Inactive

TECHNOLOGY LICENSING OPPORTUNITY Email Attachment and Link Scanning Device based on Semi-Supervised Learning A novel device that uses deep learning to accurately identify malware documents and attachm... TECHNOLOGY LICENSING OPPORTUNITY Email Attachment and Link Scanning Device based on Semi-Supervised Learning A novel device that uses deep learning to accurately identify malware documents and attachments. Opportunity: Idaho National Laboratory (INL), managed and operated by Battelle Energy Alliance, LLC (BEA), is offering the opportunity to enter into a license and/or collaborative research agreement to commercialize this attachment and link scanning device. This technology transfer opportunity is part of a dedicated effort to convert government-funded research into job opportunities, businesses and ultimately an improved way of life for the American people. Overview: This work directly addresses ransomware threats faced by small to midsize companies that cannot support extensive IT organizations to promote training or prevent spear phishing attacks. The average cost per incident for smaller companies is approximately $700,000. Deploying machine learning based solutions has historically been computationally expensive. Competitors including fireeye, binary defense, and carbon black rely on cloud based software solutions. Description: Researchers at Idaho National Lab have developed a device that uses the attention mechanism in deep learning to apply function names accurately and reliably to disassembled email attachments. The reverse engineered function names and links are then sent to a probabilistic autoencoder for anomaly detection. Attachments or links that are classified as anomalous are then sequestered on the device in a virtual machine for revision while attachments classified as non-anomalous are delivered to the user. The entire system is implemented in programmable logic on a device entirely independent of the user’s computer. The machine learning elements are implemented on field programmable gate array logic while the virtual machine running the operating system manages all emails intended for the user’s system until released from sequester and transferred to the host’s system. Links or attachments that are flagged as anomalous are kept on the device and can be examined manually within the safety of the virtual machine without ever leaving the peripheral device. Benefits: Key benefit is the use of programmable logic and on-premise deployment. Provides robust coverage of the Mitre attack matrix. The speed of the anomaly flagging process is on the millisecond timescale and enables support for monitoring multiple host systems. Applications: Organizations vulnerable to ransomware and malware documents sent by email. Development Status: TRL 3, currently undergoing proof-of-concept work. IP Status: Patent Application No. 17/663,879, “Network Systems, Classification Methods, and Related Apparatuses for Security Analyses of Electronic Messages,” BEA Docket No. BA-1291. INL is seeking to license the above intellectual property to a company with a demonstrated ability to bring such inventions to the market. Exclusive rights in defined fields of use may be available. Added value is placed on relationships with small businesses, start-up companies, and general entrepreneurship opportunities. Please visit Technology Deployment’s website at https://inl.gov/inl-initiatives/technology-deployment for more information on working with INL and the industrial partnering and technology transfer process. Companies interested in learning more about this licensing opportunity should contact Andrew Rankin at td@inl.gov.