Geographical intrusion response prioritization mapping through authentication and flight data correlation

Patent metadata

Field	Value
Publication number	US-9591004-B2
Application number	US-201314065333-A
Country	US
Kind code	B2
Filing date	Oct 28, 2013
Priority date	Aug 12, 2004
Publication date	Mar 7, 2017
Grant date	Mar 7, 2017

Abstract

Preferred systems and methods for geographically mapping intrusions through network or authentication data and flight data correlation are described. In one aspect, methods and systems include receiving threat data, receiving network or authentication data, receiving flight location data, correlating the threat data and the network or authentication data with the flight location data to generate map data, and generating a map displaying a geographical location of the intrusion based on the map data.

First claim

What is claimed is:

1. A method for displaying data associated with a cyber-attack threat against an airline, comprising:
receiving threat data associated with a network point of an airline, wherein the threat data relates to at least one of a vulnerability or an intrusion;
retrieving flight identification data from a flight information database in response to receiving the threat data, wherein the flight identification data comprises an Internet Protocol (IP) address of the network point;
retrieving flight location data from a flight location database using the flight identification data;
correlating the threat data, the flight identification data, and the flight location data to generate a record using a processor, wherein the threat data comprises a source IP address and a destination IP address, and wherein correlating comprises associating the IP address of the flight identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data; and
outputting a graphical representation reflecting the record.

2. The method of claim 1 , wherein outputting the graphical representation comprises graphically distinguishing the record based on a current status of a mitigation response to the threat.

3. The method of claim 1 , wherein the threat data further comprises an attack event name.

4. The method of claim 3 , wherein the record comprises the attack event name, the destination IP address, and the flight location data.

5. The method of claim 1 , wherein the flight identification data further comprises at least one of authentication information of a user and aircraft information.

6. The method of claim 1 , wherein the flight location data comprises aircraft information and a current aircraft location.

7. A method for displaying data associated with a cyber-attack threat against an airline, comprising:
receiving threat data associated with a network point of an airline network, wherein the threat data relates to at least one of a vulnerability or an intrusion;
identifying an Internet Protocol (IP) address associated with the network point;
retrieving a router address corresponding to the network point from an Address Routing Protocol KARP) database using the IP address associated with the network point;
retrieving a geographical location for the network point from a network location database using the router address;
correlating the threat data and the geographical location to generate a map database record using a processor, wherein the threat data comprises a source IP address and a destination IP address, and wherein correlating comprises associating the geographical location with at least one of the source IP address of the threat data and the destination IP address of the threat data; and
outputting the map database record.

8. The method of claim 7 , further comprising indicating in the map database record when the at least one of a vulnerability or an intrusion is new.

9. The method of claim 7 , wherein outputting the map database record comprises graphically distinguishing the map database record based on a current status of a mitigation response to the threat.

10. The method of claim 9 , further comprising updating the map database record based on a change in the current status of the mitigation response to the threat.

11. The method of claim 7 , wherein the threat data further comprises an attack event name.

12. The method of claim 7 , wherein the network location database resides in a router on the airline network.

13. A method for displaying data associated with a cyber-attack threat against an airline network, comprising:
receiving vulnerability information identifying a network vulnerability at a network vulnerability point;
identifying, based on the vulnerability information, an Internet Protocol (IP) address associated with the network vulnerability point;
retrieving, from an Address Routing Protocol (ARP) database using the IP address associated with the network vulnerability point, an address corresponding to the network vulnerability point using a processor, wherein the ARP database resides in a router on the network;
retrieving, from a network location database using the address corresponding to the network vulnerability point, geographical location information associated with the network vulnerability point;
storing a vulnerability record for the network vulnerability point reflecting a current status of a mitigation response to the network vulnerability; and
outputting a graphical representation reflecting the vulnerability record.

14. The method of claim 13 , wherein the network vulnerability comprises a plurality of vulnerabilities corresponding to different computers on the airline network.

15. The method of claim 13 , further comprising adjusting the graphical representation based on a quantity of identified network vulnerability points in a geographical area.

16. The method of claim 13 , further comprising updating the current status of the mitigation response to the network vulnerability indicated by the vulnerability record.

17. The method of claim 16 , further comprising adjusting the graphical representation to reflect a change of the current status of the mitigation response to the network vulnerability.

18. The method of claim 13 , further comprising indicating in the vulnerability record when the network vulnerability is new.

Assignees

• Palo Alto Networks Inc

Inventors

• Mcconnell James T
• Tucker Steven

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title