System and method for defending a network against cyber-threats

Patent metadata

Field	Value
Publication number	US-11356471-B2
Application number	US-201916537013-A
Country	US
Kind code	B2
Filing date	Aug 9, 2019
Priority date	Aug 9, 2019
Publication date	Jun 7, 2022
Grant date	Jun 7, 2022

Abstract

A system for defending a network against one or more cyber-threats. The system can include a network bus that includes a first node and a second node, such that network traffic flows from the first node to the second node. The system can include an intrusion defense unit connected to the network bus, such that network traffic between the first node and the second node passes through the intrusion defense unit, wherein when a potential cyber-threat is detected in the network traffic, the intrusion defense unit is configured to engage an associated switch to filter the network traffic until the cyber-threat is neutralized.

First claim

What is claimed is:

1. A system for defending a network against one or more cyber-threats, the system comprising:
a network bus that includes a first node and a second node, such that network traffic flows from the first node to the second node; and
an intrusion defense unit connected to the network bus, such that network traffic between the first node and the second node passes through the intrusion defense unit, wherein:
network traffic that passes through the intrusion defense unit is logged and cascaded to obtain searchable data; and
when a potential cyber-threat is detected in the network traffic, the intrusion defense unit is configured to engage an associated switch to filter the network traffic until the cyber-threat is neutralized, wherein the switch is engaged by a hardware device comprising one or more MOSFETs.

2. The system of claim 1 , wherein
the intrusion defense unit is configured to passively monitor the network traffic before the cyber-threat is detected.

3. The system of claim 1 , wherein
the intrusion defense unit is configured to passively monitor the network traffic after the cyber-threat is neutralized.

4. The system of claim 1 , wherein
the cyber-threat is detected based on an anomalous behavior of one or more nodes of the network.

5. The system of claim 1 , wherein
the cyber-threat is detected based on an anomalous behavior of the network traffic.

6. The system of claim 5 , wherein
the cyber-threat is detected based on a signature recognition of the anomalous behavior.

7. The system of claim 5 , wherein
the anomalous behavior is detected by parsing one or more messages in the network traffic.

8. A method for defending a network against one or more cyber-threats, the method comprising:
detecting a potential cyber-threat in network traffic flowing from a first node to a second node within a network bus, wherein the network traffic between the first node and second node passes through an intrusion defense unit;
logging and cascading network traffic that passes through the intrusion defense unit to obtain searchable data; and
filtering network traffic via the intrusion defense unit and an associated switch connected to the network bus, when the potential cyber-threat is detected, wherein the filtering is performed until the cyber-threat is neutralized, wherein the switch is engaged by a hardware device comprising one or more MOSFETs.

9. The method of claim 8 , wherein
the intrusion defense unit is configured to passively monitor the network traffic before the cyber-threat is detected.

10. The method of claim 8 , wherein
the intrusion defense unit is configured to passively monitor the network traffic after the cyber-threat is neutralized.

11. The method of claim 8 , wherein
the cyber-threat is detected based on an anomalous behavior of one or more nodes of the network.

12. The method of claim 8 , wherein
the cyber-threat is detected based on an anomalous behavior of the network traffic.

13. The method of claim 12 , wherein
the cyber-threat is detected based on a signature recognition of the anomalous behavior.

14. The method of claim 12 , comprising:
detecting the anomalous behavior by parsing one or more messages in the network traffic.

Assignees

• Booz Allen Hamilton Inc

Inventors

• Stanley Sean
• Petersen James
• Forant Christopher
• Rausch Matthew

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title