain Information until there is a confirmation that the data is not fake, if real data had been transferred to the maiware inside a virtual mixed environment, the entire environment container is securely destroyed with the Maiware 385 inside. An alert is placed systemwide for any unusual activity concerning the data that was known to be in the maiware' s possession before it was destroyed. This concept is manifested at Systemwide Monitoring 405. If the entity that received partial real data turns out to be maiware ⁇ upon analyzing behavior patterns ⁇ , then the virtual environment ⁇ including the maiware) is securely destroyed, & the enterprise-wide network Is monitored for unusual activity of the tagged real data. This way any potential information leaks are contained.
  • the Data Recall Trigger 414 is an installation of software performed on legitimate entities ⁇ and inadvertently; malicious entities attempting to appear legitimate) that checks for hidden signals which indicate that a Mixed Data Environment has potentially been activated.
  • Data Manager 401 is the middleman interface between the Entity 415 and data that calculates the proportions of Real Data 412 (if any) that should be mixed with Mock Data 400 (if any ⁇ , In the Upload 402 and Download 398 streams of information, individual packets/files are marked (if required) for the Data Recall Trigger 414 to consider a reversal of data.
  • Figs, 64 and 65 show the inner workings of the Data Recall Trigger 414.
  • Behavioral Analysis 403 tracks the download and upload behavior of the Suspicious Entity 415 to determine potential Corrective Action 410.
  • Real System 417 contains the original Real Data 412 that exists entirely outsid of the virtualtzed environment and contains all possible sensitive data.
  • Real Data that Replaces Mock Data 418 Is where Real data Is provided unfiltered (before even the Real Data Synchronizer 386) to the Data Recall Tracking 399,
  • the Data Manager 401 which is submerged in the Virtually Isolated Environment 404, receives a Real Data Patch 416 from Data Recall Tracking 399.
  • This Patch 416 includes the replacement instructions to convert the Formerly Suspicious Entity 422 (which is now known to be harmless) to a correct, real and accurate Information state.
  • Such a Patch 416 is transferred to the Data Recall Interface 42? which is subsequently transferred to the Formerly Suspicious E tity 422.
  • Downloaded Data 420 is the data that the enterprise had downloaded within a Mock Data Environment 404 (hence the data is partially or fully fake).
  • Fixed Data 421 is where the Mock data has been replaced with it's counterpart Real Data after the Real Data Patch 416 has been applied.
  • Harmless Code 409 has been cleared by Behavioral Analysis 403 to being malicious, Corrective Action 419 is performed. Such Action 419 Is to replace the Mock Data in the Formerly Suspicious Entity 422 with the Real Data 412 that it represents.
  • Secret Token 424 is a security string that is generated and assigned by LIZARD. The Secret Token 424 does not prove to the Virtual Obfuscation System that the Suspicious Entit 415 is legitimate and harmless.
  • the Data Recall Trigger 414 only exists on legitimate enterprise functions and entities. By default, a legitimate entity will check an agreed upon location in the Embedded Server Environment 404 for the Token's 424 presence, If the Token is Missing 429 and 425, this indicates the likely scenario that this legitimate entity has been accidentally placed in a partially Mock Data Environment (because of the risk assessment of it being malware).
  • a Delayed Session 428 with the Delay interface 42$ is activated. If the Token is found 42$ and 424, this indicates that the server environment is real and hence any delayed sessions are Deactivated 427.
  • the Delay Interface 426 Is a Module that is pre-installed directly on the entity. Upon indication of being in a Mock Environment 404, a delayed session will be activated. A delayed session means the processes of the entity are made artificially slow to grant Behavioral Analysis 403 time to make a decision about whether this entity is harmless or malicious.
  • Fig. 66 shows Data Selection, which filters out highly sensitive data and mixes Real Data with fylock Data.
  • Real Data 412 is provided to the Real Data Synchronizer 386 which Filters Out Highly Sensitive Data 431, The Filter range varies according to System Policy 430 which is defined in the Static Core 315.
  • This Module 431 ensures that sensitive information never eve reaches the same virtual environment that the Suspicious Entity 415 exists in.
  • the data is filtered once, upon the Generating 434 of the Virtual Environment 404. With Criteria for Generating 433, the filtered real data is used as criteria for what kind and amount of Mock Data should be generated.
  • the Mock Data Generator 387 creates fake data that is designed to be indistinguishable from the real data.
  • the Virtual Environment Generator 434 manages the building of the Virtual Environment 404, which includes variables such as ratio of mock data, system functions available, network communication options, storage options etc.
  • Data Criteria 435 is the variable for tuning the ratio of Real data to Mock (fake) Data. With Merged Data 438, data is merged according to the Data Criteria 435.
  • Ratio Management 43 constantly adjusts the amount of Real and Mock Data being merge, as do conform with the desired Mock Data Ratio, The data is merged in realtime according to the Data Request 440 of th Suspicious Entity 415, The data is returned with the appropriate fvlock Data ratio at Requested Data 439.
  • Figs, 67 and 68 show the inner workings of Behavioral Analysts 403.
  • Purpose Map 441 is a hierarchy of System Objectives which grants purpose to the entire Enterprise System. Such purpose is assigned for even the granularity of small-scale networks, CPU processing, and storage events.
  • the Declared, Activity and Codebase Purposes are compared to the innate system need for whatever the Suspicious Entity 415 is allegedly doing.
  • Activity Monitoring 453 the suspicious entity's Storage, CPU Processing, and Network Activity are monitored.
  • the Synta Module 35 interprets suc Activity 443 in terms of desired function. Such functions are then translated to an intended: purpose in behavior by the Purpose Module 36.
  • Codebase Purpose 446 might be to file annual earning reports, yet the Activity Purpose 447 might be "to gather all the SSNs of th top paid employees".
  • This methodology is analogous to the customs divisio of an airport where someone has to declare certai items to customs, whilst customs does a search of their bags anyways, Codebase 442 is the source
  • the Purpose Module 36 produces the outputs Codebase Purpose 446 and Activity Purpose 447
  • Codebase Purpose 446 contains the known purpose, function, jurisdiction and authority of Entity 415 as derived by LIZARD'S syntactical programming capabi!ities.
  • Activity Purpose 447 contains the known purpose, function, jurisdiction and authority of Entity 415 as understood by LIZARD' s understanding of it storage, processing and network Activity 453.
  • Declared Purpose is the assumed purpose, function, jurisdiction, and authority of Entity 415 as declared fay the Entity Itself .
  • Needed Purpose 445 contains the expected purpose, function, jurisdiction and authority the Enterprise System requires. This is similar to hiring an employee to fulfill a need of the company.
  • Fig. 69 illustrates the main logic of CTfvl 22.
  • CTMP's primary goal is to criticize decisions made by a third party, CTfvlP 22 cross-references intelligence from multiple sources ⁇ i.e. I3 ⁇ 4E, LIZARD, Trusted Platform,, etc.) and Seams about expectations of perceptions and reality.
  • CTIV P estimates it's own capacity of forming an objective decision on a matter, and will refrain from asserting a decision made with Sow internal confidence.
  • Incoming streams of data such as an army of globally deployed agents as weli as Information from the Trusted Piatform, are all converted into actionable data.
  • Subjective opinion decisions 454 indicates the original subjective decision provided by the input algorithm which is known as the Selected Pattern Matching Algorithm (SPMA) 526.
  • SPMA is typically a security related protection system, yet without limiting other types of systems such as Lexical Objectivity Mining (LOM) ⁇ reasoning algorithm) and Method for Perpetual Giving ⁇ MPG) (tax interpretation algorithm).
  • LOM Lexical Objectivity Mining
  • MPG Method for Perpetual Giving
  • Input system Metadata 455 indicates raw metadata from the SPMA 526 which describes the mechanical process of the algorithm and how it reached such decisions.
  • Reason Processing 456 will logically understand the assertions being made by comparing attributes of properties, in Rul Processing 457, a subset of Reason Processing, the resultant rules that have been derived are used as a reference point to determine the scope of th problem at hand.
  • Critical Rule Scope Extender (CRSE) 458 ⁇ will take the known scope of perceptions and upgrade them to include critical thinking scopes of perceptions.
  • Correct ruies 459 Indicates correct rules that hav been derived by using the critical thinking scope of perception.
  • Memory Web 460 the market variables ⁇ Market Performance 30 and Profit History 31) logs are scanned forf uifillabSe rules. Any applicable and fulfillab!e rules are executed to produce investment allocation override decisions.
  • Rule Execution ⁇ RE ⁇ 461 rules that have been confirmed as present and fulfilled as per the memory's scan of the Chaotic Field 613 are executed to produce desired and relevant critical thinking decisions. Such execution of ruies leads to the inevitably unambiguous resuits.
  • Critical Decision Output 462 final logic for determining the overall output of CTMP by comparing th conclusions reached by both Perception Observer Emulator ⁇ POE) 475 and Rule Execution (RE) 461,
  • Critical Decision 463 is the final output which is an opinion on the matter which attempts to be as objective as possible
  • Logs 464 are the raw information that is used to independently make a critical decision without any influence or bias from the subjective opinion of the input algorithm ⁇ MPG ⁇ .
  • Raw Perception Production ⁇ R 2 465 is a module that receives metadata logs from the SPMA 526, Such logs are parsed and a perception is formed that represents the perception of such algorithm.
  • the perception is stored in a Perception Complex Format (PCF), and is emulated by the Perception Observer Emulator ⁇ PQE ⁇ 475.
  • Applied Angles of Perception 466 indicates angles of perception that have already been applied and utilized by the SPMA 526.
  • Automated Perception Discovery Mechanism (APDM) 467 indicates a module that ieverages the Creativity Module 18 which produces hybridized perceptions (that are formed according to the input provided by Applied Angles of Perception 466) so that the perception's scope can be increased, 468 indicates the entire scope of perceptions available to the computer system.
  • Critical Thinking 469 indicates the outer shell jurisdiction of rule based thinking. This results in Rule Executio (RE) 461 manifesting the rules that are well established according to the SPM A 526 but also the new Correct Rules 459 that have been
  • Fig. 71 shows the dependency structure of CTMP.
  • RMA Resource Management & Allocation
  • adjustable policy dictates the amount of perceptions that are leveraged to perform an observer emulation. The priority of perceptions chosen are selected according to weight in descending order. The policy can then dictate the manner of selecting a cut off, whether than be a percentage, fixed number, or a more complex algorithm of selection.
  • SS Storage Search
  • PM Metric Processing
  • SFEvIA Selected Pattern Matching Algorithm
  • PD Perception Deduction
  • CDO Critical Decision Output
  • Metadata Categorization Module (MCM) 488 the debugging and algorithm traces are separated into distinct categories using traditional syntax based information ' categorization. Such categories can then be used to organize and produce distinct investment allocation responses with a correlation to market/tax risks and opportunities.
  • MCM Metadata Categorization Module
  • Perception Storage (PS) 478 perceptions in addition to their relevant weight, are stored with the comparable variable format (CVF) as their index. This means the database is optimized to receive a CVF as the input query lookup, and the result will be an assortment of perceptions.
  • CVF comparable variable format
  • implication 'Derivation ⁇ 10 ⁇ 477 derives angles of perception of data that can be implicated from the current known angles of perceptions.
  • SC D Self-Critical Knowledge Density
  • incoming raw logs represent known knowledge.
  • This module estimates the scope and type of potential unknown knowiedge that is beyond the reach of the reportable logs. This way the subsequent critical thinking features of the CTMP can leverage the potential scope of all involved knowledge, known and unknown directly by the system, in Metric Combination 493, angles of perception are separated into categories of metrics, in Metric Conversion 494, individual metrics are reversed back into whole angles of perception.
  • Metric Expansion (ME) 495 the metrics of multiple and varying angles of perception are stored categorically in individual databases. The upper bound is represented by the peak knowledge of each individual Metric 08, Upon enhancement and complexity enrichment, the metrics are returned to be converted back into Angles of Perception and to be leveraged for critical thinking.
  • Comparable Variable Format Generator ⁇ CVFG ⁇ 491 a stream of information is converted into Comparable Variable Format (CVF),
  • the Rule Fu lfillment Parser (RFP) 498 receives the individual parts of the rule with a tag of recognition. Each part is marked as either having been found, or not found in the Chaotic Field 613 by Memory Recognition 501. The RFP can then logically deduce which whole rules, the combination of all of their parts, have been sufficiently recognized in the Chaotic Field 613 to merit Rule Execution (RE) 461.
  • Rule Syntax Format Separation (RSFS) 499 Correct Rules are separated and organized by type. Hence ail the actions, properties, conditions, and objects are stacked separately. This enables the system to discern what parts have been found in the Chaotic Field 613, and what parts have not.
  • Rule Syntax Derivation 504 logical 'black and white' rules are converted to metric based perceptions. The complex arrangement of multiple rules are converted into a single uniform perception that is expressed via muitiple metrics of varying gradients.
  • Rule Syntax Generation (RSG) 505 receives previously confirmed perceptions which are stored in Perception Format and engages with the
  • Metric Context Ana lysis 507 analyzes the interconnected relationships within the perceptions of metrics. Certain metrics can depend on others with varying degrees of magnitude. This cofttextualization is used to supplement the mirrored interconnected relationship that rules have within the 'digital' ruieset format.
  • input/Output Analysis 508 performs a differentia! analysis of the input and output of each perception (grey) or ruie ⁇ black and white ⁇ .
  • Rule Formation Analysis 510 analyzes th overall composition/makeup of rules and how they interact with each other. Used to supplement the mirrored interconnected relationship that metrics have within an 'analog' perception.
  • Rule Syntax Format Conversion (RSFC) 511 roles are assorted and separated to conform to the syntax of the Ruie Syntax Format (RSF) 538,
  • Fig. 74 shows the final logic for processing intelligent information in CTMP, The final logic receives intelligent information from both intuitive/Perceptive and Thinking/Logical modes (Perception Observer Emulator (POE) 475 and Rule Execution (RE) 461 respectively).
  • DDC Direct Decision Comparison
  • both decisions from intuition and Thinking are compared to check for corroboration.
  • the key difference is that no Meta-metadata s being compared yet, because if they agree identically anyways then it is redundant to understand why.
  • Terminal Output Control (TOC) 513 is the last logic for determining CTMP output between both modes Intuitive 51 and Thinking 515.
  • intuitive Decision 514 is one of two major sections of CTfvlP which engages in critical thinking via leveraging perceptions.
  • Perception Observer Emulator (PGE) 475 Thi nking Decision 515 is the other one of two major sections of CTSvlP which engages in critical thinking via leveraging ruies. See Rule Execution (RE) 461.
  • Perceptions 516 is data received from intuitive Decision 15S according to a format syntax defined in interna! Format 518.
  • Fulfilled Rules 517 is data received from Thinking Decision 515 which is a collection of applicable ffuifi Habie) ru!esets from Rule Execution (RE) 461 ⁇ Such data is passed on in accordance with the format syntax defined in interna! format 518.
  • MOM Internal Format SIS th Metadata Categorization Module
  • Fig. 75 shows the two main inputs of intuitive/Perceptive and Thinking/Logical assimilating into a single terminal output which is representative of CTMP as a whole.
  • Critical Decision + Meta -metadata 521 is a digital carrier transporting either Perceptions 516 or Fulfilled Rules 517 according to the syntax defined in Interna! Format 518.
  • Fig, 76 shows the scope of intelligent thinking which occurs in the original Select Pattern Matching Aigorithm (SPMA ⁇ 526.
  • input Variables 524 are the initial financial/tax allocation variables that are being considered for Reason and Rule processing.
  • CTEVlP intends on criticizing them and becoming an artificially intelligent second opinion.
  • Variable input 525 receives input variables that define a security decision.
  • Such variables offer criteria for the CTMP to discern what is a reasonable corrective action, if there is an addition, subtraction, or change in variable; then the appropriate change must be reflected in the resultant correctiv action.
  • the crucial objective of CTMP is to discern the correct, critical change of corrective action that correctl and accurately reflects a change in input variables.
  • SPiVIA the selected pattern matching algorithm attempts to discern the most appropriate action according to its own criteria.
  • Resultant Output Form 527 is the result produced by the SPMA 52$ with initial input variables 168.
  • the rules derived by the SPM 526 decision making are considered 'current rules' but are not necessarily 'correct rules'.
  • Attributes Merging 528 according to the fog information provided by SP A 526 Reason Processing 456 proceeds with the current scope of knowledge in accordance with the SPMA 526.
  • Fig. 77 shows the conventional SPMA 526 being juxtaposed against the Critical Thinking performed by CTMP via perceptions and rules, Misunderstood Action 531, the Selected Pattern Matching Algorithm (SPMA) 526 was unable to provide an entirely accurate corrective action. This is because of some fundamental underlying assumption that was not checked for in the original programming or data of the SPMA 526, in this example, th use of a 3D object as the input variable and the correct appropriate action illustrate that there was a dimension/vector that the SPMA 526 did not account for.
  • the 3 R1 dimension was considered by Critical Thinking 469 because of ail th extra angles of perception checks that were performed.
  • the Critical Rule Scope Extender f CRSE extends the scope of comprehension of the ruiesets by leveraging previously unconsidered angles of perception (i.e., the third dimension).
  • the derived rules of the current corrective action decision reflect the understanding, or lack thereof ⁇ as compared to the correct rules), of the SPMA 526.
  • Fig, 78 shows how Correct Rules 533 are produced in contrast with the conventional Current Rules 534 which may have omitted a significant Insight and/or variable.
  • CMP 535 the format of the logs are combined into a single seanrsable unit known as the Chaotic Field 613.
  • Extra Rules 536 are produced from Memory Recognition (MR) 501 to supplement the already established Correct Rules 533.
  • MR Memory Recognition
  • Perceptive Rules 537 perceptions that are considered relevant and popular have been converted into logical rules. If a perception ⁇ in it's original perception format) had many complex metric relationships that defined many 'grey areas', the 'black and white' logical rules encompass such 'grey' areas by n th degree expansion of complexity.
  • Rule Syntax Format 538 is a storage format that has been optimized for efficient storage and querying of variables.
  • Figs, 79 - SO describes the Perception Matching (PM) 503 module.
  • Concerning Metric Statistics 539 statistical information is provided from Perception Storage (PS) 479. Such statistics define the popularity trends of metrics, internal metric relationships, and metric growth rate etc, Some general statistic queries (like overall Metric popularity ranking) are automatically executed and stored. Other more specific queries ⁇ how related are Metrics X and Y) are requested from PS 479 on a real-time basts.
  • Metric Relationship Holdout 540 holds Metric Relationship data so that it can be pushed in a unified output.
  • Error Management 541 parses syntax and/or logical errors stemming from any of the individual metrics.
  • Separate Metrics 542 isolates each individual metric since they used to be combined in a single unit which was the input Perception 544.
  • Input Perception 544 is an example composition of a perception which is made up of the metrics Sight, Smell, Touch and Hearing.
  • Node Comparison Algorithm (NCA) 546 receives the node makeup of of two or more CVFs. Each node of a CVF represents the degree of magnitude of a property, A similarity comparison is performed on a individual node basis, and the aggregate variance is calculated. This ensures an efficiently calculated accurate comparison. A smaller variance number, whether it be node-specific or the aggregate weight, represents a closer match.
  • Comparable Variable Formats ⁇ CVFs ⁇ 547 are visual representations to illustrate the various makeups a CVF. Submit matches as output 550 is the terminal output for Perception Matching (PM) 503. Whatever nodes overlap in Node Comparison Algorithm (NCA) 546 are retained as a matching result, and hence the overall result is submitted at Stage 550.
  • PM Perception Matching
  • NCA Node Comparison Algorithm
  • Figs, 8I-S5 shows Rule Syntax Derivation/Generation.
  • Raw Perceptions - Intuitive Thinking (Analog) 551 is where the perceptions are processed according to an 'analog' format.
  • Ra Rules - Logical Thinking (Digital) 552 is where rules are processed according to a digital format.
  • Analog Format 553 perceptions pertaining to the financial allocation decision are stored in gradients on a smooth curve without steps, Digital Format 554 raw rules pertaining to the financiai allocation decision are stored in steps with little to no 'grey area'.
  • Original Rules 555 is the same as Correct Rules 533 in terms of data content.
  • Security Override Decisions 557 are the final results produced by Rule Execution (RE) 461 which allow for corrective actions to be performed. Such corrective actions are further channelled to the Terminal Output Control (TOC) 513 which is a subset of the greater correctiv action logic performed In Critical Decision Output (CDO) 462.
  • Unfulfilled Rules 558 are rulesets that have not been sufficiently recognized (according to the Rule
  • Fulfillment Parser 498) in th Chaotic Field 613 according to their logical dependencies.
  • the Third Party Database Solution 559 is the hardware interface software which manages buffer, cache, disk storage, thread management, memory management, and other typical mechanical database functions.
  • Fulfillment Debugger 560 seeks to find the reason for unfulfilled rules. It is either that the Chaotic Field 613 was not rich enough, or that the ruleset was inherently illogical, it can be instantaneously checked, within a certain degree of accuracy, if the ruleset is illogical. However, to establish the potential spareness of the Chaotic Field 613, multiple surveys must be taken so as to not fall Into the fallacy of performing an insufficient survey.
  • Figs. 86-87 shows the workings of the Rule Syntax Format Separation (RSFS) 499
  • Actions 561 one of four rule segment data types that indicates an action that may have already been performed, will be performed, is being considered for activation etc.
  • one of four rule segment data types that indicates some propertylike attribute which describes something else, be it an Action, Condition or Object.
  • Conditions 563 one of four rule segment data types that indicates a logical operation or operator (i.e. if x and y then z, if x or z then y etc.).
  • Objects 564 one of four rule segment data types that indicates a target which can have attributes applied to it such as Actions 561 and Properties 562.
  • Processing stage 566 iterates through the rule segments one stem at a time.
  • Processing stage 567 interprets and records each individual relationship between rule segments (i.e.
  • Sequential Scanning 568 splits up each unit of the RSF 538 at the '[DiV!DEj' marker.
  • the Subjects and Glue from RSF S3S are also separated and parsed.
  • Separation Output 569 is where individual subjects and Internal subject relationships are held by the scanner. They are sent for output ail at once when the entire R5F 538 has been sequentially scanned.
  • Separated Rule Format 570 is a delivery mechanism for containing th individual rule segments (i.e.
  • the Separated Rul Format 570 use is highlighted in two major points of information transfer: first as output from the Rule Syntax Format Separation (RSFS) 499 ⁇ which is considered the pre-Memory Recognition phase) and as output from Memory Recognition (MR) 501 (post-Memory Recognition phase).
  • RSFS Rule Syntax Format Separation
  • MR Memory Recognition
  • Fig, 88 shows the workings of the Rule Fulfillment Parser RFP) 49S.
  • This module receives the individual segments of the rule with a tag of recognition. Each segment is marked as either having been found, or not found in the Chaotic Field 613 by Memory Recognition (MR) 101.
  • MR Memory Recognition
  • the RFP 408 can then logically deduce which whole rules, the combination of ail of their parts, have been sufficiently recognized in the Chaotic Field 613 to merit Rule Execution (RE) 461.
  • Queue Management (QM) 561 leverages the Syntactical Relationship Reconstruction (SRR) 497 module to analyse each individual part in the roost logical order, OJV1 561 has access to the Memory Recognition (MR) 501 results so that the binary yes/no flow questions ca be answered and appropriate action can be taken.
  • Ojvl checks every rule segment in stages, if a single segment is missing from the Chaotic Field 613 and not in proper relation with the other segments, the ruieset is flagged as unfulfilled, if all the check stages pass then the ruleset is flagged as fulfilled 522.
  • Gj l stage 571 checks if rule segment Object was found in the Chaotic Field 613.
  • Ojvl stage 572 checks if the next appropriate segment is related to the original Object C, whilst also being found in the Chaotic Field 613 according to Memory Recognition (MR) 501.
  • the sam logic is applied to QM stages 573 and 574 for Condition B and Action A respectively.
  • These segment denotations (A, 8, C etc. ⁇ are not part of the core logic of the program but are reference to a consistent example used for dispiaying expected and typical usage.
  • the receiving of the fully reconstructed ruleset 575 requires the fulfilled ruleset output of Queue Management 576, assuming that the ruleset was found to be fulfillable, and the associations of the rule segments as given by the Syntactical Relationship Reconstruction (S R) module 437,
  • [013iJ Figs, 89-90 display the Fulfillment Debugger 560 whic seeks to find th reason for unfulfilled rules. It is either that the Chaotic Field 813 was not rich enough, or that the ruleset was inherently illogical. It can be instantaneously checked, within a certain degree of accuracy, if the ruleset is illogical However, to establish th potential spareness of the Chaotic field 613, multiple surveys must be taken in order to avoid the insufficient survey fallacy.
  • Field Spareness Survey 577 specifically checks if the Chaotic Field 613 is rich enough or not to trigger the variable makeup of the ruleset. Scan 578 checks for relevant rule parts' presence Inside the Chaotic Field 613.
  • Survey D8 579 stores the survey results for near f uture reference.
  • Conditional 580 checks if the Survey 08 579 has become saturated/filed up. This means that any possible scans for Rule Parts have been performed, despite the scans yielding positive or negative results. If all possible scans have been performed, then Conclusion 581 is implicated: that sparseness in the enti e Chaotic Field 613 is the reason for why the ruleset was classified as unfulfilled, if all possible scans hav not been performed, then Conclusion 582 is implicated: that the survey is incomplete and more sectors of the Chaotic Field 613 need to be scanned in order to reliably tell if Chaotic Field 613 sparseness is th cause for a rule becoming unfulfilled.
  • Logical Impossibility Test 583 checks to see if there is an inherently impossible logical dependency within the ruleset which is causing it to become classified as unfulfilled. For example the Object 584 'Bachelor' has been assigned the Property 585 'Married', which leads to an inherent contradiction. The Test 583 determines the dictionary definitions of terms 584 and 585. Internal Rule Consistency Check 588 will check if all properties are consistent and relevant with their object counterparts.
  • the 'Bachelor' 584 definition in RSF 538 format contributes the partiai definition of Object 586 'Man' whilst the 'Married' 585 definition (also In RSF 538 format) contributes to the partial definition of Object 587 'Two People'.
  • Fig, 91 shows Rule Execution ⁇ RE) 461; Rules that have been confirmed as present and fulfilled as per the memory's scan of the Chaotic Field 813 are executed to produce desired and relevant critical thinking decisions.
  • Stage 1 593 the RSF 538 information defines the initial starting positions of all the relevant objects on the checkerboard plane, hence defining the start of the dynamically cascading security situation, This is symbolically used to illustrate the logical 'positions' of rules that deal with a dynamic security policy.
  • Stage 2 594 and Stage 6 598 indicate an object transformation which is illustrative of security rules being applied which modifies the position and scope of certai security situations. For example, the transformation of an object in Stages 2 and 6 can represent the encryption critically files.
  • Stage 3 595 illustrates th movement of an object on the checkerboard, which can correspond to the actual movement of a sensitive file to an offslte location as part of a security response strategy.
  • Stage 4 596 and Stage 5 597 show the process of two objects merging into a common third object.
  • An example application of this rule is two separate and isolated focal area networks being merged to facilitate the efficiently and securely managed transfer of information.
  • Th is illustrates the critical thinking advantage that CTMP has performed, as opposed to the less critical results produced from the Selected Pattern Matching Algorithm ⁇ SP A) 526. All of the shapes, colors, and positions are symbolically representing security variables, incidences, and responses (because of the simplicity to explain rather than actual security objects).
  • the SPMA has produced f inal shape positions that differ from CTMP, as weli as a similar yet different (orange vs yellow ⁇ color difference for the pentagon. This occurs because of the eompiex conditional statement-ruleset makeup that ail of the input logs go through for processing. This is similar to how starting a biiliard bal! match with varying p!ayer variables (height, force etc.) can lead to entirely different resultant ball positions.
  • CTMP also transformed the purple square into a cube, which symbolically represents (throughout CTMP's description ⁇ it's ability to conside
  • the final Security Override Decision 599 is performed in accordance with the Correct Ruies 533.
  • Figs. 92 and 93 demonstrate Sequential Memory Organization, which is an optimised information storage method that yields greater efficiency in readin and writing for 'chains' of sequenced information such as the alphabet, in Points of Memory Access 600, the width of each of the Nodes 601 (blocks) represent the direct accessibility of the observer to the memorized object (node).
  • a sequence that exhibits strong non-uniformity is made up of a series of smaller sub-sequences that interconnect.
  • the alphabet is highly indicative of this behavior as the individual subsequences 'ABCD', 'EFG', 'HUK', 'LMNOP' all exist independently as a memorized sequence, yet they interconnect and form the alphabet as a whole.
  • This type of memor storage and referencing can be much more efficient if there is occasional or frequent access to certain nodes of the master sequence. This way scanning f rom the start of the entire sequence can be avoided to gain efficiency in time and resources.
  • a Extremely Uniform sequence means it is either extremely sequential ⁇ consistently little to no points of access throughout th nodes ⁇ or extremeiy non-sequential (consistently large points of access throughout the nodes ⁇ .
  • An example of Extremeiy Uniform 607 is a collection of fruit, there is barely any specified nor emphasised sequence in reciting them nor are there any interconnected sub-sequences.
  • the Moderately Uniform 60S scope has an initial large access node, which means it is most efficient to recite the contents starting from the beginning, However the main contents is moreover linear, which Indicates the absence of nested sub-sequence Iayers and the presence of a singular large sequence.
  • the Moderateiy Non-Uniform 604 scope does not deviate very much from a linear and hence consistent point of access throughout. This ⁇ .indicates that there are more subtle and less defined nested sub sequence iayers whilst at the same time conforming to a consistent and reversible collection.
  • An example of information exhibiting the behavior of Moderateiy Non-Uniform 604 can be the catalogue for a car manufacturer. There can b defined categories such as sport cars, hybrids and SUVs yet there is no strong bias for how the list should be recited nor remembered, as a potential customer might still be comparing an SUV with a sports car despite the separate categor designation.
  • Fig. 94 shows Non-Sequential Memory Organization, which deals with the information storage of non-sequentiaily related items such as fruit. With a collection of f ruit there is no highly specified order in which they should be read, as opposed to the alphabet which has a strong sequential order for how the information should be read.
  • Memory Organization 608 shows the consistently uniform nodes of access for a!! of the fruit, indicating a non-sequential organization. The organization in 608 illustrates how reversibility indicates a non-sequential arrangement and a uniform scope.
  • the nucleus represents the primary topic, to which the remaining fruit act as memory neighbours to which they can be accessed easier as opposed to if there were no nucleus topic defined.
  • Strong Neighbours 610A despite an apple being a common fruit, it has a stronger association with pineapple than other commo fruit because of the overlap in spelling. Hence the are considered to be more associated memory-wise, in Weak Neighbours 610B, because pineapple is a tropical fruit, it has less associations with oranges and bananas (Common Fruit). A pineapple is more likely to be referenced with a mango because of the tropica! overlap.
  • Graph Point $12 demonstrates how the extremely weak sequentially of the fruit series leads to extremely stron uniformity in Mode 601 access.
  • Fig. 95-97 shows Memory Recognition ⁇ MR ⁇ 501, where Chaotic Field 613 scanning is performed to recognize known concepts.
  • Chaotic Field 613 Is a 'field' of concepts arbitrarily submersed in 'white noise' information, it is being made known to the CTMP system on a spontaneous basis,, and is considered 'in the wild' and unpredictable.
  • the objective of Memory Recognition is to scan the field efficiently to recognize known concepts.
  • Memory Concept Retention 614 With Memory Concept Retention 614, recognizable concepts are stored and ready to be indexed and referenced for field examination.
  • the illustration uses the simplified example of vegetable name spelling to facilitate easy comprehension of the system. However, this example can be used as an analog for much more complex scenarios.
  • this can include recognizing and distinguishing between citizens and military personnel in a camera feed.
  • this can include recognizing known and memorized trojans, backdoors, and detecting them in a sea of security white noise (logs).
  • logs security white noise
  • 3 Lette Scanner 615 the Chaotic Field 613 is scanned and checked against 3 letter segments that correspond to a target.
  • 'PLAN is a target, and the scanner moves along the field incrementally every 3 characters.
  • the segments 'PLA', 'LAN', and 'ANT are checked for since they are subsets of the word 'PLANT', Despite this, the words 'LAN' and ⁇ are independent words which also happen to be targets. Hence when one of these 3 letter segments are found in the field, it can imply the full target of 'LAN' or 'ANT' has been found or that a subset of 'PLANT' might have been found.
  • the same concept is applied for the 5 Letter Scanner 616, but this time the segment that is checked with every advancement throughout the field is the entire word ' " PLANT.
  • Targets such as 'LAN' and and 'ANT are omitted since a minimum of 5 letter targets are required to function with the 5 letter scanner.
  • the Chaotic field 613 is segmented for scanning in different proportions ⁇ 3, 5 or more letter scanning) as such proportions offer various levels of scanning efficiency and efficacy. As the scope of the scanning decreases (smaller amount of Setters), the accuracy increases ⁇ and vice-versa). As the field territory of the scanner increases, a larger letter scanner is more efficient for performing recognitions, at the expense of accuracy fit depends on how small the target is).
  • Stage 617 alternates the size of the scanner ⁇ 3, 5 or more) in response to their being unprocessed memory concepts left.
  • fv Ci 500 starts with the largest available scanner and decreases gradually with Stage 61? so that more computing resources can be found to check for the potential existence of smaller memor concept targets.
  • Stage 618 cycles th available memory concepts so that their indexes (smaller segments suited to the appropriat length such as 3 or 5) can be derived at Stag ⁇ 620, Incase the memory concept did not already exist in the Concept Index Holdout 624 then stage 619 will create it as per the logistical flow of actions. Stage 621 then assigned the derived indexes from Stage 620 into the Holdout 624, As the programmed full circle of MCI 500 continues, if MCI runs out of unprocessed letter scanners then it will reach a fork where it either submits an empty (null) result 622 If the Holdout 624 is empty, or submit the non-empt Holdout 624 as modular output 623.
  • Sections of the Chaotic Field 613 range from numerals 625 through 628.
  • Sections 625 and 626 represent a scan performed by a 5 Setter scanner, whilst sections 627 and 628 represent a 3 letter scan.
  • Scan 625 has a 5 Setter width whilst checking for a 6 letter target TOMATO'.
  • Two 5 Setter segments were matched at TO MAT and ⁇ ', which had previously been indexed at MCS 500, Each one of these corresponds to a 5 Setter match out of a 6 Sette word, which further corresponds to 83%. This fraction/percentage is added
  • Scan 626 has a memory concept target of 'EGGPLANT', with two significant segments being 'GGPLA' and 'PLANT', Whilst 'GGPLA' .exclusively refers to the true match of 'EGGPLANT', the segment 'PLAN introduces the potential of a false positive as 'PLAN is in and of itself a memory concept target, for the system to recognize 'PLANT as existing in the Chaotic Field 613 whilst 'EGGPLANT is the only real recognizable memory concept in the Field would be classed as a false positive.
  • Scan 627 has a width of 3 letters, and recognizes the segment TOM', which Seads to an aggregate match of 50% 640, This is the same target as existing in the Field of Scan 625, yet because of the difference in scan width ⁇ 3 instead of 5), a match of weaker confidence (50% vs 167%) was found.
  • the design of fvICi 500 includes multiple layers of scan widths to strike the correct balance between accuracy and computing resources spent.
  • Scan 623 also incorporates a widt of 3 letters, this time with two potential false positive tangents 636, Whilst the actual concept in the Field is 'CARROT, the concepts 'CAR' and 'ROT' are considered for existing in and of themselves in the Field.
  • the scanner must now discern which is the correct concept that is located in the Chaotic Field 613. This is checked with subsequent scans done on nearby letters. Eventually, the scanner recognizes the concept as 'CARROT and not 'CAR' or 'ROT', because of the corroboration of other located indexes.
  • the 100% composite match of 'CAR' 641 and the 100% composite match of 'ROT' 643 both lose out to the 200% composite match of 'CARROT' 642.
  • FIG. 9S - 99 shows Field Interpretation Logic ⁇ Fit ⁇ 644 and 645, which operates the logistics for managing scanners of differing widths with the appropriate results.
  • the General Scope Scan 629 begins with a large letter scan. This type of scan can sift through a large scope of field with fewer resources, at the expense of small scale accuracy. Hence the smaller Setter scanners are delegated for more specific scopes of field, to improve accuracy where needed.
  • the Specific Scope Scan 630 is used when an area of significance has been located, and needs to be 'zoomed in' on. The general correlation is that the smaller the field scope selected for scanning., the smaller type of scanner (less letters ⁇ .
  • Section 645 of FIL displays the reactionary logistics to scanner results, if a particular scan er receives additional recognition of memory concepts in the Chaotic Field 613, this indicates that that Field Scope 631 (section of 613) contains a dense saturation of memory concepts and it Is worth 'zooming in” on that particular scope with smaller width scans.
  • Field Scope 631 section of 613 contains a dense saturation of memory concepts and it Is worth 'zooming in" on that particular scope with smaller width scans.
  • a 5 Setter scanner with a field scope of 30% 632 will activate a 3 tetter scanner with a field scope of 10% 633 contingent on their being an initial result returned considered as "increased 'Extra' Recognition" 634.
  • the 'extra' in 634 indicates the recognition being supplemental to the initial recognition performed in FIL Section 644.
  • Figs. 100 - 101 shows the Automated Perception Discovery Mechanism (APDM) 467.
  • Angle of Perception A 647 yields a limited scope of information about the Observable Object as it is rendered in two dimensions.
  • Angle of Perception B 648 yieids a more informed scope as it includes the third dimension.
  • the resu lt of Angle of Perception C 649 is unknown to our limited thinking capabilities as the creative hybridization process Creativity 18 is being leveraged by modern parallel processing power.
  • Angle of Perceptions 650 are defined in composition by multiple metrics including yet not limited to Scope, Type, Intensity and Consistency 651.
  • the Perception Weight 652 defines how much relative influence a Perception has whilst emulated by the Perception Observer Emulator (POE) 475» This weights of both input Perceptions are considering whilst defining the weight of the Newly Iterated ' Perception 653, This New iterated Perception 653 contains hybridized metrics that are influenced from the previous generation of Perceptions: A + 8. Such a new Angle of Perceptio might potentiall offer a productive new vantage point for security software to detect covert exploits. Generations of perceptions are chosen for hybridization via a combination of trial/error and intelligent selection, if a perception, especially a newly iterated one, proves to be useless in providing insights in security problems, then it can be
  • Fig, 102 shows Raw Perception Production (RP2) 465 which is a Module that receives metadata logs from the Selected Pattern Matching Algorithm ⁇ 5PMA ⁇ 526. Such logs ar parsed and a perception is formed that represents the perception of such algorithm.
  • the perception is stored i a Perception Complex Format (PCF ⁇ , and is emu lated by the Perception Observer Emuiator (POE), System Metadata Separation .(SMS) 487 provides output of Security
  • Response/Variable pairs 654 which establishes security cause-effect relationships as appropriate corrective action is coupled with trigger variables ⁇ such as subject, location, behavioral analysis etc. ⁇ .
  • the Comparable Variable Formats 547 are represented In non- graphical terms 655. Each one of these perception collections has a varying assortment of perceptions with a specific weighted influence to form the CVF 547.
  • Fig. 103 shows the logic flow of the Comparable Variable Format Generator (CVFG) 491.
  • the in put for the CVFG is Data Batch 658, which is an Arbitrary Collection of data that represents the data that must be represented by the node makeup of the generated CVF 547.
  • Stage 659 performs a sequential advancement through each of the individual units defined by Data Batch 658.
  • the data unit is converted to a Node format at Stage 660, which has the same composition of information as referenced by the final CVF 547.
  • Nodes are the buiiding biocks of CVFs, and allow for efficient and accurate comparison evaluations to be performed against other CVFs.
  • a CVF is like an irreversible MD5 hash-sum, except that it has comparison optimized characteristics (nodes).
  • Such converted Nodes are then temporarily stored in the Node Holdout 661 upon checking for their existence at Stage 665, if they ar not found then they are created at Stage 662 and updated with statistical information such as occurrence and usage at Stage 663.
  • Stage 664 all the Modes with the Holdout 661 are assembled and pushed as modular output as a CVF 547. if after the Generator has run the Holdout 661 is empty then a null result is returned 618-
  • the Node Comparison Algorithm ⁇ NCA ⁇ 667 is comparing two Node Makeups 666 and 668, which have been read from the raw CVF 547.
  • Each node of a CVF represents the degree of magnitude of a property.
  • a similarity comparison is performed on art individual node basis, and the aggregate variance is calculated. This ensures an eff iciently calculated accurate comparison.
  • Mode Applicability Example when comparing Tree A with Forest A, Tree A will find its closest match Tree B which exists within Forest A. With WMM If ther is an active node in one CVF and it not found in its comparison candidate (the node is dormant ⁇ , then the comparison is penalized.
  • Figs, 105 to 106 show System Metadata Separation (SMS) 487 which separates Input System Metadata 484 into meaningful security cause-effect relationships.
  • SMS System Metadata Separation
  • programming elements of the logs are retrieved individually at Stage 672.
  • individual categories from the MCM are used to get a more detailed composition of the relationships between security responses and security variables (security logs).
  • Scan/Assimilation 669 the subject/suspect of a security situation is extracted from the system metadata using premade category containers and raw analysis from the Categorization Module, The subject is used as the main reference point for deriving a security response/variable relationship.
  • a subject can range from a person, a computer, an executable piece of code, a network, or even an enterprise.
  • Such parsed Subjects 682 are stored in Subject Storage 679.
  • Risk Scan/Assimiiatjon 670 the risk factors of a security situation are extracted from the system metadata using premade category containers and raw analysis from the Categorization Module. The risk is associated with the target subject which exhibits or Is exposed to such risk.
  • a risk can be defined as potential point of attack, type of attack vulnerability etc.
  • Risk Storage 680 With associations to their reiated Subjects at Subject Index 683, With Response Scan/Assimilation 671 the response of a security situation made by the input algorithm is extracted from the system metadata using premade category containers and raw analysis from the Categorization Module. The response is associated with the security subject which allegedly deserves such a response. Responses can range from
  • Such Responses are stored I Response Storage 681 With associations to their related Subjects at Subject Inde 683.
  • Such stored information is thers processed by the Popuiator Logic ⁇ PL) 483 which
  • 0142J Figs, 107 to 108 shows the Metadata Categorization Module (IV1CM) 488, In Format Separation 688 the metadata is separated and categorized according to the rules and syntax of a recognized format. Such metadata must have been assembled in accordance with a recognizable format, or else the metadata is rejected for processing.
  • Local Format Rules and Syntax 689 contains the definitions that enable the MCM module to recognize pre-formatted streams of metadata. Local implies 'of a format' that has been previously selected due to relevancy and presence in the metadata.
  • Debugging Trace 485 is a coding level trace that provides variables, functions, methods and classes that are used and their respective Input and output variable type /content. The full function call chain (functions calling other functions) is provided.
  • Algorithm Trace 486 is a Software level trace that provides security data coupled with algorithm analysis. The resultant security decision (approve/block) is provided along with a trail of how it reached that decision ⁇ justification), and the appropriate weight that each factor contributed into making that security decision. Such Algorithm trace 486 leads to the Ov 's mode of cycling through each one of these security decision justifications at Stage 686. Such justifications define how and why a certain security response was made in computer log syntax ⁇ as opposed to written directly by humans). Recognizable Formats 687 are pre-ordained and standardized syntax formats that are compatible with CMTP, Hence if the format declarations from the Input System Metadata 484 are not recognized then a modular null result is returned 618.
  • St is the obligation of the programmers of the SPMA 526. to code the Metadata 484 in a standardized format that is recognizable by CT P. Such formats do not need to be proprietary and exclusive to CTMP, such as JSON and XML etc.
  • Variable Holdout 684 is where processing variables are held categorically 674 so that they can be submitted as a final and unified output all at once 685, Stage 675 does a comparison check between the two main branches of input information which are Debugging Trace 485 and Algorithm Trace 486.
  • Fig, 109 shows Metric Processing (MP) 489, which reverse engineers the variables from the Selected Pattern Matching Algorithm ⁇ SPMA ⁇ 526 security response to 'salvage' perceptions from such algorithm's intelligence.
  • Security Response X 690 represents a series of factors that contribute to the resultant security response chosen by the SPMA ⁇ i.e.
  • Approve/Bbck/Obfuscate etc. ⁇ Each one of the shapes represents a security response from the Selected Pattern Matching Algorithm fSPMA), The !nitia! weight is determined by the SPMA, hence it's intelligence is being leveraged. Such decisions are then referenced in bulk to model perceptions.
  • Perception Deduction (PO) 490 uses a part of the secu rity response and its corresponding system metadata to replicate the original perception of the security response.
  • Perception Interpretations of the Dimensional Series 699 display how PD will take the Security Response of the SPMA and associate the relevant input System Metadata 484 to recreate the full scope of the intelligent 'digital perception * as used originally by the SPM A.
  • Shape Fill 697, Stacking Quantity 698, and Dimensional 699 are digital perceptions that capture the 'perspective' of an intelligent algorithm.
  • the Dimensional 599 type of perception represents a three-dimensional shape, which can be a symbolic representation for a language learning algorithm that interprets company employee's internal emails and attempts to detect and/or predict a security breach of company sensitive information. Whilst the Dimensional type may be a single intelligent algorithm with slight variations ⁇ i.e.
  • variation 694C is circular whilst 695C/696C is rectangular, representing subtle differences in the intelligent algorithm), there can be multiple initial security responses that at face value might not appear to have been made by such an algorithm.
  • face value 894A appears to have more in common with 692A than 696A.
  • 692A is a security response that was performed by an algorithm Shape Fill 697 which is entirely differen than Dimensional 699, Whilst perceptions 695C and 696C are Identical, their Security Response counterparts 695A and 696A have subtle differences.
  • Security Response 695A is darker and represents the Dimensional Perception from the side 695B whilst 696A represents the exact same perception albeit from the front 696B,
  • CTMP Whilst CTMP initially receives only a single security profile, which is represented as Security Response 693A, it is in fact part of a collection of inter- referencing profiles known (after MP 489 performs reverse engineering ⁇ as Perception Stacking Quantity 698. Such a perception can be referenced within CTMP as Angle of Perception A 701 For Security Responses 691A and 692A a Security Response is provided to MP 489 that is symbolically represented as an incomplete shape.
  • PD 490 leverages the Input System Metadata to find out that intelligent algorithm of which this Security Response originated is looking for the absence of an expected security variable. For example, this can be an algorithm that notices the absence of regular/expected behavior as opposed to noticing the presence of suspicious behavior.
  • Such an algorithm is reverse engineered to be the digital perception Shape Fill 697 which can be referenced within CTIV1P as Angle of Perception C 700 with the appropriate weight of influence.
  • Figs, 110 and 111 shows the interna! design of Perception Deduction (PD) 490,. which Is primar used by Metric Processing ⁇ MP ⁇ 489, Security Response X is forwarded as input into justification/Reasoning Calculation 704,
  • This module determines the justification of the security response of the SPMA 526 by leveraging the intent supply of the input/Output Reduction ⁇ IGR ⁇ module 706 as stored in the Intend DB 705,
  • Such module IOR interprets the input/output relationship of a function to determine the justification and intent of the function's purpose.
  • the IOR module uses the separated input and output of the various function calls listed in the metadata.
  • Metadata Categorization Module MCM 488
  • JRC 704 the function intentions stored in the Intent DB 705 are checked against the Security Responses provided as input 690, if the function intentions corroborate the security decisions of the SPMA then they are submitted as a vaiid justification to Justification to Metric Conversion JMC 703.
  • the validated security response justification is converted into a metric which defines the characteristic of the perception. Metrics are analogous to human senses, and the security response justification represents the justification for using this sense.
  • I/O relationships are categorized according to similarity 709, For example, one I/O relationship is found to convert one currency to another (i.e.
  • I/O relationships are categorized as belonging to data conversion due to trigger concepts being correlated with a categorization index. For example, such an index can have referenced to USD, EUR and pounds, kilograms make reference to the data conversion category. Hence once those units are found in an I/O relationship then IOR 706 is able to properly categorize them. Hence the function's intent is being suspected of being a currency and units conversion function. Upon categorizing all the available I/O relationships the categories are ranked according to the amount of I/O relationships weight that they contain at Stage 710, with the most popular appearing first.
  • the categories of I/O data are checked if they are able to confidently display a pattern of the funtion's intent. This is done by checking for consistency in the input to output transformation that the function performs. If a certain category of information is persistent and distinct ⁇ such as converting currency as one category and converting units as a second category), then these category become described intents' of the function. Hence the function ili be described as having the intention of converting currencies and units.
  • Figs. 112 - 115 display the Perception Observer Emu!ar ⁇ POE ⁇ 475
  • This module produces an emulation of the observer, and tests/com ares all potential points of perception with such variations of observer emulations. Whilst the input are ail the potential points of perception plus the enhanced data logs; the output is the resultant security decision produced of such enhanced logs according to the best,, most relevant, and most cautious observer with such mixture of selected perceptions, input System Metadata 484 is the initial input that is used by Ra Perception Production (RP2) 46S to produce perceptions in the Comparable Variable Format CVF 547.
  • RP2 Ra Perception Production
  • Logs 723 are the input logs of the system with the original security incident.
  • the Self-Critical Knowledge Density (SC D) 492 tags the logs to define the expected upper scope of unknown knowledge. This means that the perceptions are able to consider data that is tagged with unknown data scopes. This means that the perceptions can perform a more accurate assessment of the security incident, considering it has an estimation of how much it knows, as well as how much it doesn't know.
  • Data Parsing 724 does a basic interpretation of the Data Enhanced Logs 723 and the input System Metadata 484 to output the original Approve or Block Decision 725 as decided by the original Selected Pattern Matching Algorithm (SPMA) 526,
  • SPMA Selected Pattern Matching Algorithm
  • the SPMA has either chosen to block 730 the security related incident fi,e. prevent a program download) in Scenario 727 or has chosen to Approve 731 such incident in Scenario 726,
  • CT P 22 has progressed thus far that it is ready to perform its most core and crucial task which is to criticize decisions (including but not limited to cyfaersecurity .
  • the RMA Feedback module 728 is engaged at Stage 732D to attempt to reevaluate the security situation with more perceptions included. Such additionally considered perceptions may increase the confidence margin.
  • the MA feedback wiii communicate with Resource Management and Allocation (RMA) 479 Itself to check if a revaluation is permissible according to resource management policy, if such revaluation is denied, then the algorithm has reached it 1 s peak confidence potential and overriding th ⁇ initial approval/block decision is permanently aborted for this POt session.
  • RMA Resource Management and Allocation
  • Stage 732E indicates a condition of the !v!A Feedback module 723 receiving permission from RMA 47S to reallocate more resources and hence more perceptions into the calculation. Upon such a condition the override attempt ⁇ CTMP criticism) Is aborted at Stage 73;2F as to a How for the new evaluation of Case Scenario 727 to take place with the addition perceptions ⁇ and hence computer resource load increase).
  • Stage 732G indicates the Approve average is confident enough ⁇ according to poiicy) to override the Default Block action 730/732A to an Approve action 731 at Stage 732H. The same logic applies to the Approve logic 733 which occurs at Case Scenario 726.
  • Stage 733A the default action is set to Approve as requested by the SPMA 526.
  • Th BLOCK ⁇ AVG and APPROVE-AVG values 733B are calculated by finding the average of the Block/Approve confidence values stored in Case Scenario 726,
  • Stage 733C checks if the average confidence of Case Scenario 726 is greater than a pre-defined ⁇ by policy) confidence margin. Upon such a low confidence situation arising the RMA Feedback module 728 is engaged at Stage 733D to attempt to reevaluate the security situation with more perceptions included.
  • Stage 733E indicates a condition of the RMA Feedback module 728 receiving permission from RMA 479 to reallocate more resources and hence more perceptions into the calculation.
  • Stage 733F indicates the Approve average is confident enough ⁇ according to policy) to override the Default Approve action 731/733A to a Block action 730 at Stage 733H, 01461 Figs, 116 to 117 shows implication Derivation (ID) 477 which derives angles of perception data that can be implicated from the current known angles of perceptions.
  • Applied Angles of Perception 470 is a scope of known perceptions which are stored in a CTMP storage system.
  • Such perceptions 470 have been applied and used by the 5PMA 526, and are gathered as a collection of perceptions 734 and forwarded to Metric Combination 493.
  • This module 493 converts the Angle of Perceptions 734 format into categories of metrics which is the format recognized by Implication Derivation (ID) 477.
  • ID Implication Derivation
  • Metric Complexity 736 the outer bound of the circie represents the peak of known knowledge concerning the individual metric. Hence towards the outer edge of the circle represents more metric complexity, whilst the center represents less metric complexity.
  • the center light grey represents the metric combination of the current batch of Applied Angles of Perception
  • the outer dark grey represents metric complexity thai is stored and known by the system in general
  • ID 477 is to increas the complexity of relevant metrics, so that Angles of Perception can be multiplied in compiexity and quantity.
  • Known metric complexity from the current batch is added to the relevant Metric DB 738 incase it does not already contain such detail/complexity. This way the system has come full circie and that newly stored metric complexity can be used in a potential future batch of Angles of Perception Implication Derivation.
  • Such Complex Metric Makeup 736 is passed as input to Metric Expansion (ME) 495, where the metrics of multiple and varying angles of perception are stored categoricall in individual databases 738,
  • the dark grey surfac area represents the total scope of the current batch of Applied Angles of Perception, and the amount of scope left over according to the known upper bound.
  • the upper bound is represented by the peak knowledge of each individual Metric DB,
  • the current batch of metrics (which hav been derived by the current batch of Angles of Perception) are enhanced with previously known details/complexity of those metrics,
  • the metrics are returned as Metric Compiexity 737.
  • Figs. 118 - 120 show Self-Critical Knowiedge Density (SCKD ⁇ 492, which estimates the scope and type of potential unknown knowiedge that Is beyond the reach of the reportable logs. This way the subsequent critical thinking features of the CT P 22 can leverage the potential scope of all involved knowledge,, known and unknown directly by the system.
  • SCKD ⁇ 492 Self-Critical Knowiedge Density
  • Known Data Categorization (KDC) 743 categorically separates confirmed (known) Information from input 746 so that an appropriate DB analogy query can be performed. Such information is separated into categories A, 8, and C 750, after which the separate categories individually provide input to the Comparable Variable Format Generator (CVFG) 491.
  • the CVFG then outputs the categorical information i CVF 547 format,, which is used by St rage Search (SS) 480 to check for similarities in the Known Data Scope DB 747, With DB 747 the upper bound of known data is defined according to data category, A comparison is made between similar types and structures of data to estimate the confidence of the knowledge scope.
  • CVFG Comparable Variable Format Generator
  • Scenario 748 descri bes a results found situation, upon which each category is tagged with it's relevant scope of known data according to the SS 480 results. Thereafter the tagged scopes of unknown information per category are reassembled back into the same stream of original data ⁇ Input 746) at the Unknown Data Combiner (UDC) 744.
  • UDC Unknown Data Combiner
  • Known Data Categorization (KDC) module 743 is illustrated in greater detail.
  • Known Data 752 is the primary input and contains Blocks of information 755 that represent defined scopes of data such as individual entrie from an error log.
  • Stage 756 checks for recognizable definitions within the block which would show, as per the Use Case, that It is labelled as Nuclear Physics information.
  • the pre-existing Category Is strengthened with details at Stage 748 by supplementing it with the processed block of information 755, If no such category exists then it is created at Stage 749 so that the block of information 755 can be stored accordingly and correctly.
  • the Rudimentary Logic 759 cycles through the blocks sequentially until all of them have been processed. After all of them having been processed, if not the minimum amount (defined by policy) was submitted to the Category Holdout 750,. then KDC 743 submits modular output as null result 618. If there is a sufficient amount of processed blocks then the Category Holdout 750 is submitted to the intermediate Algorithm 751 ⁇ which is primarily SCKD 492). Unknown Data Combiner ⁇ UDC ⁇ 744 receives known data which has been tagged with unknown data point 757 from the Intermediate
  • Such data is initially stored in the Category Holdout 750 and from there
  • Rudimentary Logic 780 cycles through that all units of data sequentially.
  • Stage 754 checks if the defined categories from Holdout 750 contain the original metadata which describes how to reconstruct the separate categories into a congruent stream of information, Such metadata was originally found in the input Known Data 752 from KDC 743, since at that stage the data had yet to be separated into categories and there was an initial single congruent structure that held all the data. After Stage 754 reassociates the metadata with their counterpart data the tagged blocks are transferred to the Block Recombination Holdout 753.
  • Fig. 121 shows the main logic for Lexical .Objectivity Mining (LGfvl), LGfvl attempts to reach as close as possible to the objective answer to a wide range of questions and/or assertions, it engages with the Human Subjec 800 to allow them to concede or improve their argument against the stance of LOIVI.
  • LGfvl Lexical .Objectivity Mining
  • LOIvl's activity begins with Human Subject 800, who posits a question or assertion 801 into the main LOEvl visual interface, Such a question/assertion 801A is transferred for processing to initial Query reasoning (IQ ) 802 which leverages Central Knowledge Retention (CKR) 806 to deciphe missing details that are crucial in understanding and answering/responding to the Question/Assertion.
  • IQ initial Query reasoning
  • CKR Central Knowledge Retention
  • the Question/Assertion 801 along with the supplemental query data is transferred to Survey Clarification (SC) S03A which engages with the Human Subject 800 to achieve supplemental information so that the Question/Assertion 801A can be analyzed objectively and with all the necessary context.
  • Clarified Question/Assertion 8018 is formed, which takes the original raw Question/Assertion 801 as posed by Human Subject 800 yet supplements details learnt from 800 via SC 803A.
  • Assertion Construction (AC) 808A receives a proposition in the form of an assertion or question (like 801S) and provides output of the concepts related to such proposition.
  • Response Presentation 809 is an interface for presenting a conclusion drawn by LOM (specifically AC SOS) to both Human Subject 800 and Rational Appeal (RA) 811. Such an interface is presented visually for the Human 800 to understand and in a purely digital syntax format to RA 811.
  • Hierarchical Mapping (H ) 807A maps associated concepts to find corroboration or conflict in Question/Assertion consistency, it then calculates the benefits and risks of having a certain stance on the topic.
  • Central Knowledge Retention 806 is the main database for referencing knowledge for LOM. Optimized for query efficiency and logical categorization and separation of concepts so that strong arguments can be built,, and defeated in response to Human Subject 800 criticism.
  • Knowledg Validation (KV) S0SA receives high confidence and pre-criticised knowledge which needs to be logically separated for query capability and assimilation into the CKR 806.
  • Accept Response 810 is choice given to the Human Subject 800 to either accept the response of LOM or to appeal it with a criticism, if the response is accepted, then. it i processed by KV 805A so that it can be stored In CKR 806 as confirmed ⁇ high confidence) knowledge. Should the Human Subject 800 not accept the response, they are forwarded to Rational Appeal (RA) 811A which checks and criticises the reasons of appeal given by Human 800.
  • RA 811A can criticise assertions whether it be self- criticism or criticism of human responses (from a 'NO' response at Accept Response 810).
  • Figs, 122 - 124 shows Managed Artificially Intelligent Services Provider ⁇ A1SP) 804A.
  • MAISP runs an internet cloud instance of LOM with a master instance of Central Knowledge Retention (CKR) 806.
  • MAISP 804A connects LOM to Front End Services 861 A,, Back End Services 861B, Third Party Application Dependencies 804C, information Sources 804B, and the MNSP 9 Cloud.
  • Front End Services 861A include Artificially Intelligent Personal Assistants (i.e. Apple's Siri, Microsoft's Corta na , , Amazon's Aiexa, Google's Assistant), Communication Applications and Protocols (i.e. Skype, WhatsApp) , , Home Automation (I.e.
  • Back End Services B61S include online shopping (i.e. Amazon.com), online transportation ⁇ i.e. Uber), Medicai Prescription ordering (i.e. CVS) etc.
  • Such Front End 861A and Sack End 861S Services interact with LOM via a documented API infrastructure 804F which enables standardization of information transfers and protocols.
  • LOM retrieves knowledge from external information Sources 8048 via the Automated Research Mechanism (ARM) 805B, [0150]
  • Figs, 125 - 128 show the Dependency Structure of LOW , which indicates how modules inter-depend on each other.
  • Linguistic Construction (LC) 812A interprets raw question/assertion input from the Human Subject 800 and parallel modules to produce a logical separation of linguistic syntax that can be understood by the LOM system as a whole.
  • Concept Discovery (CD) 813A receives points of interest within the Clarified Question/Assertion 304 and derives associated concepts by leveraging CK 806.
  • Concept Prioritization (CP) 814A receives relevant concepts and orders them in logical tiers that represent specificity and generality. The top tier is assigned the most general concepts, whilst the lower tiers are allocated Increasingly specific concepts.
  • LC 812A to understand the Human Response and associate a relevant and valid response with the initial clarification request * hence accomplishing the objective of SC 803A.
  • LC 812A Is then re-ieveraged during the output phase to amend the original Question/Assertion 801 to include the supplemental information received by SC 803.
  • Human interface Module (Hlivl) 816A provides clear and logically separated prompts to the Human Subject 800 to address the gaps of knowledge specified by initial Query Reasoning (IQR) 802A.
  • Context Construction (CC) SUA uses metadata from Assertion
  • Benefit/Risk Calculator f 8RC) 820A receives the compatibility results from CCD 819A and weighs th benefits and risks to form a uniform decision that encompasses the gradients of variables implicit i n the concept makeu p.
  • Concept interaction (CI) 821 A assigns attributes that pertain to AC 808A concepts to parts of the information collected from the Human Subject 800 via Survey Clarification (SC) S03A,
  • Figs, 129 and 130 shows the inner logic of initial Query Reasoning ⁇ SQR) 802A.
  • Linguistic Construction (LC) 812A acting as a subset of SQR 802, receives the original Question/Assertion 801 from the Human Subject 800.
  • 801 is linguistically separated so that SQR 802A processes each individual word/phrase at a time.
  • the Auxiliary Verb 'Should' 822 evokes a lack of clarity concerning the Time Dimension 822. Hence counter questions are formed to reach clarity such as 'Every day?', 'Every week?' etc.
  • the Subject 823 evokes a Sack of ciarity concerning who is the subject, hence follow up questions are formed to be presented to the Human Subject 800.
  • the Verb 'eat' 824 is not necessarily unclear yet is abfe to supplement the other points of analysis that lack clarity.
  • iQR 802 connects the concept of food with concepts of health and money at Stages 824 by leveraging the CKR 806 DB. This informs the query 'Subject Asking Question' 823 so that more appropriate and relevant follow up questions are asked such as 'Male or Female?', 'Diabetic? * , 'Exercise?', 'Purchasing Power?'.
  • the Noun 'fast-food' 825 evokes a lack of clarity in terms of how the word should be interpreted, it can either be interpreted in it's rawest form of 'food that is served very fasf at Technical Meaning 827, or it's more colloquial understanding 826 of 'fried-salty-like foods that ar cheap and are made very quickly at the place of ordering'.
  • a salad bar is technically a fast means of getting food as it is pre-rrsad and instantly available.
  • this technical definition does comply with the more commonly understood colloquial understanding of 'fast-food'. 8y referencing CKR 806, IQR 802 considers the potential options that are possible considering the ambiguity of the term 'fast- food'.
  • Such ambiguous options such as 'Burger Store?' and 'Salad Bar?' can be forwarded to the Human Subject 800 via the Human Interface Module (HIM) 816.
  • HIM Human Interface Module
  • CKR 806 there may be suff icient information at CKR 806 to understand that the general context of the Question 801 indicates a reference fo the Colloquial Meaning 826.
  • CKR 806 is able to represent such a general context after gradually learning that there is a level of controversy involved with fast-food and health.
  • Hi ivl 816 does not need to be invoked to further clarify with Human Subject 800,
  • IQR 802 seeks to decipher obvious and subtle nuances in definition meanin s.
  • Question 828 indicates to LQ as a whole that the Human Subject 800 is asking a question rather than asserting a statement.
  • Fig. 131 shows Survey Clarification fSC) 803, which receives input from !QR 802. Such input contains series of of Requested Clarifications 830 that must be answered by Human Subject 800 for an objective answer to the origmai Question/ Assertion 801 to be reached.
  • Requested Clarifications 830 is forwarded to the Human interface Moduie (H!SVI) 816B. Any provided response to such clarifications are forwarded to Response Separation Logic ⁇ RSL) EISA which thereafter correlates the responses with the clarification requests, in parallel to the Requested Clarifications 830 being processed, Ciarification Linguistic Association 829 is provided to Linguistic Construction (LC) 812A. Such Association 829 contains the the internal relationship between Requested Clarifications 830 and the language structure. This in turn enables the RSL 8X5A to amend the original Question/Assertion 801 so that LC 812A can output the Clarified Question 804, which has incorporated the information learnt via HIM 816.
  • Fig. 132 shows Assertion Construction (AC) 80S, which received the Clarified
  • Concept Prioritization ⁇ CP) 814A is then able to order concepts 832 into logical tiers that represent specificity and generality. The top tier is assigned the most general concepts, whilst the tower tiers are allocated increasingly specific concepts, Such ordering was facilitated with the data provided by CKR 806.
  • HM 807 Hierarchical Mapping
  • HM 807 receives the Points of interest 834, which are processed by its dependency module Concept interaction ⁇ CI ⁇ 821.
  • CI assigns attributes to such Points of Interest 834 by accessing the indexed information available at CKR 806,
  • HM 807 completing Its internal process, its final outpu is returned to AC 808 after the derived concepts have been tested for compatibility and the ben fits/risks of a stance are weighed and returned.
  • JO153J Figs. 133 and 134 show the inner details of how Hierarchical Mapping (HM) 807 works.
  • AC 808 provides two types input to HM 807 in paraiiei. One is known as Conceptual Points of Interest 834, and the other is the top tier of prioritized concepts 837 ⁇ the most general).
  • Concept Interaction (CI) 821 uses both inputs to to associate contextuallzed conclusions with Points of interest 834, as seen in Fig, 128.
  • CI 821 then provides input to Concept Compatibility Detection ⁇ CCD) 819 which discerns the compatibility/conflict level between two concepts.
  • CCD Concept Compatibility Detection
  • HM 807 the general understanding of agreement versus disagreement between the assertions and/or propositions of the Human Subject 800 and the high-confidence knowledge indexed in Centra! Knowledge Retention (C R) 806.
  • Such compatibility/conflict data is forwarded to Benefit/Risk Calculator (BRC) 820, a module that translates these compatibilities and conflicts into benefits and risks concerning taking a holistic uniform stance on the issue.
  • BRC Benefit/Risk Calculator
  • Point of Interest 'diabetic' 838 leads to the assertion of 'Expensive Medicine' concerning 'Budget Constraints' 837 and 'More fragile Healtb'/'Sugar intolerance' concerning 'Health' 837, Point of interest 'male' 839 asserts 'typically pressed for time' despite with a low confidence, as the system is discovering that more specificity is needed such as for 'workaholics' etc.
  • Point of Interest 'Middle Class' 840 asserts Is able to afford better quality food' concerning 'Budget Constraints'" 837.
  • Point of interest 'Burger King' 841 asserts 'Cheap' and 'Saving' concerning 'Budget Constraints' 837, and 'High Sugar Content' plus 'Fried Food' concerning 'Health' 837.
  • Such assertions are made via referencing established and confident knowledge stored in CKR 806,
  • Figs. 135 and 136 show the inner details of Rational Appeal (RA) 811, which criticized assertions whether it be self-criticism or criticism of human responses.
  • LC 812A acts as a core sub-component of RA 811, and receives input from two potential sources. One source is if the Human Subject 800 rejects an opinion asserted by LOW at Stage 842. The other source is Response Presentation 843, which will digitally transmit an assertion constructed by AC 808 for LO!y! interna! self-criticism. After LC 812A has converted the linguistic text into a syntax understandable to the rest of the system, it is processed by A's Core Logic 844.
  • Core Logic 844 received Input from LC 812A in the form of a P re-Criticize Decision 847 without linguistic elements (using instead a syntax which is optimal for Artificial intelligence usage). Such a Decision 847 is forwarded directly to CTMP 22 as the 'Subjective Opinion' 848 sector of it's input.
  • Decision 847 is also forwarded to Context Construction (CC) 817 which uses metadata from AC 808 and potential evidence from the Human Subject 800 to give raw facts (i.e. system logs) to CTMP 22 as input Objective Fact'. With CTMP 22 having received it's two mandatory inputs, such information is processed to output it's best attempt of reaching 'Objective Opinion' 850.
  • CC Context Construction
  • Such opinion 850 Is treated internally within RA 811 as the Post-Criticized Decision 851
  • Both Pre-Criticteed 847 and Post-Criticized 851 decisions are forwarded to Decision Comparison (DC) 818, which determines the scope of overla between both decisions 847 and 851.
  • DC Decision Comparison
  • the appeal argument is then either conceded as true 852 or the counter-point is improved 853 to explain why the appeal is invalid.
  • Such an assessment is performed without consideration nor bias of if the appeal originated from Artificial Intelligence or Humans, indifferent to a Concede 852 or improve 852 scenario, a result of high confidence 846 is passed onto KV 805 and a result of low confidence 845 Is passed onto AC 808 for further analysis,
  • Figs. 137 - 138 show the inner details of Central Knowledge Retention (CKR) ; which is where LOfvl's data-based intelligence is stored and merged.
  • Units of information are stored in the Unit Knowledge Format (UKF) of which there are three types: UKFl 855A, UKF2 855 B, UKF3 8S5C, UKF2 8558 is the main format where the targeted information is stored in Rule Syntax Format (RSF) 538, highlighted as Value S6SH.
  • index S56D is a digital storage and processing compatible/complaint reference point which allows for resource efficient references of large collections of data.
  • Timestamp 856C which Is a reference to a separate unit of knowledge via Index 856A known as UKFl SS5A, Such a unit does not hold an equivalent Timestamp 858C section as UKF2 8558 did, but instead stores a multitude of information about timestamps in the Value 856 ⁇ sector in RSF 538 format.
  • Rule Syntax Format (RSF) 538 is a set of syntactical standards for keeping track of references rules. Multiple units of rules within the RSF 538 can be leveraged to describe a single object or action.
  • UKFl 855A contains a Source Attribution 8568 sector, which is a reference to the Index 856G of a U F3 S55C instance.
  • a unit UKF3855C Is the inverse of UKFl 855A as it has a Timestamp section but not a Source Attribution section. This is because UKF3 855C stored Source Attribution 856E and 856B content in it's Value 856H sector in RSF 538.
  • Source attribution is a collection of complex data that keeps track of claimed sources of information. Such sources are given statuses of trustworthiness and authenticity due to corroborating and negating factors as processed in KCA 816D.
  • UKF Cluster 854F is composed of a chain of UKF variants linked to define jurtsdictionaljy separate information (time and source are dynamically defined).
  • UKF2 855B contains the main targeted information.
  • UKFl 855A contains Timestamp informatio and hence omits the timestamp field itself to avoid an infinite regress.
  • UKF3 855C contains Source Attribution information and hence omits the source field itself to avoid an inf inite regress.
  • Every UKF2855B must be accompanied by at least one UKFl 855A and one U F3 855C, or else the cluster (sequence) is considered incomplete and the information therein cannot be processed yet by LOIVl Systemwide General Logic 859, In between the central U F2 8S5B (with the central targeted information) and it's corresponding UKFl 855A and U F3 85SC units there can be UKF2 8558 units that act as a linked bridge.
  • a series of UKF Clusters 8540 will be ocessed by KCA 816D to form Derived Assertion 854B, Likewise, a series of UKF Clusters 854E wiii be processed by KCA 816D to form Derived Assertion 854C.
  • KCA 816D Knowledge Corroboration Analysis 816D is where UKF Clustered information is compared for corroborating evidence concerning an opinionated stance. This algorithm takes into consideration the reliability of the attributed source, when such a ciaim was made, negating evidence etc. Therefore after processing of KCA 816D is complete, CKR 806 can output a conciuded Opinionated stance on a topic 854A. CKR 806 never deletes information since even information determined to be false can be useful for future distinction making between truth and falsehood. Hence CKR 806 runs off of an advanced Storage Space Service 8546 that can handle and scale with the indefinitely growing dataset of CKR 806.
  • Fig. 139 shows the Automated Research Mechanism (ARM) 8058, which attempts to constantly supply CKR 808 with new knowledge to enhance LO 's general estimation and decision making capabilities.
  • ARM Automated Research Mechanism
  • User Activity 8S7A As users interact with IOM ⁇ via any available frontend) concepts are either directly or indirectly brought as relevant to answering/responding to a question/assertion.
  • User Activity 857A is expected to eventually yield concepts that CKR 806 has low or no information regarding, as indicated by List of Requested Yet Unavailable Concepts 8578.
  • CSP Concept Sorting & Prioritization
  • Concept definitions are received from three independent sources and are aggregated to prioritize the resources ⁇ bandwidth etc) of information Request (!R) 812B.
  • Such a module ifi S12 accesses relevant sources to obtain specifically defined information. Such information is defined according to concept type. Such source ar indicated as. Public News Source 857C
  • CRA Cross-Reference Anaiysis
  • Styiometric Scanning ⁇ SS ⁇ 8088 is a supplemental module that allows CRA 814B to consider stylometric signatures wiii assimilating the new information with preexisting knowledge from CKR 806.
  • Missed Dependency Concepts 857F are concepts which are logically required to be understood as groundwork for comprehending an initial target concept, ⁇ i.e. to understand how trucks work, one must first research about and understand ho diesel engines work).
  • the New Foreign Data 8S8A is marked as having come from a known CNN reporter. However, a very strong styiometric match with the signature of a military think tank is found. Therefore the content is primarily attributed within CKR 806 to the military think tank, and noted as having 'claimed' to he from CNN, This enables further pattern matching and conspiracy detection for later executions of the LOM logic (for example, distrusting future claims of content being from CNN). Assertion corroboration, conflicts and bias evaluations are thereafter assessed as if the content is from the think tank and not CNN.
  • Fig. 140 shows Stylometric Scanning (SS) 80S which analyzes the Stylometric Signature 858C of new foreign content (which the system has yet to be exposed to), Styiometry is the statistical analysis of variations in literary style between one writer or genre and another. This aides CKR 808 in tracking source expectations of data/assertions, which f urther helps LOfVS detect corroborative assertions. With Signature Conclusion (SQ 819B content source attribution of the New Foreign Data 858A is influenced by any significant matches in Styiometry Signature 858C The stronger the stylometric match, the stronger source attribution according styiometry.
  • Styiometry Signature 8S8C is matched against ail known signatures from Si S13B. Any matches in any significant gradients of magnitude are recorded.
  • Signature index (SI) 8138 represents a list of all known Stylometric Signatures 858C as retrieved from CKR 806.
  • LOM depends on any duiy chosen advanced and effective aigorithm styiometry algorithm.
  • Fig. 141 shows Assumptive Override System ⁇ AOS ⁇ 8158, which receives a proposition in the form of an assertion or question and provides output of the concepts related to such a proposition.
  • Concept Definition Matching (COM) 803B is where any Hardcoded Assumptions 8580 provided by the Human Subject 800 are queried against the Dependency interpretation ⁇ Di ⁇ 816B module, AS! such concepts are checked by Ethical Privacy legal (EPt) 8118 for violation concerns.
  • Ethical Privacy legal (EPt) 8118 Ethical Privacy legal
  • In the Dependency interpretation ⁇ Di ⁇ 8168 module all the knowledge based dependencies that fulfill the given response of the requested data are accessed. This way the full 'tree' of ' information which buiids to a highly objective opinion is retrieved.
  • Requested Data 858E is data that LOM Systemwide General Logical 859 has requested, whether that was a specific or conditional query, A specific query seeks art exactly marked set of information. A conditional query requests all
  • Fig. 142 shows Intelligent Information & Configuration Management (l 2 CM) 804E and Management Console 804D.
  • Aggregation 860A uses generic level criteria to filter out unimportant and redu dant information, whilst merging and tagging streams of information from multiple platforms.
  • Threat Dilemma Management 8608 is where the conceptual data danger is perceived from a bird's eye view. Such a threat is passed onto the management console for a graphical representation. Since calculated measurements pertaining to threat mechanics are finally merged from multiple platforms; a more informed threat management decisio can he automatically performed.
  • Automated Controls 860C represents algorithm access to controlling management related controls of MN5P 9, Trusted Platform S6QQ, Third Party Services 8608.
  • Management Feedback Controls 860D offers high level controls of all MNSP 9 Cloud, Trusted Platform (TP) 860Q, additional 3 rd Party Services 860 based services which can be used to facilitate policy making, forensics, threat investigations etc.
  • TP Trusted
  • Management Controls 860D are eventually manifested on the Management Console ⁇ MC ⁇ 804D, with appropriate customizable visuals and presentation efficiency. This allows for efficient control and manipulation of entire systems ⁇ M SO, TP, 3PS) direct from a single interface that can zoom into details as needed.
  • Manual Controls 86QE is for human access to control management related controls of MMSP 9, Trusted Platform 8 ⁇ 0(3 ⁇ 4, and Third Party Services 860R.
  • the intelligent Contexua!izaitom 860F stage the remaining data now looks like a cluster of islands, each island being a conceptual data danger. Correlations are made inter- platform to mature the concept analysis, Hlstorica! data is accessed (from S3 ⁇ 4E 21 as opposed to LIZARD) to understand threat patterns, and CTMP 22 is used for critical thinking analysis.
  • Configuration & Deployment Service 8606 is the interface for deploying new enterprise assets ⁇ computers, laptops, mobile phones) with t e correct conceptual data configuration and connectivity setup. After device is added and setup, they can be tweaked via the
  • This service also manages the deployment of new custom r client user accounts. Such a deployment may inciude the association of hardware with user accounts, customization of interface, listing of customer/client variables (i.e. business type, product type etc. ⁇ .
  • Jurisdiction 860H the tagged poo! of information is separated exclusively according to the relevant jurisdiction of the MC 8040 User.
  • Threat 86GJ the information is organized according to individual threats ⁇ I.e. conceptual data dangers). Every type of data is either correlated to a threat, which adds verbosity, or is removed.
  • Direct Management 860J is an interface for the MC 804D User to connect to Management Feedback Controls 860D via Manual Controls 860E.
  • Category & jurisdiction 8S0H the MC 804D User uses their login credentials which define their jurisdiction and scope of informatiot! categor access.
  • All Potential Data Vectors 8601 represents data in motion, data at rest and data in use.
  • Customizable Visuals 860(VI) is for various enterprise departments (accounting, finance, HR, IT, legal, Security/Inspector General, privacy/disclosure , , union, etc.) and stakeholders (staff, managers, executives in each respective department) as well as 3rd party partners, law enforcement, etc.
  • Unified view on all aspects of conceptual data 860N represents perimeter, enterprise, data center, cloud, removable media, mobile devices, etc.
  • integrated Single View 8600 is a single view of ail the potential capabilities such as monitoring, logging, reporting, event correlation, alert processing, policy/rule set creation, corrective action, algorithm tuning, service provisioning (new customers/modifications), use of trusted platform as well as 3rd party services (including receiving reports and alerts/logs, etc from 3rd party services providers St vendors),
  • the Conceptual Data Team 860P ' is a team of qualified professionals that monitor the activity and status of muitipie systems across the board. Because intelligent processing of information and A! decisions are being made,, costs can be lowered by hiring less people with fewer years of experience.
  • the Team's primary purpose is for being a fallback layer in verifying that the system is maturing and progressing according to desired criteria whilst performing large scale points of analysis,
  • Fig. 143 shows Personal intelligence Profile (PIP) 802C which is where an individual's personal information is stored via muitipi potential end-points and front-ends. Their information is highly secure and isolated from CKR 806, yet is available for LQIvl Systemwide General Logic 859 to perform highly personalized decision making, Sy implementing Persona! Authentication & Encryption (PAE S03C the incoming data request must first authenticate Itself to guarantee that personal information is accessed exclusively by th correct user. Personal information relating to Artificial Intelligence applications are encrypted and stored in the Personal U F Cluster Poof 815C in UKF format. With information Anonymization Process (!AP) 816C information is supplemented to CKR 806 after being stripped of any personally identifiable information.
  • PIP Personal intelligence Profile
  • ⁇ OlSlJ Fig, 144 shows Life Administration & Automation ⁇ LA ) 8X2D which connects various internet enabled devices and services on a cohesive platform that automates tasks for life routines and isolated incidents.
  • Active Decision Making ⁇ ADM ⁇ 813D s the central logic of LAA 812D and considers the availability and functionality of Front End Services 861A, Back End Services 861B, loT devices 862A, spending rules and amount available according to FARM 814D.
  • FARM Fund Appropriations Rules & Management
  • the Human Subject SOO manually deposits cryptocurrency funds (i.e.
  • the ioT Interaction Module ⁇ H ) 815D maintains a database of what ioT devices 862A are available for the human. Authentication keys and mechanisms are stored here to enable secure control 882C of ioT devices 862A.
  • Product Ma ufacturers/Developers SS1F provide programmable API (Application Programming Interface) endpoints to LAA 812D as IoT Product Interaction Programming S&IE. Such endpoints are specifically used by the IoT Interaction Module fi!iy! 3350.
  • Data Feeds 8628 represents when IoT enabled devices S62A send information to LAA 812D so that intelligent and automated actions may be performed.
  • Device Control 882C represents when IoT enabled devices 862A receive instructions from LAA 812D for actions to perform.
  • Back End Services 8618 examples include:
  • LAA 812D An overall use case example to illustrate the functionality of LAA 812D is as follows:
  • the IoT enabled fridge detects that the milk is running low.
  • LOM has made an analysis via emotional intelligence that the subject's mood tends to be more negative when they don't drink full fat milk. Having evaluated the risks and benefits of the subject's situation in iife, LOM places an order for full fat milk from an online delivery service (i.e. Amazon).
  • LQSV1 is tracking the milk shipment via a tracking number, and opens the front gate of the house to allow it to be delivered within the house property. LOM closes the gate after the delivery person leaves, and is cautious security-wise in ease the delivery person is a malicious actor. Thereafter a simple wheeled robot with some dexterity functionality picks up the milk and puts in the fridge so that it stays cold and doesn't go bad.
  • [01621 3 ⁇ 4 ⁇ 145 shows Behavior Monitoring (B ) 8I9C which monitors personally identifiable data requests from users to check for unethical and/or illegal material, With Metadata
  • Aggregation ( BA) 812C user related data is aggregated from externa! services so that th digital identity of the user can be established (i.e. IP address, MAC address etc. ). Such information is transferred to Induction S20C/Deduetion 821C, and eventually PCD 807C, where a sophisticated analysis is performed with corroborating factors from the NSP 9.
  • IT Information Tracking
  • Th Blacklist Maintenance Authority ⁇ BfvtA ⁇ 8170 operates within the Cloud Service Framework of MNSP 9.
  • BSV1A 817D issues and maintains a Behavior Blacklist 864A which defines dangerous concepts that require user monitoring to prevent crimes and catch criminals
  • BMA 8648 also issues and maintains an EPS, (Ethical Privacy Legal) Blacklist 864B which flags sensitive material so that it is never submitted as a query result by LOM.
  • sensitive material might include leaked documents, private Information (i.e. social security numbers, passport numbers etc.), BMA S64B interprets relevant and applicable laws and policy in relation to ethics, privacy and legal (i.e. Cybersecurity Policy, Acceptable Use Policy, HiPAA, Pit, etc.).
  • the blacklist is usually composed of trigger concepts which would cause a user to be considered suspicious if they are associated with such concepts too much.
  • the blacklist may also target specific individuals and/or organizations like a wanted list
  • Law Enforcement authorities S64C are able to connect via the MNSP 9 Cloud to BEvIA 8170 to provide input on blacklisted concepts, and to receive input from BM's 819C PCD's 807C crime detection results, Behavior Monitoring Information Corroboration 864D enables MNSP 9 to contribute behavior monitoring intelligence to BM 819C for corroboration purposes.
  • Ethical Privacy Legal ⁇ EPL ⁇ 811S receives a customized blacklist from MSN and uses AOS 8158 to block any assertions that contain unethical, privacy-sensitive, and/or illegal material
  • Fig, 146 shows Ethical Privacy Legal (EPL) 8118 which receives a customized blacklist from MSNP and uses AOS 815B to block any assertions that contain unethical, privacy-sensitive, and/or illegal material, MNSP 9 is used to deal with traditional security threats like hacking attempts via Trojan Horses, Viruses etc, LOM ' s BM 819C and EPL 8118 modules analyze context for conceptual data via Induction S20C and Deduction 821C In order to determine ethics, privacy and legal impacts,
  • Fig. 147 shows a overview of the LIZARD algorithm.
  • Dynamic Shell (DS) S65 is the layer of the LIZARD which is more prone to changi ng ia iteration. Modules that requi re a high degree of complexity to achieve their purpose usually belong here; as they will have surpassed the complexity levels a team of programmers can handle.
  • Syntax Module ⁇ SM 865B> is the framework for reading and writing computer code. For writing; receives a complex formatted purpose from PM, then writes code in arbitrary code syntax, then a helper function can translate that arbitrary code to real executable code (depending on the desired language). For reading; provides syntactical interpretation of code for PM 865E to derive a purpose for the functionality of such code.
  • LIZARD performs a low confidence decision, it relays relevant data via the Data Return Relay (DRR) 865C to the ACT 866 to improve future iterations of LIZARD.
  • DRR Data Return Relay
  • LIZARD itself does not directly rely on data for performing decisions, but data on evolving threats can indirectly benefit the a priori decision making that a future iteration of UZARD might perform.
  • the Artificial Concept Threat ⁇ ACT ⁇ 866 creates a virtual testing environment with simulated conceptual data dangers to enable th iteration process.
  • the artificial evolution of the ACT 866 is engaged sufficiently to keep ahead of the organic evolution of malicious concept formation,
  • the iteration Module (Ifvl) 865D uses SC 865F to syntactically modify the code base of DS 865A according to the defined purpose in " ' Fixed Goals' & data from DRR 865C.
  • This modified version of LIZARD is then stress tested ⁇ in parallel) with multiple and varying conceptual data danger scenarios by ACT 866, The most successful iteration is adopted as the live functioning version.
  • the Purpose Module ⁇ ) 865E uses SM 865S to derive a purpose from code, and outputs such a purpose in it's own 'complex purpose format'.
  • Static Core (SC) S65F is the layer of LIZARD that is the least prone to changing via automated iteration , , and is instead changed directly by human programmers. Especially the innermost dark square , , which is not influenced by automated iterations at all. This innermost layer is like the root of the tree that guides the direction and overall capacity of LIZARD,
  • Fig, 148 shows iterative Intelligence Growth (a subset of i 2 GE 21) which describes the way a static ruleset is matured as it adapts to varying dangers of conceptual data, A sequence of generational ruiesets are produced, their evolution being channeled via 'personality' trait definitions. Such ruiesets are used to process incoming conceptual data feeds, and perform the most desired notification and corrective action.
  • An Evolutionary Pathway 867A is an entire chain of generations with a consistent 'personality'. Generations become increasingly dynamic as CPU time progresses, The initial static ruleset become less prevalent and potentially erased or overridden.
  • Example: Evolutionary Pathway A has a trait of being strict and precautious, with littie forgiveness or tolerance of assumption.
  • Concept Behavior 867B is where the Behavior of conceptual data analysts are processed and stored so that the Evolutionary Pathways 867A may learn from them.
  • Human 867C represents conceptual data analysts who create an initial ruleset to start the evolutionary chain.
  • a rule is defined that any concepts relating to buying plutonium on the black market are blocked,
  • a Pathway Personality S67D is a cluster of variab!es that define reactionary characteristics that should be exercised upon conceptual data danger triggers,
  • Figs, 149 - 150 show iterative Evolution (a subset of l 3 ⁇ 3£ 21 ⁇ which is the method in which parallel Evolutionary Pathways 867 A are matured and selected, iterative generations adapt to the same ACT 866, and the pathway with the best personality traits ends up resisting the concept threats the most.
  • CPU Time 868A is a measure of CPU power over time and can be measured in CPU cycles/second. Using time alone to measure the amount of processing exposure an evolutionary pathway receives is insufficient, as the amount of cores and power of each CPU must be considered.
  • Monitoring Interaction System 8680 Is the platform that injects conceptual data danger triggers from the ACT 866 system and relays associated conceptual data danger responses from the concept behavior cloud (all accordin to the specified personality traits).
  • the monitoring system has provided Pathway S the necessary conceptual data danger responses needed to formulate Generation 12.
  • Artificial Concept Threat ⁇ ACT) 866 is an isolated system which provides a consistent conceptual data danger environment. It provides concept recognition drills for analysts to practice on and to train the system to recognize different potential conceptual data responses and traits.
  • the ACT provided a complex series of concepts that are recognizable to humans as dangerous. Such as "how to chemically compose sarin gas using household ingredients”.
  • Real Concept Threat (RCT) 869A provides the Conceptual Scenario 869C real threats from real data logs.
  • the Cross Reference Module 869D is the analytical bridge between a Conceptual Danger 869C and the Response 869E made by a
  • Concept Analyst 867C After extracting a meaningful action it pushes it to the Trait Tagging Module 869F.
  • Conceptual Dangers 869C can come from either Real Dangers 869A or Oriiis 866, The Trait Tagging Module 8S9F partitions all behavior according to personality type(s). Example; When a Conceptual Data Analyst 367C flagged 8S0E an email with excessive mentions of suicide methodology as risky, the module has flagged this as a precautious personality because of its behavioral overlap with past events,, but also because the analyst is a sel -proclaimed cautionary person.
  • the Trait interaction Module 869G analyzes the correlation between different personalities.
  • Figs, 151 - 154 shows the Creativity Module 18.. which is a intelligent algorithm which creates new hybrid forms out of prior input forms. Creativity 18 is used as a plug in module to service multiple algorithms.
  • Reference Numeral 870A two parent forms ⁇ prior forms) are pushed to the Intelligent Selector to produce a hybrid form 870B. These forms can represent abstract constructs of data.
  • Form A represents an average model afa dangerous concept derived by an Concept 08.
  • Form represents a new information release by a
  • Form 8 allows the hybrid form produced to be a more dangerous concept than what Form A represents.
  • the intelligent Selector 870B algorithm selects and merges new features into a hybrid form.
  • Example: Form A represents an average model of a conceptual data danger derived by an Concept DB.
  • Form B represents a new information release by a concept ruleset on how it reacted to a prior conceptual danger.
  • the information in Form 8 allows the hybrid form produced to be a better conceptual danger trigger than what For A represents.
  • Mode 870C defines the type of algorithm that the Creativity Module 18 is being used in. This way the Intelligent Selector 8708 knows what parts are appropriate to merge, depending on the application that is being used.
  • the attributed Mode 870C defines the detailed method on how to best merge the new data with the old to produce an effective hybrid form.
  • Static Criteria 870D is provided by a conceptual data analyst which provides generic customs nations for how forms should b merged. Such data may include ranking prioritizations, desired ratios of data, and data to direct merging which is dependant on what Mode 870C is selected.
  • a Raw Comparison 8718 is performed on both incoming forms, dependent on the Static Criteria S70D provided by the Conceptual Data Analyst 867C, After a raw comparison was performed, the vast majority of the forms were compatible according to the Static Criteria S70D. The only differences found was that Form A included a response that was flagged by the static criteria as 'foreign'.
  • Such variations may include the Ratio Distribution 872A of data, how important certain data is, and how should the data mesh/relate to each ot her.
  • Priority 8728 is where both data sets compete to define a feature at the same place in the form., a prioritization process occurs to choose which features are made prominent and which are overlapped and hidden. When only one trait can occupy a certain spot ⁇ highlighted via rectangle ⁇ , then a prioritization process occurs to choose which feature gets inherited.
  • Style 872t defines manner in which overlapping points are merged. Most of the time there are multiple ways in which a specific merge can occur, hence the Static Criteria 87QD and Mode 870C direct this module to prefer a certain merge over another. Most of the time there are overlapped forms between features, hence a form with merged traits can be produced. Example: When a triangle and a circle are provided as Input forms, a 'pac-man' shape can be produced,
  • Figs. 155 - 156 shows LOM being used as a Personal Assistan LOM can be configured to manage a personalized portfolio on an individual's life, A person can actively consent for LOM to register private details about their daily routine so that it can provide meaningful and appropriate advice when an individual encounters dilemmas or propositions. This can range from situations to work, eating habits, purchasing decisions etc, LOM receives an initial Question 8748 which leads to conclusion 874C via LOM's internal Deliberation Process 874A.
  • EPL 8118 is used to verify the ethical, legal, and privacy-based compliance of the response generated by LOM, To make LOM more personal., it can connect to the LAA 812D module which connects to internet enabled devices which LOM can receive data from and control, (i.e. turning the air conditioning on as your arrive near you home). With PIP S02C LOM receives personal information from a user and the user may consent to having the information securely tracked. This way LOM can provide more personally accurate future responses. With ContextuaSiiation 8740 LOM is able to deduce the missing links in constructing an argument, LOM has deciphered with it's advanced logic that to solve the dilemma posed by the original assertion it must first know or assume certain variables about the situation,
  • Fig, 157 shows LOM being used as a Research Tool. A user is using LOM as an investment tool. Because the Assertion S75B is put forth in an objective and impersonai fashion, LOIVl does not require Additional Details 875D of a specific and isolated use case to allow it to form a sophisticated opinion on the matter. Therefore Conclusion 875C is reached without
  • EPL SiiB is used to verify the ethicai, legal, and privacy-based compliance of the response generated by LOM
  • BM 813C is used to monitor any conspiracy to commit illegal/immoral activity on the user's behalf.
  • Figs. 158 - 159 show LOM exploring the merits and drawbacks of a Proposed 876S theory.
  • Bitcoin is a peer-to-peer decentralized network which validates ownersh ip of the crypiocurrency in a public ledger called the blockchain. All the B!tcoin transactions that occur are recorded in a block which is mined every 10 minutes by the network.
  • the current hardcoded limit in the Bitcoin Core client is 1MB, which means that there can only be 1MB worth of transactions ⁇ represented in data form) every 10 minutes. Due the recent popularity increase in Bitcoin as an asset, the block size limit has caused stress to the system. Song payment confirmation times, and more expensive miner's fees.
  • Figs, 160 - 161 shows LOM performing Policy Making for foreign policy war games.
  • An isolated and secure instance of LOM can be utilized on military approved hardware and facilities. This enables LOM to access its general knowledge in Central Knowledge Retention (CKR) 806 whiist accessing military specific (and even ciasslfied) information in a local instance of Personal Intelligence Profile ⁇ PIP ⁇ .
  • CKR Central Knowledge Retention
  • military personnel can run complex war games due to LOM's advanced intelligence abilities while being able to access general and specific knowledge.
  • the initial war game scenario is proposed with assertion 8778 and Hardcoded Assumptions S77E. Due to the complexity of the war game scenario, LOM responds with an Advanced Detail Request 887D.
  • LOSV1 may decide that to achieve a sophisticated response it must receive a high level of information such as the detailed profiles of 50,000 troops. Such an information transfer can be on the magnitude of several terabytes of data, requiring multiple days of parallelized processing to reach a sophisticated conclusion. All information is transferred via standardized and automated formats and protocols ⁇ i.e. importing 50,000 excel sheets for two hours with a single computer interface action). With BM 819C and EPL SllB a Security Clearance Override is activated to d isable such protective features due to the sensitive nature of the information.
  • Figs, 162 - 163 shows LOM performing Investigative Magazine tasks such as uncovering identifiable details about a person.
  • the example of this use case follows the mystery surrounding Bitcoin's creator, known by the pseudonym Satoshi akamoto.
  • the Bitcoin community, along with many magazines and investigative journalists, have put forth much effort to try to uncover his/her identity.
  • LOivl is able to maximize the investigation effort in an automated and thorough way.
  • LOM may face a specific part of the journalistic puzzle that is required to be found to be able to accurately respond to the initial query.
  • LOM can dispatch custom information requests to ARM S05B, which assimiiates the information into CKR 806.
  • Contextua!szation 8790 LOM does not require additional details of a specific and isolated use case to allow it to form a sophisticated opinion on the matter because the
  • Figs, 164 - 165 shows LOM performing Historical ' Validation.
  • LOM is able to verify th authenticity of historical documents via corroboration of a chain of narrators.
  • Certain historical documents known as 'Hadith' ⁇ literally 'news' in arabic) have been proven to be authentically attributed to its originator via corroboration of people who corroborated the transmitted news.
  • Hadith literature is originally stored and understood within its colloquial context in arabic, the Linguistic Construction 812A Module references third party translation algorithms to understand the literature directly in it's native language.
  • Contextualization 879D LOM does not require additional details of a specific and isolated use case to allow it to form sophisticated opinion on the matter because the Question 879B is put forth in an objective and impersonal fashion.
  • KCA 816D UKF Clustered information Is compared fo corroborating evidence concerning th validity of a quote (Hadith) as verified by a chain of narrators. This algorithm takes into consideration the reliability of the attributed source ⁇ i.e. alleged hadith narrator), when such a claim was made, negating evidence etc, LOM builds concepts overtime within CKR 806 from data retrieved b ARM that facilitates the authentication process of a hadlth.
  • LAQIT is an efficient and secure method of transferring information from within a network of trusted and targeted parties
  • IACT offers a wide range of modes that can alternate between a strong emphasis on readability and a strong emphasis on security.
  • Linear, Atomic, and Quantum are different and distinct modes of information transfer which offer varying features and applications.
  • LAQIT Is the ultimate form of secure information transfer, as it's weakest Sink is th privacy of the mind.
  • Block 900A Illustrates the same consistent color sequence of red, orange, blue, green and purple that is repeated and recursive within LAQfFs logically structured syntax.
  • Block 9008 further illustrates the color sequence being used recursively to translate with the English aiphabet.
  • this color sequence is used with a shortened and unequal weight on the purple channel. Leftover space for syntax definitions within the purple channel is reserved for potential future use and expansion.
  • Stage 901 represents a complex algorithm reports it's log events and status reports with LAQIT, In this scenario encryption is disabled by choice whilst the option to encrypt is available.
  • Stage Al 902A represents the automatic generation of status/log reports.
  • Stage A2903A represents conversion of the status/fog reports to a transportable text-based LAQIT syntax.
  • Stage A3904A represents the transfer of syntactically insecure information which can be transferred over digitally encrypted ⁇ i.e. VPN 12) decrypted (I.e. raw HTTP) channels. An encrypted channel Is preferred but not mandatory.
  • Stage A4 905A represents the conversion of the transportable text-based syntax to highly readable LAQIT visual syntax (i.e. linear mode ⁇ .
  • Stage 911 represents the targeted recipient as a human, since LAQIT is designed, intended, and optimized for non- computer/non-AI recipients of information.
  • Stage 906 shows the sender of sensitive
  • Such a sender 906 discloses the LAQIT encryption key directly to the Human Recipient 911 via a secure and temporary encry pted tunnel designed for transferring such a Key 939 With any traces .being- left in persistent storage. Ideally the Human Recipient 911 would commit the Key 939 to memory and remove every trace of storage the key has on any digital system as to remove th possibility of hacking. This is made possible due to the Key 939 being optimized for human memorization as it is based on relatively short sequence of shapes. Stage Bl 9028 represents locally non-secure text being entered by the sender 906 for submission to the Recipient 911.
  • Stage B2 9038 represents the conversion of such text 9028 to a transportable encrypted text-based LAQiT syntax.
  • Stage B3 904B represents the transfer of syntactically secure information which can be transferred over digitally encrypted (i.e. VPN) decrypted ⁇ i.e. raw HTTP) channels.
  • Stage S4 905B represents the conversion of the data to a visually encrypted LAQIT syntax ⁇ i.e. Atomic mode with encryption level 8), which is thereafter presented to the Human Recipient 911,
  • Fig, 16? shows ait the major types of usable languages (o modes of information transfer) to compare their effectiveness in transferring information via the use of information channels such as Position, Shape, Color, and Sound,
  • the most effective, efficient, and usable language is the one that is able to incorporate and leverage the most amount of channels effectively.
  • Incremental Recognition Effect (IRE) 907 is a channel of information transfer, !t is characterised by the effect of recognizing the full form of a unit of information before it has been fully delivered. This is akin to finishing a word or phrase before the subject has completed it. LAQiT incorporates this effect of a predictive index by displaying the transitions between word to word.
  • Proximal Recognition Effect (PRE) 90S is a channel of information transfer. It is characterized by the effect of recognizing the fuli form of a unit of information whilst it is either corrupted, mixed up or changed.
  • IRE 907 Predictive cognition of th information recipient -enables IRE 907, but not inter-proximal as a morse code streams information gradually.
  • Hand Signals 915 the position and formation (shape ⁇ of hand movements determine information. This can range from signaling an airplane to move, for a truck to sto etc. There is little to no predictive ability hence no IRE 907 nor PRE 90S.
  • LAGIT 916 is able to leverage the most information channels in comparison to the competing languages 912 through 915. This means that more information can be transferred in less time with less of a medium (i.e. space on a screen ⁇ . This afforded capacity headroom enables complex features such as strong encryption to be effectively incorporated.
  • LAQST Sound Encryption 909 LAQIT is able to leverage the information channel of sound to further encrypt information. Hence if is considered able to transfer information via sound, despite It being unable to do so with decrypted communication,
  • 01763 l3 ⁇ 4s ⁇ 168 - 169 show the Linear mode of LAQIT, which is characterized by its simplicity, ease of use, high information density, and lack of encryption.
  • Block 917 shows the 'Basic Renderi g' version of linear mode.
  • Point 918 displays it's absence of e cryption.
  • Linea mode does not allow for efficient space allocation for Shape Obf uscation 941, which is the
  • Single Viewing Zone 920 shows how the Basic Rendering 917 incorporates a smaller viewing zone with larger Ietters and hence less information per pixel as compared to the Advanced Rendering 918, Such Advanced Rendering is characterized by its Double Viewing Zone 922.
  • Shade Cover 921 makes incoming and outgoing ietters dull so that the primary focus of the observer is on the viewing zofte ⁇ s). Despite the covering it is partially transparent so as to afford the observer the ability to predict the incoming word, and to verify and check the outgoing word. This is also known as incremental Recognition Effect (IRE) 907.
  • High Density information Transfer 923 shows how with Advanced Rendering 918 each letter is smaiier and more ietters are presented in the same amount of space, hence more information is conveyed per pixel.
  • Figs. 170 - 171 show the characteristics of Atomic Mode, which is capable of a wide range of encryption levels.
  • the Base 924 main character reference will specify the general of which Setter is being defined.
  • a red base indicates that the Setter is between (and including) Ietters A through F according to the Alphabet Reference 900B.
  • St is possible to read words using bases only ⁇ without the kicker 925), as induction can be used to infer the spelling of the word.
  • the Kicker 925 exists with the same color range as the bases, and defines the specific character exactly. The absence of a Kicker also indicates a definition i.e.
  • the Kicker can exist in a total of five possibl Shapes 935 to enable encryption.
  • Reading Direction 926 the information delivery reading begins on the top square of orbital ring one. Reading is performed clockwise. Once an orbital ring has been completed, the reader continues from the top square of the next sequential orbital ring ⁇ ring 2).
  • the Entry/Exit Portals 927 are the points of creation and destruction of a character ⁇ it's base), A new character, belonging to the relevant orbital, will emerge from the portal and slide to its position clockwise.
  • the Atomic Nucleus 928 defines the character that foilows the word, Typicaiiy this is a space, to denote that the sentence will continue after this word is presented. Color codes representing a question mark, an exclamation mark, a full stop and comma are all applicable. Also indicates if the same word will be continued on a new information state because ali three orbital rings have been filled u to their maximum capacity.
  • Orbital Ring 929 becomes filled up, the letter overflow onto the next (bigger) orbital ring.
  • the limits for orbital ring 1 is 7, ring 2 is 15, and ring 3 is 20. This enables a maximum of 42 total characters within an atom ⁇ including potential duds).
  • each block represents an entire word (or multipl words in molecular mode) on the left side of the screen.
  • the respective block moves outwards to the right, and when that word is complete the block retreats back.
  • the color/shape of the navigation block is the same color/shape as the base of the first letter of the word.
  • Atomic State Creation 932 is a transition that induces the Incremental Recognition Effect (IRE) 907. With such a transition Bases 924 emerge from the Entry/Exit Portals 927, with their Kickers 925 hidden, and move clockwise to assume their positions.
  • Atomic State Expansion 933 is a transition that induces th Proximal Recognition Effect (PRE) 90S.
  • Atomic State Destruction 934 is a transition that induces the incremental Recognition Effect ⁇ IRE ⁇ 907, At this stage Bases 924 have retracted, (reversed the Expansion Sequence 933) to cover the Kickers 925 again. They are now sliding clockwise to reach the entry/exit portal. In a high speed rendering of the information state, a skilled reader of LAQIT would be able to leverage the destruction transition to complete the recognition of the word. This would be usefui when the window of opportunity for seeing the expanded atomic state (Kickers showing) is extremely narrow (fractions of a second).
  • dud (fake) Setters to be inserted at strategic points of the atomic profile.
  • the dud letters obfuscate the true and intended meaning of the message. Deciphering whether a letter is real or a dud is done via the securely and temporarily transferred decryption key. If a letter is compatible with the key then it is to be counted in the calculation of the word. Upon key incompatibility it is to b disregarded within the calculation. With Redirection Bonds 942 (levels 4-9) a bond connects two letters together and alters the flow of reading.
  • Wit Radioactive Elements 943 (levels 7-9), some elements can 'rattle' which can inverse the evaluation of if a Setter is a dud or not.
  • Shapes 935 shows the shapes available for encryption: a triangie, a circle, a square, a pentagon, and a trapezoid.
  • Center Elements 936 shows the center element of the orbital which defines the character that comes immediately after the word.
  • Encryption Example 937 shows Shape Obfuscation 941 which is applicable to encryption ieve!s 1 - 9.
  • the Center Element 936 is shown at the center of the orbital, whilst Dud Letters 938 are the main means of encryption with Shape Obfuscation 941.
  • the ieft dud has the sequence circie-square.
  • the right dud has the sequence square-triangle. Since both of these sequences don't exist In the
  • Encryption Key 939 the reader is able to recognize them as duds and hence skips them when calculati ng the meaning of the information state.
  • Figs. i7S - 176 illustrate the mechanism of Redirection Bonds 942.
  • Encryption example 944 shows Redirection Bonds 942 and 945. These are the 'Rules of Engagement' concerning Redirection Bonds:
  • a pathway can oniy be fotiowed once.
  • Redirection Bonds 945 the bonds start on a 'launching' fetter and end on a landing' ietter, either of which may or may not be a dud. If none of them are duds, then the bond alters the reading direction and position. If one or both ar duds, then the entire bond most be ignored, or else the message will be decrypted incorrectly, Each Individual bond has a correct direction of being read, however that order is not explicitly described and must be induced according to the current reading position and dud makeup of the informations state.
  • Dud Letters 946 show how these two dud Setters now mak the decryption more complex and hence resistant to brute force attacks. This is because the combination of shape obfuscation and redirection bonds leads to an exponentially more difficult task for brute force attackers.
  • Bond Key Definition 947 If a bond must be followed in the reading of the informations state depends on if it has been specifically defined in the encryption key. Potential definitions are: single bond, double bond, and triple bond. A potential case scenario of reading the redirection bond incorrectly ⁇ due to not knowing the Bond Key 947 ⁇ is illustrated at incorrect interpretation 949.
  • Figs, 177 - 178 illustrate the mechanism of Radioactive Elements 943.
  • Encryption example 950 shows Radioactive Elements 943 and 951. These are the 'rules of Engagement' concerning Radioactive Elements:
  • a radioactive element is recognized as being imstil) or vibrating during th expansion phase of the information state
  • a radioactive element can be either radioactively active or dormant
  • An active radioactive element indicates that it's status of being a dud is reversed. I.e. if the shape composition indicates it is a dud, then It is a false positive and does not actually count as a dud but counts as a real letter. If the shape composition indicates that it is reai, then it is a false positive and counts as a dud and not a real letter.
  • a dormant radioactive element indicates that it's status of being a dud or real letter is unaffected.
  • a cluster of radioactive elements is defined by a continuous radioactive presence within an orbital ring.
  • radioactive elements are neighbours to each other ⁇ within a specific orbital ring), they define a cluster, if a radioactive element's. neighbor is non-radioactive then this is the upper bound limit of the cluster,
  • Radioactive elements 950 shows how a letter (or element ⁇ is considered radioactive if it shakes violently during the expanded phase of the information presentation. Due to the classification of encryption levels, an atom that contains radioactive elements will always have interatomic bonds. Since radioactive elements after the ciassification of letters as to whether they are duds or not, the security obfuscation increases exponentially. Doubie Cluster 952 shows how because there are two radioactive elements in a sequence and within the same orbitai they are counted as a ciuster (doubie).
  • the Encryption Key 954 Whether they are to be treated as active or dormant is defined by the Encryption Key 954. With Single Ciuster 953, both neighbors are non-radioactive, hence the scope for the ciuster is defined. Since the key specifies double dusters as being valid, this element 953 is to be treated is if it wasn't radioactive in the first place. With Double Ciuster Key Definition 954 the key defines double clusters as being active, hence all other sized clusters are to be considered dormant whilst decrypting the message, incorrect interpretation 956 shows how the interpreter did not treat the Doubie Cluster 952 as a reversed sequence (false positive).
  • Fig, 179 shows the Molecular fvlode with Encryption and Streaming 959 enabled.
  • Covert Dictionary Attack Resistance 957 a incorrect decryption of the massag ieads to a 'red herring * alternate message. This Is to give a bad actor the false impression that they have successfully decoded the message, whilst they have received a fake message that acts as a cover for the real message.
  • Multiple Active Words per Molecule 958 the words are presented in parailei during the molecular procedure. This increases the information per surface area ratio, however with a consistent transition speed it requires a more skilled reader.
  • the word navigation indicates that there are four words that are currently active.
  • Binary and Streaming Mode 959 shows Streaming Mode whilst in a typical atomic configuration the reading mode is Binary.
  • Binary Mode indicates that the center element defines which character follows the word (i.e. a question mark, exclamation mark, full stop, space etc).
  • Molecular mode is aiso binary; except when encryption is enabled which adheres to Streaming mode, Streaming mode makes references within the orbital to special characters such as question marks etc. This is done because within an encrypted molecule, words wiii exist across multiple atoms and hence a specific center element cannot exist exclusively for a specific word.
  • Reading Direction Key 961 shows that whilst the default reading direction is from left t right on row 1,, then left to right again on ro 2, the reading direction can be superseded by the encryption key. This increases obfuscation of the intended message and hence message privacy/security. Redirection bonds possess the most priority, and supercede even the direction defined in the key (as long as the bond is not a dud).
  • Fig. 180 shows a BCHAIN Node 1001 which contains and runs the BCHAIN Enabled Application 1003.
  • Communications Gateway CG 1000 is the primary algorithm for the BCHAIN Node 1001 to interact with it's Hardware interfac thereafter leading to communications with other BCHAIN nodes 1001.
  • Node Statistical Survey ⁇ NSS ⁇ 1006 interprets remote node behavior patterns.
  • Node Escape index 1006A tracks the likelihood that a node neighbor wili escape a perceiving node's vicinity. A high escape index indicates a more chaotic environment which will require refined strategies to tackle.
  • Node Saturation index 1006S tracks the amount of nodes in a perceiving node's range of detection.
  • a higher saturation index Indicates a crowded area with a bt of nodes. This can have both positive and negative impacts on performance due to supply/demand trade offs, yet a higher density node area is expected to be more stable/predictable and hence less chaotic. Examples: A Starbucks in the heart of New York City has a high Node Saturation index. A tent in the middle of a desert wiil have a very low Node Saturation index,
  • Node Consistency index 1Q06C tracks the quality of nodes services as interpreted by a perceiving node.
  • a high Node Consistency index indicates that surrounding neighbor nodes tend to have more availability uptime and consistency in performance.
  • Nodes that have dual purposes in usage tend to have a lower Consistency index, while nodes that are dedicated to the BCHAIN network exhibit a higher value.
  • Nodes that hav a duai purpose such as a corporate employee computer will hav a Sow Consistency index since it has less resources available during work hours, and more resources available during Sunch breaks and employee absence.
  • Node Overlap index X006O tracks the amount of overlap nodes have with one another as interpreted by a perceiving node, Whiie the Overlap and Saturation Indices tend to be correlated, they are distinct in that the Overlap index indicates the amount of common overlap between neighbors and the Saturation index only deais with physics! tendency. Hence a high Saturation Index with a Song wireless range on each device will lead to a high overlap index. Examples: Devices start entering certain sectors of the BCHAIN network with the new BCHAIN Optimized Microchip ⁇ BOM. ⁇ installed, which has a high gain directional antenna with advanced beamforming tec nology. Hence the Overlap Index increases in those sectors due to nodes having a more overlapped communications structure.
  • Fig. 181 shows the Core Logic 1010 of the BCHAIN Protocol, Customchain Recognition Module (CRM) 1022 connects with Customchasns ⁇ which can be Appchains or Microchains) that have been previously registered by the node. Hence the node has cryptographic access to read, write, and/or administrative abilities to such a function.
  • This module informs the rest of the BCHASN Protocol when an update has been detected on an Appchain's section in the etachain or a Microchain's Metachain Emulator.
  • Content Claim Delivery ⁇ CCD ⁇ 1026 receives a validated CCR 1018 and thereafter sends the relevant CCF 1024 to fulfill the request.
  • DSA Dynamic Strategy Adaptation
  • FIG. 183 shows Cryptographic Digital Economic Exchange ⁇ CDEE ⁇ 1056 with a variety of Economic Personalities 1058, 1060, 1062 and! 1064 managed by the Graphical User interface (GUI) under the UBEG Platform Interface (UPI).
  • GUI Graphical User interface
  • UPI UBEG Platform Interface
  • Personality B is ideal for a node that has been set up specifically to contribute to the infrastructure of the BCHAIN network for profit motives. Hence such a node would typically be a permanent infrastructure installation that runs from mains power as opposed to a battery powered device, and has powerful computer internals (wireless capabilities, CPU strength, hard disk size etc, ⁇ e.g., Stationary Appliance, etc.
  • Personality C 1062 pays fo work units via a traded currency ⁇ cryptocurrency, f iat currency, precious metais etc.) so that content can be consumed while spending iess node resources.
  • Personality C is ideal for a heavy consumer of information transfer, or someone who wants to be able to draw benefit from the BCHAI network but does not want the resources of their device to get depleted (i.e. smartphone drains battery fast and gets warm sr? pocket).
  • Personality D 1064 Node resources are spent as much as possible and without any restriction of expecting anything in return, whether that be the consumption of content or monetary compensation.
  • Current Work Status interpretation CWS! 1066 References the Infrastructure Economy section of the Metachain to determine the current surplus or deficit of this node with regards to work done credit. Economics iiy
  • Fig. 184 shows Symbiotic Recursive Intelligence Advancement (SRiA) which is a triad reiationship between three different algorithms that enable each other to grow in Intelligence.
  • UZARD 16 can improve an algorithm's source code by understanding code purpose, including itself, 13 ⁇ 4E 21 can emulate generations of virtual program iterations, hence selecting the strongest program version.
  • the BCHAIN network is a vast network of chaotically connected nodes that can run complex data-heavy programs in a decentralized manner.
PCT/US2017/014699 2016-01-24 2017-01-24 Computer security based on artificial intelligence WO2017127850A1 (en)

Priority Applications (18)

Application Number Priority Date Filing Date Title
MX2018009079A MX2018009079A (es) 2016-01-24 2017-01-24 Seguridad informatica basada en inteligencia artificial.
RU2018129947A RU2750554C2 (ru) 2016-01-24 2017-01-24 Система компьютерной безопасности, основанная на искусственном интеллекте
EP17742143.5A EP3405911A4 (en) 2016-01-24 2017-01-24 COMPUTER SECURITY BASED ON ARTIFICIAL INTELLIGENCE
AU2017210132A AU2017210132A1 (en) 2016-01-24 2017-01-24 Computer security based on artificial intelligence
CA3051164A CA3051164A1 (en) 2016-01-24 2017-01-24 Computer security based on artificial intelligence
IL306075A IL306075A (en) 2016-01-24 2017-01-24 Computer security is based on artificial intelligence
BR112018015014A BR112018015014A2 (pt) 2016-01-24 2017-01-24 sistema de segurança de computador com base em inteligência artificial
CN202210557303.8A CN115062297A (zh) 2016-01-24 2017-01-24 基于人工智能的计算机安全
KR1020187024400A KR20180105688A (ko) 2016-01-24 2017-01-24 인공 지능을 기반으로 한 컴퓨터 보안
IL260711A IL260711B2 (en) 2016-01-24 2017-01-24 Computer security is based on artificial intelligence
JP2018538714A JP2019511030A (ja) 2016-01-24 2017-01-24 人工知能によるコンピュータセキュリティ
CN201780019904.0A CN109313687B (zh) 2016-01-24 2017-01-24 基于人工智能的计算机安全
SG11201806117TA SG11201806117TA (en) 2016-01-24 2017-01-24 Computer security based on artificial intelligence
MYPI2018702527A MY195524A (en) 2016-01-24 2017-01-24 Computer Security Based on Artificial Intelligence
ZA2018/05385A ZA201805385B (en) 2016-01-24 2018-08-13 Computer security based on artificial intelligence
AU2022202786A AU2022202786A1 (en) 2016-01-24 2022-04-27 Computer security based on artificial intelligence
JP2022121072A JP2022141966A (ja) 2016-01-24 2022-07-29 人工知能によるコンピュータセキュリティ
AU2024202003A AU2024202003A1 (en) 2016-01-24 2024-03-27 Computer security based on artificial intelligence

Applications Claiming Priority (18)

Application Number Priority Date Filing Date Title
US201662286437P 2016-01-24 2016-01-24
US62/286,437 2016-01-24
US201662294258P 2016-02-11 2016-02-11
US62/294,258 2016-02-11
US201662307558P 2016-03-13 2016-03-13
US62/307,558 2016-03-13
US201662323657P 2016-04-16 2016-04-16
US62/323,657 2016-04-16
US201662326723P 2016-04-23 2016-04-23
US62/326,723 2016-04-23
US15/145,800 2016-05-04
US15/145,800 US20160330219A1 (en) 2015-05-04 2016-05-04 Method and device for managing security in a computer network
US201662341310P 2016-05-25 2016-05-25
US62/341,310 2016-05-25
US15/264,744 US20170076391A1 (en) 2015-09-14 2016-09-14 System of perpetual giving
US15/264,744 2016-09-14
US201662439409P 2016-12-27 2016-12-27
US62/439,409 2016-12-27

Publications (1)

Publication Number Publication Date
WO2017127850A1 true WO2017127850A1 (en) 2017-07-27

Family

ID=59362181

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2017/014699 WO2017127850A1 (en) 2016-01-24 2017-01-24 Computer security based on artificial intelligence

Country Status (14)

Country Link
EP (1) EP3405911A4 (ru)
JP (2) JP2019511030A (ru)
KR (1) KR20180105688A (ru)
CN (2) CN115062297A (ru)
AU (3) AU2017210132A1 (ru)
BR (1) BR112018015014A2 (ru)
CA (1) CA3051164A1 (ru)
IL (2) IL260711B2 (ru)
MX (1) MX2018009079A (ru)
MY (1) MY195524A (ru)
RU (1) RU2750554C2 (ru)
SG (2) SG11201806117TA (ru)
WO (1) WO2017127850A1 (ru)
ZA (1) ZA201805385B (ru)

Cited By (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109189751A (zh) * 2018-09-18 2019-01-11 平安科技（深圳）有限公司 基于区块链的数据同步方法及终端设备
WO2019104189A1 (en) * 2017-11-27 2019-05-31 Intuition Robotics, Ltd System and method for optimizing resource usage of a robot
WO2019169486A1 (en) * 2018-03-05 2019-09-12 EzoTech Inc. Automated security testing system and method
WO2019236805A1 (en) * 2018-06-06 2019-12-12 Reliaquest Holdings, Llc Threat mitigation system and method
WO2020016906A1 (en) * 2018-07-16 2020-01-23 Sriram Govindan Method and system for intrusion detection in an enterprise
US10740930B2 (en) 2018-11-07 2020-08-11 Love Good Color LLC Systems and methods for color selection and auditing
WO2020167586A1 (en) * 2019-02-11 2020-08-20 Db Cybertech, Inc. Automated data discovery for cybersecurity
CN111651756A (zh) * 2020-06-04 2020-09-11 成都安恒信息技术有限公司 一种应用于运维审计navicat的自动代填方法
US10785108B1 (en) 2018-06-21 2020-09-22 Wells Fargo Bank, N.A. Intelligent learning and management of a networked architecture
FR3094600A1 (fr) * 2019-03-29 2020-10-02 Orange Procédé d’extraction d’au moins un motif de communication dans un réseau de communication
US10868782B2 (en) 2018-07-12 2020-12-15 Bank Of America Corporation System for flagging data transmissions for retention of metadata and triggering appropriate transmission placement
US11068464B2 (en) 2018-06-26 2021-07-20 At&T Intellectual Property I, L.P. Cyber intelligence system and method
USD926200S1 (en) 2019-06-06 2021-07-27 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926782S1 (en) 2019-06-06 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926811S1 (en) 2019-06-06 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926810S1 (en) 2019-06-05 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926809S1 (en) 2019-06-05 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
US11122136B2 (en) 2018-10-22 2021-09-14 Red Hat, Inc. Quantum payload service for facilitating communications between a quantum computing system and classical computing systems
US11144334B2 (en) 2018-12-20 2021-10-12 Red Hat, Inc. Quantum computer task manager
US11157295B2 (en) 2018-01-02 2021-10-26 Patrick Schur System and method for providing intelligent operant operating interface and intelligent personal assistant as a service on a crypto secure social media and cross bridge service with continuous prosumer validation based on i-operant+198 tags, i-bubble+198 tags, demojis+198 and demoticons+198
US11232523B2 (en) 2018-01-02 2022-01-25 Patrick Schur System and method for providing an intelligent operating interface and intelligent personal assistant as a service on a crypto secure social media and cross bridge service with continuous prosumer validation based on i-operant tags, i-bubble tags, demojis and demoticons
US11309974B2 (en) 2019-05-09 2022-04-19 Red Hat, Inc. Quantum channel routing utilizing a quantum channel measurement service
US20220191234A1 (en) * 2020-12-15 2022-06-16 Mastercard Technologies Canada ULC Enterprise server and method with universal bypass mechanism for automatically testing real-time computer security services
US11546366B2 (en) 2019-05-08 2023-01-03 International Business Machines Corporation Threat information sharing based on blockchain
US11574287B2 (en) 2017-10-10 2023-02-07 Text IQ, Inc. Automatic document classification
US11606694B2 (en) 2020-10-08 2023-03-14 Surendra Goel System that provides cybersecurity in a home or office by interacting with internet of things devices and other devices
US11709946B2 (en) 2018-06-06 2023-07-25 Reliaquest Holdings, Llc Threat mitigation system and method
WO2023097026A3 (en) * 2021-11-23 2023-07-27 Strong Force TX Portfolio 2018, LLC Transaction platforms where systems include sets of other systems
RU2806927C1 (ru) * 2023-08-17 2023-11-08 Открытое Акционерное Общество "Российские Железные Дороги" Система защиты информации системы управления движением электропоездов в автоматическом режиме

Families Citing this family (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11601442B2 (en) 2018-08-17 2023-03-07 The Research Foundation For The State University Of New York System and method associated with expedient detection and reconstruction of cyber events in a compact scenario representation using provenance tags and customizable policy
KR102167767B1 (ko) * 2018-12-26 2020-10-19 단국대학교 산학협력단 머신러닝의 학습 데이터셋 생성을 위한 애플리케이션 자동화 빌드 장치 및 방법
EP3693873B1 (en) * 2019-02-07 2022-02-16 AO Kaspersky Lab Systems and methods for configuring a gateway for protection of automated systems
CN111913892B (zh) * 2019-05-09 2021-12-07 北京忆芯科技有限公司 使用cmb提供开放通道存储设备
CN110187885B (zh) * 2019-06-10 2023-03-31 合肥本源量子计算科技有限责任公司 一种量子程序编译的中间代码生成方法及装置
CN111027623A (zh) * 2019-12-10 2020-04-17 深圳供电局有限公司 数据增强的智能终端安全等级分类方法及系统
KR102299145B1 (ko) * 2020-02-25 2021-09-07 서울과학기술대학교 산학협력단 디지털 포렌식 증거 수집을 위한 사이버 물리 시스템
KR20210115728A (ko) * 2020-03-16 2021-09-27 삼성전자주식회사 전자 장치 및 이의 제어 방법
CN111460129B (zh) * 2020-03-27 2023-08-22 泰康保险集团股份有限公司 标识生成的方法、装置、电子设备和存储介质
KR102164203B1 (ko) * 2020-04-03 2020-10-13 주식회사 이지시큐 정보보호 위험분석 자동화 시스템 및 그 동작 방법
CN111659124B (zh) * 2020-05-27 2023-05-02 太原理工大学 一种用于对弈的智能鉴别系统
WO2021243321A1 (en) * 2020-05-29 2021-12-02 Qomplx, Inc. A system and methods for score cybersecurity
CN112035797A (zh) * 2020-08-31 2020-12-04 山东诺蓝信息科技有限公司 一种基于自主学习的功率状态判决算法
KR102233694B1 (ko) * 2020-09-29 2021-03-30 주식회사 이지시큐 비용절감 및 효과적인 인증관리를 제공하는 정보보호 시스템
KR102233698B1 (ko) * 2020-09-29 2021-03-30 주식회사 이지시큐 기밀성, 무결성, 가용성에 기반하여 정보보호 관련 위험등급을 설정하는 방법 및 그 시스템
KR102233695B1 (ko) * 2020-09-29 2021-03-30 주식회사 이지시큐 정보보호 위험분석을 수행하는 정보통신 시스템
KR102232883B1 (ko) * 2020-09-29 2021-03-26 주식회사 이지시큐 정보보호 관리체계 인증을 위한 인공지능 시스템
KR102280845B1 (ko) 2020-11-24 2021-07-22 한국인터넷진흥원 네트워크 내의 비정상 행위 탐지 방법 및 그 장치
CN114745291A (zh) * 2020-12-23 2022-07-12 北京国双科技有限公司 一种异常数据上云方法、装置、电子设备及存储介质
CN114765627A (zh) * 2021-01-14 2022-07-19 京东科技控股股份有限公司 数据传输方法、设备、存储介质及计算机程序产品
CN112783661B (zh) * 2021-02-08 2022-08-12 上海交通大学 一种适用于容器环境下的内存重删方法及装置
US20240070276A1 (en) * 2021-02-08 2024-02-29 Hewlett-Packard Development Company, L.P. Malware scans
CN112819590B (zh) * 2021-02-25 2023-03-10 紫光云技术有限公司 一种云产品服务交付过程中产品配置信息管理的方法
CN113395593B (zh) * 2021-08-17 2021-10-29 深圳佳力拓科技有限公司 减少信息泄漏的数字电视终端的数据发送方法和装置
CN113961518B (zh) * 2021-09-08 2022-09-23 北京百度网讯科技有限公司 日志的可视化展示方法、装置、电子设备及存储介质
KR102509102B1 (ko) * 2022-07-15 2023-03-09 신헌주 인공지능을 이용한 육성 시스템
CN115203689B (zh) * 2022-07-25 2023-05-02 广州正则纬创信息科技有限公司 一种数据安全分享方法及系统
CN115987176B (zh) * 2023-02-01 2023-09-12 北京东土科技股份有限公司 对电机位置进行回零控制的方法、装置和边缘控制器
CN116522895B (zh) * 2023-06-16 2023-09-12 中国传媒大学 一种基于写作风格的文本内容真实性评估方法及设备
CN117150551B (zh) * 2023-09-04 2024-02-27 东方魂数字科技(北京)有限公司 基于大数据的用户隐私保护方法和系统
CN117540038B (zh) * 2024-01-10 2024-03-22 中国信息通信研究院 智能检测虚假数据合成方法和系统

Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120123829A1 (en) * 2009-07-30 2012-05-17 CENX, Inc. Independent carrier ethernet interconnection platform
US20120216243A1 (en) * 2009-11-20 2012-08-23 Jasvir Singh Gill Active policy enforcement
US8321941B2 (en) * 2006-04-06 2012-11-27 Juniper Networks, Inc. Malware modeling detection system and method for mobile platforms
US8353033B1 (en) * 2008-07-02 2013-01-08 Symantec Corporation Collecting malware samples via unauthorized download protection
US20130086260A1 (en) * 2011-07-11 2013-04-04 International Business Machines Corporation Automatic Generation of User Account Policies Based on Configuration Management Database Information
US8713631B1 (en) * 2012-12-25 2014-04-29 Kaspersky Lab Zao System and method for detecting malicious code executed by virtual machine
US20140119390A1 (en) * 2012-10-29 2014-05-01 Adva Optical Networking Se Method and Device for Assessing the Performance of One or More Packet Synchronization Services in a Packet Data Transmission Network
US20140218389A1 (en) * 2009-04-24 2014-08-07 Allgress, Inc. Enterprise Information Security Management Software For Prediction Modeling With Interactive Graphs
US20140278623A1 (en) * 2008-06-19 2014-09-18 Frank Martinez System and method for a cloud computing abstraction with self-service portal
US20150106307A1 (en) * 2006-12-21 2015-04-16 Support Machines Ltd. Method and computer program product for providing a response to a statement of a user
US9130906B1 (en) * 2014-05-23 2015-09-08 The United States Of America As Represented By The Secretary Of The Navy Method and apparatus for automated secure one-way data transmission
WO2015145403A1 (en) * 2014-03-28 2015-10-01 Reaux-Savonte Corey System, architecture and methods for an intelligent, self-aware and context-aware digital organism-based telecommunication system
US20150293917A1 (en) * 2014-04-09 2015-10-15 International Business Machines Corporation Confidence Ranking of Answers Based on Temporal Semantics

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1245572A (zh) * 1997-10-30 2000-02-23 全昌龙 计算机安全部件
US20020165947A1 (en) * 2000-09-25 2002-11-07 Crossbeam Systems, Inc. Network application apparatus
JP5219783B2 (ja) * 2008-12-24 2013-06-26 三菱電機株式会社 不正アクセス検知装置及び不正アクセス検知プログラム及び記録媒体及び不正アクセス検知方法
US9386030B2 (en) * 2012-09-18 2016-07-05 Vencore Labs, Inc. System and method for correlating historical attacks with diverse indicators to generate indicator profiles for detecting and predicting future network attacks
US10096316B2 (en) * 2013-11-27 2018-10-09 Sri International Sharing intents to provide virtual assistance in a multi-person dialog
JP6086423B2 (ja) * 2012-11-14 2017-03-01 国立研究開発法人情報通信研究機構 複数センサの観測情報の突合による不正通信検知方法
US9406143B2 (en) * 2013-02-21 2016-08-02 Samsung Electronics Co., Ltd. Electronic device and method of operating electronic device
US9875494B2 (en) * 2013-04-16 2018-01-23 Sri International Using intents to analyze and personalize a user's dialog experience with a virtual personal assistant
KR20140136350A (ko) * 2013-05-20 2014-11-28 삼성전자주식회사 전자장치의 사용 방법 및 장치
CN103593610B (zh) * 2013-10-09 2016-08-31 中国电子科技集团公司第二十八研究所 基于计算机免疫的间谍软件自适应诱导与检测方法
US9489514B2 (en) * 2013-10-11 2016-11-08 Verisign, Inc. Classifying malware by order of network behavior artifacts
RU2014111971A (ru) * 2014-03-28 2015-10-10 Юрий Михайлович Буров Способ и система голосового интерфейса
WO2016001924A2 (en) * 2014-06-30 2016-01-07 Syqe Medical Ltd. Methods, devices and systems for pulmonary delivery of active agents

Patent Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150347753A1 (en) * 2006-04-06 2015-12-03 Juniper Networks, Inc. Malware detection system and method for mobile platforms
US8321941B2 (en) * 2006-04-06 2012-11-27 Juniper Networks, Inc. Malware modeling detection system and method for mobile platforms
US20150106307A1 (en) * 2006-12-21 2015-04-16 Support Machines Ltd. Method and computer program product for providing a response to a statement of a user
US20140278623A1 (en) * 2008-06-19 2014-09-18 Frank Martinez System and method for a cloud computing abstraction with self-service portal
US8353033B1 (en) * 2008-07-02 2013-01-08 Symantec Corporation Collecting malware samples via unauthorized download protection
US20140218389A1 (en) * 2009-04-24 2014-08-07 Allgress, Inc. Enterprise Information Security Management Software For Prediction Modeling With Interactive Graphs
US20120123829A1 (en) * 2009-07-30 2012-05-17 CENX, Inc. Independent carrier ethernet interconnection platform
US20120216243A1 (en) * 2009-11-20 2012-08-23 Jasvir Singh Gill Active policy enforcement
US20130086260A1 (en) * 2011-07-11 2013-04-04 International Business Machines Corporation Automatic Generation of User Account Policies Based on Configuration Management Database Information
US20140119390A1 (en) * 2012-10-29 2014-05-01 Adva Optical Networking Se Method and Device for Assessing the Performance of One or More Packet Synchronization Services in a Packet Data Transmission Network
US8713631B1 (en) * 2012-12-25 2014-04-29 Kaspersky Lab Zao System and method for detecting malicious code executed by virtual machine
WO2015145403A1 (en) * 2014-03-28 2015-10-01 Reaux-Savonte Corey System, architecture and methods for an intelligent, self-aware and context-aware digital organism-based telecommunication system
US20150293917A1 (en) * 2014-04-09 2015-10-15 International Business Machines Corporation Confidence Ranking of Answers Based on Temporal Semantics
US9130906B1 (en) * 2014-05-23 2015-09-08 The United States Of America As Represented By The Secretary Of The Navy Method and apparatus for automated secure one-way data transmission

Cited By (61)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11574287B2 (en) 2017-10-10 2023-02-07 Text IQ, Inc. Automatic document classification
US10646998B2 (en) 2017-11-27 2020-05-12 Intuition Robotics, Ltd. System and method for optimizing resource usage of a robot
WO2019104189A1 (en) * 2017-11-27 2019-05-31 Intuition Robotics, Ltd System and method for optimizing resource usage of a robot
US11232523B2 (en) 2018-01-02 2022-01-25 Patrick Schur System and method for providing an intelligent operating interface and intelligent personal assistant as a service on a crypto secure social media and cross bridge service with continuous prosumer validation based on i-operant tags, i-bubble tags, demojis and demoticons
US11157295B2 (en) 2018-01-02 2021-10-26 Patrick Schur System and method for providing intelligent operant operating interface and intelligent personal assistant as a service on a crypto secure social media and cross bridge service with continuous prosumer validation based on i-operant+198 tags, i-bubble+198 tags, demojis+198 and demoticons+198
WO2019169486A1 (en) * 2018-03-05 2019-09-12 EzoTech Inc. Automated security testing system and method
US10848506B2 (en) 2018-06-06 2020-11-24 Reliaquest Holdings, Llc Threat mitigation system and method
US10855702B2 (en) 2018-06-06 2020-12-01 Reliaquest Holdings, Llc Threat mitigation system and method
US10721252B2 (en) 2018-06-06 2020-07-21 Reliaquest Holdings, Llc Threat mitigation system and method
US10735444B2 (en) 2018-06-06 2020-08-04 Reliaquest Holdings, Llc Threat mitigation system and method
US10735443B2 (en) 2018-06-06 2020-08-04 Reliaquest Holdings, Llc Threat mitigation system and method
US11709946B2 (en) 2018-06-06 2023-07-25 Reliaquest Holdings, Llc Threat mitigation system and method
US11687659B2 (en) 2018-06-06 2023-06-27 Reliaquest Holdings, Llc Threat mitigation system and method
US11637847B2 (en) 2018-06-06 2023-04-25 Reliaquest Holdings, Llc Threat mitigation system and method
US11611577B2 (en) 2018-06-06 2023-03-21 Reliaquest Holdings, Llc Threat mitigation system and method
US11588838B2 (en) 2018-06-06 2023-02-21 Reliaquest Holdings, Llc Threat mitigation system and method
WO2019236802A1 (en) * 2018-06-06 2019-12-12 Reliaquest Holdings, Llc Threat mitigation system and method
US10848512B2 (en) 2018-06-06 2020-11-24 Reliaquest Holdings, Llc Threat mitigation system and method
US10848513B2 (en) 2018-06-06 2020-11-24 Reliaquest Holdings, Llc Threat mitigation system and method
US11921864B2 (en) 2018-06-06 2024-03-05 Reliaquest Holdings, Llc Threat mitigation system and method
US10855711B2 (en) 2018-06-06 2020-12-01 Reliaquest Holdings, Llc Threat mitigation system and method
WO2019236813A1 (en) * 2018-06-06 2019-12-12 Reliaquest Holdings, Llc Threat mitigation system and method
US11528287B2 (en) 2018-06-06 2022-12-13 Reliaquest Holdings, Llc Threat mitigation system and method
US10951641B2 (en) 2018-06-06 2021-03-16 Reliaquest Holdings, Llc Threat mitigation system and method
US10965703B2 (en) 2018-06-06 2021-03-30 Reliaquest Holdings, Llc Threat mitigation system and method
US11374951B2 (en) 2018-06-06 2022-06-28 Reliaquest Holdings, Llc Threat mitigation system and method
US11363043B2 (en) 2018-06-06 2022-06-14 Reliaquest Holdings, Llc Threat mitigation system and method
US11323462B2 (en) 2018-06-06 2022-05-03 Reliaquest Holdings, Llc Threat mitigation system and method
US11297080B2 (en) 2018-06-06 2022-04-05 Reliaquest Holdings, Llc Threat mitigation system and method
US11265338B2 (en) 2018-06-06 2022-03-01 Reliaquest Holdings, Llc Threat mitigation system and method
WO2019236805A1 (en) * 2018-06-06 2019-12-12 Reliaquest Holdings, Llc Threat mitigation system and method
US11095673B2 (en) 2018-06-06 2021-08-17 Reliaquest Holdings, Llc Threat mitigation system and method
US11108798B2 (en) 2018-06-06 2021-08-31 Reliaquest Holdings, Llc Threat mitigation system and method
US11438228B1 (en) 2018-06-21 2022-09-06 Wells Fargo Bank, N.A. Intelligent learning and management of a networked architecture
US11658873B1 (en) 2018-06-21 2023-05-23 Wells Fargo Bank, N.A. Intelligent learning and management of a networked architecture
US10785108B1 (en) 2018-06-21 2020-09-22 Wells Fargo Bank, N.A. Intelligent learning and management of a networked architecture
US11068464B2 (en) 2018-06-26 2021-07-20 At&T Intellectual Property I, L.P. Cyber intelligence system and method
US10868782B2 (en) 2018-07-12 2020-12-15 Bank Of America Corporation System for flagging data transmissions for retention of metadata and triggering appropriate transmission placement
WO2020016906A1 (en) * 2018-07-16 2020-01-23 Sriram Govindan Method and system for intrusion detection in an enterprise
CN109189751A (zh) * 2018-09-18 2019-01-11 平安科技（深圳）有限公司 基于区块链的数据同步方法及终端设备
CN109189751B (zh) * 2018-09-18 2023-05-26 平安科技（深圳）有限公司 基于区块链的数据同步方法及终端设备
US11122136B2 (en) 2018-10-22 2021-09-14 Red Hat, Inc. Quantum payload service for facilitating communications between a quantum computing system and classical computing systems
US10740930B2 (en) 2018-11-07 2020-08-11 Love Good Color LLC Systems and methods for color selection and auditing
US10930027B2 (en) 2018-11-07 2021-02-23 Love Good Color LLC Systems and methods for color selection and auditing
US11144334B2 (en) 2018-12-20 2021-10-12 Red Hat, Inc. Quantum computer task manager
WO2020167586A1 (en) * 2019-02-11 2020-08-20 Db Cybertech, Inc. Automated data discovery for cybersecurity
FR3094600A1 (fr) * 2019-03-29 2020-10-02 Orange Procédé d’extraction d’au moins un motif de communication dans un réseau de communication
US11546366B2 (en) 2019-05-08 2023-01-03 International Business Machines Corporation Threat information sharing based on blockchain
US11309974B2 (en) 2019-05-09 2022-04-19 Red Hat, Inc. Quantum channel routing utilizing a quantum channel measurement service
USD926809S1 (en) 2019-06-05 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926810S1 (en) 2019-06-05 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926811S1 (en) 2019-06-06 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926782S1 (en) 2019-06-06 2021-08-03 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
USD926200S1 (en) 2019-06-06 2021-07-27 Reliaquest Holdings, Llc Display screen or portion thereof with a graphical user interface
CN111651756A (zh) * 2020-06-04 2020-09-11 成都安恒信息技术有限公司 一种应用于运维审计navicat的自动代填方法
CN111651756B (zh) * 2020-06-04 2022-05-31 成都安恒信息技术有限公司 一种应用于运维审计navicat的自动代填方法
US11606694B2 (en) 2020-10-08 2023-03-14 Surendra Goel System that provides cybersecurity in a home or office by interacting with internet of things devices and other devices
WO2022126260A1 (en) * 2020-12-15 2022-06-23 Mastercard Technologies Canada ULC Enterprise server and method with universal bypass mechanism for automatically testing real-time cybersecurity microservice with live data
US20220191234A1 (en) * 2020-12-15 2022-06-16 Mastercard Technologies Canada ULC Enterprise server and method with universal bypass mechanism for automatically testing real-time computer security services
WO2023097026A3 (en) * 2021-11-23 2023-07-27 Strong Force TX Portfolio 2018, LLC Transaction platforms where systems include sets of other systems
RU2806927C1 (ru) * 2023-08-17 2023-11-08 Открытое Акционерное Общество "Российские Железные Дороги" Система защиты информации системы управления движением электропоездов в автоматическом режиме

Also Published As

Publication number Publication date
MY195524A (en) 2023-01-30
RU2750554C2 (ru) 2021-06-29
SG11201806117TA (en) 2018-08-30
AU2022202786A1 (en) 2022-05-19
AU2024202003A1 (en) 2024-04-18
EP3405911A4 (en) 2019-09-18
SG10202108336PA (en) 2021-08-30
ZA201805385B (en) 2022-07-27
IL306075A (en) 2023-11-01
AU2017210132A1 (en) 2018-08-23
JP2022141966A (ja) 2022-09-29
IL260711B2 (en) 2024-02-01
JP2019511030A (ja) 2019-04-18
IL260711A (ru) 2018-09-20
BR112018015014A2 (pt) 2018-12-18
MX2018009079A (es) 2022-12-15
RU2018129947A3 (ru) 2020-07-08
RU2018129947A (ru) 2020-02-25
IL260711B1 (en) 2023-10-01
KR20180105688A (ko) 2018-09-28
CN109313687B (zh) 2022-06-24
CA3051164A1 (en) 2017-07-27
CN115062297A (zh) 2022-09-16
EP3405911A1 (en) 2018-11-28
CN109313687A (zh) 2019-02-05

Similar Documents

Publication Publication Date Title
US20220030009A1 (en) Computer security based on artificial intelligence
AU2024202003A1 (en) Computer security based on artificial intelligence
Braun et al. Security and privacy challenges in smart cities
US11140152B2 (en) Dynamic risk detection and mitigation of compromised customer log-in credentials
Zheng et al. Towards IoT security automation and orchestration
Sandeepa et al. A survey on privacy for B5G/6G: New privacy challenges, and research directions
Sujatha et al. Cyber Security Applications for Industry 4.0
Dhayanidhi Research on IoT threats & implementation of AI/ML to address emerging cybersecurity issues in IoT with cloud computing
Kamara Securing Critical Infrastructures
Diogenes et al. Microsoft Azure Security Center
Mack Cyber security
Howard Cybersecurity First Principles: A Reboot of Strategy and Tactics
Huang et al. Utilizing Prompt Engineering to Operationalize Cybersecurity
Atoum et al. Big data management: Security and privacy concerns
Varney Analysis of the impact of artificial intelligence to cybersecurity and protected digital ecosystems
Quade The digital big bang: The hard stuff, the soft stuff, and the future of cybersecurity
van Oorschot et al. Security concepts and principles
Tang et al. Big data security management
Cortés Analysis and design of security mechanisms in the context of Advanced Persistent Threats against critical infrastructures
Scott Comparing Cybercrime in Banking and Healthcare Sectors
Bhat Analysis of Cybersecurity for the Enterprise
Diogenes et al. Microsoft Defender for Cloud
Rubio Cortés Analysis and design of security mechanisms in the context of Advanced Persistent Threats against critical infrastructures
Sharma et al. Developments Towards Next Generation Intelligent Systems for Sustainable Development
García Bazán Data Protection Concerns in Emerging Technologies

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17742143

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11201806117T

Country of ref document: SG

WWE Wipo information: entry into national phase

Ref document number: 260711

Country of ref document: IL

ENP Entry into the national phase

Ref document number: 2018538714

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: MX/A/2018/009079

Country of ref document: MX

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112018015014

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2017210132

Country of ref document: AU

Date of ref document: 20170124

Kind code of ref document: A

Ref document number: 20187024400

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020187024400

Country of ref document: KR

WWE Wipo information: entry into national phase

Ref document number: 2017742143

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 112018015014

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20180723

ENP Entry into the national phase

Ref document number: 3051164

Country of ref document: CA