Policy generation in airborne systems

1. A non-transitory machine-readable medium including instructions that, when executed by processing circuitry of a machine, configure the processing circuitry for detection of policy anomalies in packets on a 1553B bus of an airborne system, the processing circuitry configured to perform operations comprising:

decoding a computer network defense (CND) capability message, wherein the CND capability message indicates an interface to monitor, and wherein the interface is the 1553B bus of the airborne system;

decoding a CND command message, associated with the CND capability message, the CND command message comprising a policy set;

receiving packets from the 1553B bus;

analyzing the 1553B packets based on the policy set to determine anomalies;

allowing non-anomalous 1553B packets to reach destinations of the non-anomalous 1553B packets; and

discarding anomalous 1553B packets such that the anomalous 1553B packets do not reach respective destinations of the anomalous 1533B packets; and

wherein analyzing the 1553B packets based on the policy set to determine anomalies comprises:

analyzing a mode code of a data transfer to determine if the m ode code is allowed based on the policy set;

analyzing a status flag of the data transfer to determine if the status flag is allowed based on the policy set;

analyzing a source of the data transfer to determine if the source is allowed based on the policy set; and

analyzing a destination of the data transfer to determine if the destination is allowed based on the policy set.

2. The non-transitory machine-readable medium of claim 1 , wherein the operations further comprise decoding a mission mode, wherein analyzing the 1553B packets based on the policy set to determine anomalies is based on the mission mode.

3. The non-transitory machine-readable medium of claim 1 , wherein analyzing the 1553B packets based on the policy set to determine anomalies comprises determining the source of the data transfer is allowed to send data to the destination of the data transfer based on the policy set.

4. The non-transitory machine-readable medium of claim 3 , wherein analyzing the 1553B packets based on the policy set to determine anomalies comprises:

determining the data transfer is a first remote terminal to a second remote terminal transfer; and

determining the first remote terminal to the second remote terminal transfer is allowed based on the policy set.

5. The non-transitory machine-readable medium of claim 1 , wherein the policy set comprises a list of active 1553B bus addresses, wherein each list of active 1553B bus addresses is associated with a transmit flag that indicates if the each list of active 1553B bus addresses is allowed to transmit data on the 1553B bus, and wherein analyzing a source of the data transfer to determine if the source is allowed based on the policy set comprises determining the list of active 1553B bus addresses comprises the source, and determining the source is allowed to send data on the 1533B bus based on a transmit flag associated with the source.

6. The non-transitory machine-readable medium of claim 1 , wherein the operations further comprise:

determining a predetermined number of anomalies have occurred on the 1553B bus; and

encoding an alert based on determining the predetermined number of anomalies have occurred on the 1553B bus.

7. A method for detection of policy anomalies in packets on a 1553B bus of an airborne system, the method comprising:

decoding a computer network defense (CND) capability message, wherein the CND capability message indicates an interface to monitor, and wherein the interface is the 1553B bus of the airborne system;

decoding a CND command message, associated with the CND capability message, the CND command message comprising a policy set;

receiving packets from the 1553B bus;

analyzing the 1553B packets based on the policy set to determine anomalies;

allowing non-anomalous 1553B packets to reach destinations of the non-anomalous 1553B packets; and

discarding anomalous 1553B packets such that the anomalous 1553B packets do not reach respective destinations of the anomalous 1533B packets; and

wherein analyzing the 1553B packets based on the policy set to determine anomalies comprises:

analyzing a mode code of a data transfer to determine if the m ode code is allowed based on the policy set;

analyzing a status flag of the data transfer to determine if the status flag is allowed based on the policy set;

analyzing a source of the data transfer to determine if the source is allowed based on the policy set; and

analyzing a destination of the data transfer to determine if the destination is allowed based on the policy set.

8. The method of claim 7 , further comprising decoding a mission mode, wherein analyzing the 1553B packets based on the policy set to determine anomalies is based on the mission mode.

9. The method of claim 7 , wherein analyzing the 1553B packets based on the policy set to determine anomalies comprises determining the source of the data transfer is allowed to send data to the destination of the data transfer based on the policy set.

10. The method of claim 9 , wherein analyzing the 1553B packets based on the policy set to determine anomalies comprises:

determining the data transfer is a first remote terminal to a second remote terminal transfer; and

determining the first remote terminal to the second remote terminal transfer is allowed based on the policy set.

11. The method of claim 7 , wherein the policy set comprises a list of active 1553B bus addresses, wherein each list of active 1553B bus addresses is associated with a transmit flag that indicates if the each list of active 1553B bus addresses is allowed to transmit data on the 1553B bus, and wherein analyzing a source of the data transfer to determine if the source is allowed based on the policy set comprises determining the list of active 1553B bus addresses comprises the source, and determining the source is allowed to send data on the 1533B bus based on a transmit flag associated with the source.

12. The method of claim 7 , further comprising:

determining a predetermined number of anomalies have occurred on the 1553B bus; and

encoding an alert based on determining the predetermined number of anomalies have occurred on the 1553B bus.

13. A system for detection of policy anomalies in packets on a 1553B bus of an airborne system, the system comprising:

processing circuitry;

a memory including program instructions that, when executed the processing circuitry, configure the processing circuitry to:

decode a computer network defense (CND) capability message, wherein the CND capability message indicates an interface to monitor, and wherein the interface is the 1553B bus of the airborne system;

decode a CND command message, associated with the CND capability message, the CND command message comprising a policy set;

receive packets from the 1553B bus;

analyze the 1553B packets based on the policy set to determine anomalies;

allow non-anomalous 1553B packets to reach destinations of the non-anomalous 1553B packets; and

discard anomalous 1553B packets such that the anomalous 1553B packets do not reach respective destinations of the anomalous 1533B packets; and

where to analyze the 1553B packets based on the policy set to determine anomalies the processing circuitry is configured to:

analyze a mode code of a data transfer to determine if the mode code is allowed based on the policy set;

analyze a status flag of the data transfer to determine if the status flag is allowed based on the policy set;

analyze a source of the data transfer to determine if the source is allowed based on the policy set; and

analyze a destination of the data transfer to determine if the destination is allowed based on the policy set.

14. The system of claim 13 , wherein the processing circuitry is configured to decode a mission mode, wherein the analysis of the 1553B packets based on the policy set to determine anomalies is based on the mission mode.

15. The system of claim 13 , wherein to analyze the 1553B packets based on the policy set to determine anomalies the processing circuitry is configured to determine the source of the data transfer is allowed to send data to the destination of the data transfer based on the policy set.

16. The system of claim 15 , wherein to analyze the 1553B packets based on the policy set to determine anomalies the processing circuitry is configured to:

determine the data transfer is a first remote terminal to a second remote terminal transfer; and

determine the first remote terminal to the second remote terminal transfer is allowed based on the policy set.

17. The system of claim 13 , wherein the policy set comprises a list of active 1553B bus addresses, wherein each list of active 1553B bus addresses is associated with a transmit flag that indicates if the each list of active 1553B bus addresses is allowed to transmit data on the 1553B bus, and wherein to analyze a source of the data transfer to determine if the source is allowed based on the policy set the processing circuitry is configured to:

determine the list of active 1553B bus addresses comprises the source; and determine the source is allowed to send data on the 1533B bus based on a transmit flag associated with the source.