GEOGRAPHICAL INTRUSION RESPONSE PRIORITIZATION MAPPING THROUGH AUTHENTICATION AND FLIGHT DATA CORRELATION

• US 20070152849A1
• Filed: 03/07/2007
• Published: 07/05/2007
• Est. Priority Date: 08/12/2004
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Airfone Inc. (Verizon Communications Inc.), Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: Tucker, Steven, McConnell, James
• Granted Patent: US 8,572,734 B2
• Time in Patent Office: Days
• US Class Current: 340/963
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G08G 5/0008 with other aircraft
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Preferred systems and methods for geographically mapping intrusions through network or authentication data and flight data correlation are described. In one aspect, methods and systems include receiving threat data, receiving network or authentication data, receiving flight location data, correlating the threat data and the network or authentication data with the flight location data to generate map data, and generating a map displaying a geographical location of the intrusion based on the map data.

Claims

1. A method for geographically mapping an intrusion in connection with an airline, comprising:

receiving threat data;

receiving identification data;

receiving flight location data;

correlating the threat data and the identification data with the flight location data to generate map data; and

generating a map displaying a geographical location of the intrusion based on the map data.

2. The method of claim 1, wherein the threat data comprises source IP address, destination IP address, and attack event name.

3. The method of claim 1, wherein the identification data comprises at least one of authentication information, IP address, and aircraft information.

4. The method of claim 3, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

correlating comprises correlating the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

5. The method of claim 1, wherein the flight location data comprises aircraft information and a current aircraft location.

6. The method of claim 1, wherein the map data comprises identification information, IP address, attack event name, and geographic coordinates.

7. A method for geographically mapping an intrusion in connection with an airline, comprising:

receiving threat data;

querying identification data by providing the threat data;

retrieving the identification data, the identification data including identification information and flight information data;

querying flight location data by providing at least a portion of the identification data;

retrieving the flight location data;

correlating the threat data with the flight location data to generate map data; and

generating a map displaying a geographical location of the intrusion based on the map data.

8. The method of claim 7, wherein the threat data comprises source IP address, destination IP address, and attack event name.

9. The method of claim 7, wherein the identification data comprises authentication information, IP address, and aircraft information.

10. The method of claim 9, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

querying identification data comprises correlating the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

11. The method of claim 7, wherein the flight location data comprises aircraft information and a current aircraft location.

12. The method of claim 7, wherein the map data comprises identification information, IP address, attack event name, and geographic coordinates.

13. A system for geographically mapping an intrusion in connection with an airline, comprising:

a network-based system configured to provide threat data;

an identification system configured to provide identification data, the identification data including authentication data and flight information data;

a location system configured to provide flight location data;

a mapping system connected to the network-based system, the identification system and the location system and configured to receive the threat data, the identification data, the flight information data and the flight location data, generate map data by correlating the threat data, the identification data and the flight information data with the flight location data, and generate a map reflecting a geographical location of the intrusion based on the map data; and

a display device connected to the mapping system and configured to communicate with the mapping system to display the generated map.

14. The system of claim 13, wherein the threat data comprises source IP address, destination IP address, and attack event name.

15. The system of claim 13, wherein the identification system includes an authentication system that is implemented through the RADIUS Authentication Protocol.

16. The system of claim 13, wherein the identification data comprises identification information, IP address, and aircraft information.

17. The system of claim 16, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

the mapping system is further configured to correlate the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

18. The system of claim 13, wherein the flight location data comprises aircraft information and current aircraft location.

19. The system of claim 13, wherein the map data comprises identification information, IP address, attack event name, flight information and geographic coordinates.

20. A system for geographically mapping an intrusion in connection with an airline, comprising:

a network-based system configured to provide threat data;

an identification system configured to receive the threat data from the network-based system and provide authentication data based on the threat data;

a location system configured to receive the identification data from the identification system and provide flight location data based on the identification data;

a mapping system connected to the network-based system, the identification system, and the location system and configured to receive the threat data and the flight location data, generate map data by correlating the threat data with the flight location data, and generate a map reflecting a geographical location of the intrusion based on the map data; and

a display device connected to the mapping system and configured to communicate with the mapping system to display the generated map.

21. The system of claim 20, wherein the threat data comprises source IP address, destination IP address, and attack event name.

22. The system of claim 20, wherein the identification system includes an authentication system that is implemented through the RADIUS Authentication Protocol.

23. The system of claim 20, wherein the identification data comprises authentication identification, IP address, and aircraft information.

24. The system of claim 23, wherein:

the threat data comprises source IP address, destination IP address, and attack event name; and

the authentication system is further configured to correlate the IP address of the identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data.

25. The system of claim 20, wherein the flight data comprises aircraft information and current aircraft location.

26. The system of claim 20, wherein the map data comprises identification information, IP address, attack event name, flight information and geographic coordinates.