Geographical intrusion mapping system using telecommunication billing and inventory systems

• US 20060253907A1
• Filed: 07/10/2006
• Published: 11/09/2006
• Est. Priority Date: 08/12/2004
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: McConnell, James Trent
• Granted Patent: US 8,631,493 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G08G 5/0008 with other aircraft
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Systems and methods for geographically mapping a threat into a network having one or more network points include receiving threat information identifying a threat to a point of the network, correlating the threat information with location information for the identified network point, and network identification information for the identified network point, and generating a map displaying a geographical location of the threat.

Claims

1. A method for geographically mapping a threat, comprising:

receiving threat data;

receiving identification data;

receiving location data;

correlating the threat data and the identification data with the location data to generate map data; and

generating a map displaying a geographical location of the threat based on the map data.

2. The method of claim 1, wherein the threat data comprises source IP address, destination IP address, and attack event name.

3. The method of claim 1, wherein the identification data comprises at least one of authorization information, caller ID information and IP address.

4. The method of claim 3, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

correlating comprises correlating the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

5. The method of claim 1, wherein the location data comprises at least one of caller ID information and authorization information, and the location data further includes geographic data.

6. The method of claim 5, wherein the geographic data includes at least one of a mailing address, billing address, installation address and geographic coordinates from customer billing information based on a caller ID identified customer or an authentication identified customer.

7. A method for geographically mapping a threat, comprising:

receiving threat data;

querying identification data by providing the threat data;

receiving the identification data;

querying location data by providing the identification data;

receiving the location data;

correlating the threat data with the location data to generate map data; and

generating a map displaying a geographical location of the threat based on the map data.

8. The method of claim 7, wherein the threat data comprises at least one of source IP address, destination IP address, and attack event name.

9. The method of claim 7, wherein the identification data includes at least one of authentication information, caller ID information and IP address.

10. The method of claim 9, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

querying identification data comprises correlating the IP address of the caller data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

11. The method of claim 7, wherein the location data includes at least one of caller ID information and authorization information, and the location data further includes geographic data.

12. The method of claim 11, wherein the geographic data includes at least one of a mailing address, billing address, installation address and geographic coordinates.

13. A system for geographically mapping a threat, comprising:

a network security system configured to provide threat data;

an identification system configured to provide identification data;

a location system configured to provide location data; and

a mapping system connected to the network security system, identification system and location system, and configured to receive the threat data, the identification data and the location data, generate map data by correlating the threat data and the identification data with the location data, and generate a map reflecting a geographical location of the threat based on the map data; and

a display device connected to the mapping system and configured to communicate with the mapping system to display the generated map.

14. The system of claim 13, wherein the threat data includes at least one of a source IP address, destination IP address, and attack event name.

15. The system of claim 13, wherein the identification system includes and authentication system, and wherein the authentication system uses the RADIUS authentication protocol.

16. The system of claim 13, wherein the identification data includes at least one of authorization information, caller ID information and an IP address.

17. The system of claim 16, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

the mapping system is further configured to correlate the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

18. The system of claim 13, wherein the location system includes a customer database.

19. The system of claim 13, wherein the location data comprises at least one of caller ID information and authorization information, and the location data further includes geographic data.

20. The method of claim 19, wherein the geographic data includes at least one of a mailing address, billing address, installation address and geographic coordinates.

21. A system for geographically mapping a threat, comprising:

a network security system configured to provide threat data;

an identification system configured to receive the threat data from the network security system and provide identification data based on the threat data;

a location system configured to receive the identification data from the identification system and provide location data based on the identification data;

a mapping system configured to receive the threat data and the location data, generate map data by correlating the threat data with the location data, and generate a map reflecting a geographical location of the threat based on the map data; and

a display device configured to communicate with the mapping system to display the generated map.

22. The system of claim 21, wherein the identification data includes at least one of authentication information, caller ID information and IP address.

23. The system of claim 22, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

the identification system is further configured to correlate the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

24. The system of claim 22, wherein the location data comprises at least one of caller ID information and authorization information, and the location data further includes geographic data.

25. The method of claim 24, wherein the geographic data includes at least one of a mailing address, billing address, installation address and geographic coordinates.