Dynamic security hardening of security critical functions

Patent metadata

Field	Value
Publication number	US-9369484-B1
Application number	US-201414340010-A
Country	US
Kind code	B1
Filing date	Jul 24, 2014
Priority date	Jul 24, 2014
Publication date	Jun 14, 2016
Grant date	Jun 14, 2016

Abstract

A method for providing dynamic security hardening of selected aircraft functions includes: a) monitoring sequences of real-time security events for at least one aircraft function; b) accessing a database storing a plurality of sequences of attack events indicative of an attack of the at least one aircraft function; c) probabilistically inferring, by at least one processor, the location and progression of an attack represented within the database by utilizing the sequences of real-time security events; and d) activating at least one countermeasure in response to an inferred location and progression of an attack.

First claim

The invention claimed is:

1. A method for providing dynamic security hardening of selected aircraft functions, comprising the steps of:
a) monitoring sequences of real-time security events for at least one aircraft function;
b) accessing a database storing a plurality of sequences of attack events indicative of an attack of the at least one aircraft function, wherein said database comprises:
i) a plurality of nodes, each node representing a potential attack, each node including at least one node attribute;
ii) a plurality of links, each link connecting a pair of said plurality of nodes, each link representing a potential attack progression, each link including at least one link attribute; and,
iii) at least one security property for a specified node;

c) probabilistically inferring, by at least one processor, a location, progression, and security property of a real-time attack represented within the database by utilizing said sequences of real-time security events; and
d) automatically activating at least one avionics specific countermeasure in real-time, in response to the inferred location, progression, and security property of the real-time attack.

2. The method of claim 1 , wherein said at least one aircraft function is selected from a group of aircraft functions including: data loading, electronic flight bags, and passenger information and entertainment service domain.

3. The method of claim 1 , wherein said step of monitoring said sequences of real-time security events comprises analyzing collected logs to highlight behaviors of interest representing the security events, the logs being defined as lists of activities that occurred, with records of new events being appended to the end of the logs as they occur.

4. The method of claim 1 , wherein said database comprises a plurality of attack trees, each attack tree comprising:
a) said plurality of nodes; and
b) said plurality of links.

5. The method of claim 4 , wherein said step of probabilistically inferring comprises querying the database by the steps of:
a) inferring a current node(s) under attack in the appropriate attack tree for a real-time security event;
b) inferring a next node(s) under attack in the appropriate attack tree for a sequence of real-time security events; and
c) identifying whether a security property specified in a root node of said plurality of nodes is violated.

6. The method of claim 4 , wherein said at least one node attribute comprises at least one countermeasure.

7. The method of claim 1 , wherein said step of probabilistically inferring comprises multicriteria decision making utilizing fuzzy set theory.

8. The method of claim 1 , wherein said step of activating at least one countermeasure comprises utilizing a decision tree.

9. A system for providing dynamic security hardening of selected aircraft functions, comprising:
a) a plurality of sensors configured to collect and log data entering an aircraft;
b) a dynamic security hardening engine, comprising:
i) a monitor agent for receiving said data collected by said plurality of sensors, analyzing the data, and generating sequences of real-time security events for at least one aircraft function;
ii) an inference engine for: 1) accessing a database storing a plurality of sequences of attack events indicative of an attack of the at least one aircraft function; and 2) probabilistically inferring, by at least one processor, a location, progression, and security property of a real-time attack represented within the database by utilizing said sequences of real-time security events; and
iii) a decision engine for automatically activating at least one avionics specific countermeasure in real-time, for the aircraft function to be protected, in response to the inferred location, progression, and security property of the real-time attack, wherein said database comprises:
i) a plurality of nodes, each node representing a potential attack, each node including at least one node attribute;
ii) a plurality of links, each link connecting a pair of said plurality of nodes, each link representing a potential attack progression, each link including at least one link attribute; and,
iii) at least one security property for a specified node.

10. The system of claim 9 , further comprising a storage device including said database.

11. The system of claim 9 , wherein said at least one aircraft function is selected from a group of aircraft functions including: data loading, electronic flight bags, and passenger information and entertainment service domain.

12. The system of claim 9 , wherein said sequences of real-time security events comprises collected logs to highlight behaviors of interest representing the security events, the logs being defined as lists of activities that occurred, with records of new events being appended to the end of the logs as they occur.

13. The system of claim 9 , wherein said database comprises a plurality of attack trees, each attack tree comprising:
a) said plurality of nodes; and
b) said plurality of links.

14. The system of claim 9 , wherein said inference engine is configured to query the database by:
a) inferring a current node(s) under attack in the appropriate attack tree for a real-time security event;
b) inferring a next node(s) under attack in the appropriate attack tree for a sequence of real-time security events; and
c) identifying whether a security property specified in a root node of said plurality of nodes is violated.

15. The system of claim 9 , wherein said at least one node attribute comprises at least one countermeasure.

16. The system of claim 9 , wherein said inference engine is configured to provide said probabilistically inferring by multicriteria decision making utilizing fuzzy set theory.

17. The system of claim 9 , wherein said decision engine is a decision tree configured to activate said at least one countermeasure.

18. A method for providing dynamic security hardening of selected aircraft functions, comprising the steps of:
a) monitoring sequences of real-time security events for at least one aircraft function;
b) accessing a database storing a plurality of sequences of attack events indicative of an attack of the at least one aircraft function, wherein said database comprises a graph database comprising:
i) a plurality of nodes, each node representing a potential attack, each node including at least one node attribute;
ii) a plurality of links, each link connecting a pair of said plurality of nodes, each link representing a potential attack progression, each link including at least one link attribute; and,
iii) at least one security property for a specified node;

c) probabilistically inferring, comprising multicriteria decision making utilizing fuzzy set theory, utilizing at least one processor, a location, progression, and security property of a real-time attack represented within the database by utilizing said sequences of real-time security events, wherein said step of activating at least one countermeasure comprises utilizing a decision tree; and
d) automatically activating at least one avionics specific countermeasure in real-time, in response to an inferred location, progression, and security property of the real-time attack.

Assignees

• Lacerte Yves
• Ryon Luke E
• Morrissey Patrick J
• Rockwell Collins Inc

Inventors

• Lacerte Yves
• Ryon Luke E
• Morrissey Patrick J

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title