GEOGRAPHICAL VULNERABILITY MITGATION RESPONSE MAPPING SYSTEM

• US 20110093786A1
• Filed: 12/22/2010
• Published: 04/21/2011
• Est. Priority Date: 08/12/2004
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: MCCONNELL, James Trent
• Granted Patent: US 8,990,696 B2
• Time in Patent Office: Days
• US Class Current: 715/736
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and methods for geographically mapping a vulnerability of a network having one or more network points include receiving vulnerability information identifying a vulnerability of a point of the network, correlating the vulnerability information with location information for the identified network point, and network identification information for the identified network point, and generating a map displaying a geographical location of the vulnerability.

Claims

1-68. -68. (canceled)

69. A computer-implemented method for displaying a vulnerability of a network comprising one or more network points, the method comprising:

receiving, at a computer, network vulnerability information identifying a point of vulnerability in the network;

determining a network address of the identified network vulnerability point based on the received network vulnerability information;

determining a geographical location of the identified network vulnerability point based on the determined network address of the identified network vulnerability point;

receiving mitigation response status information indicative of a status of a mitigation response to the identified network vulnerability point;

providing a geographical map including at least the geographical location of the identified network vulnerability point;

providing a network vulnerability symbol on the map designating the geographical location of the network vulnerability point; and

graphically distinguishing the network vulnerability symbol on the map to indicate the status of the mitigation response.

70. The method of claim 69, wherein the network vulnerability information includes an Internet Protocol (IP) address associated with the identified network vulnerability point;

71. The method of claim 69, wherein the network address includes at least one of a media access control (MAC) address or a router address associated with the identified network vulnerability point.

72. The method of claim 69, wherein:

determining a network address includes looking up the network address in a network address database using the received vulnerability information; and

determining a geographical location includes looking up the geographical location in a geographical location database using the determined network address.

73. The method of claim 69, further including storing, in a map database, a vulnerability record for the identified network vulnerability point, the vulnerability record including the vulnerability information, the network address, the geographical location information, and the mitigation response status information associated with the identified network vulnerability point.

74. The method of claim 69, wherein the status of the mitigation response includes new, open, assigned to a mitigation response team, or closed.

75. The method of claim 69, further including:

receiving new mitigation response status information indicating a new status of the mitigation response; and

updating the network vulnerability symbol on the map to indicate the new status of the mitigation response.

76. A non-transitory computer-readable storage medium storing instructions which, when executed by a computer, cause the computer to perform a method for displaying a vulnerability of a network having one or more network points, the method comprising:

receiving network vulnerability information identifying a point of vulnerability in the network;

determining a network address of the identified network vulnerability point based on the received network vulnerability information;

determining a geographical location of the identified network vulnerability point based on the determined network address of the identified network vulnerability point;

receiving mitigation response status information indicative of a status of a mitigation response to the identified network vulnerability point;

providing a geographical map including at least the geographical location of the identified network vulnerability point;

providing a network vulnerability symbol on the map designating the geographical location of the network vulnerability point; and

graphically distinguishing the network vulnerability symbol on the map to indicate the status of the mitigation response.

77. The computer-readable storage medium of claim 76, wherein the network vulnerability information includes an Internet Protocol (IP) address associated with the identified network vulnerability point;

78. The computer-readable storage medium of claim 76, wherein the network address includes at least one of a media access control (MAC) address or a router address associated with the identified network vulnerability point.

79. The computer-readable storage medium of claim 76, wherein the method further includes:

determining a network address includes looking up the network address in a network address database using the received vulnerability information; and

determining a geographical location includes looking up the geographical location in a geographical location database using the determined network address.

80. The computer-readable storage medium of claim 76, wherein the method further includes storing, in a map database, a vulnerability record for the identified network vulnerability point, the vulnerability record including the vulnerability information, the network address, the geographical location information, and the mitigation response status information associated with the identified network vulnerability point.

81. The computer-readable storage medium of claim 76, wherein the status of the mitigation response includes new, open, assigned to a mitigation response team, or closed.

82. The computer-readable storage medium of claim 76, wherein the method further includes:

receiving new mitigation response status information indicating a new status of the mitigation response; and

updating the network vulnerability symbol on the map to indicate the new status of the mitigation response.

83. A computer-implemented method for representing vulnerabilities of a network comprising a plurality of network points, the method comprising:

receiving, at a computer, network vulnerability information identifying a plurality of vulnerability points on the network;

determining network addresses of the identified network vulnerability points based on the received network vulnerability information;

determining geographical locations of the identified network vulnerability points based on the determined network addresses of the identified network vulnerability points;

receiving mitigation response status information indicative of statuses of mitigation responses to the identified network vulnerability points;

providing a geographical map including at least the geographical locations of the identified network vulnerability points;

providing network vulnerability symbols on the map designating the geographical location of the network vulnerability points; and

graphically distinguishing the network vulnerability symbols on the map to indicate the respective statuses of the mitigation responses to the network vulnerability points.

84. The method of claim 83, wherein the network vulnerability information includes Internet Protocol (IP) addresses associated with the identified network vulnerability points;

85. The method of claim 83, wherein the network addresses include at least one of media access control (MAC) addresses or a router addresses associated with the identified network vulnerability points.

86. The method of claim 83, wherein:

determining network addresses includes looking up the network addresses in a network address database using the received vulnerability information; and

determining geographical locations includes looking up the geographical locations in a geographical location database using the determined network addresses.

87. The method of claim 83, further including storing, in a map database, vulnerability records for the identified network vulnerability points, the vulnerability records including the respective vulnerability information, network addresses, geographical location information, and mitigation response status information associated with the identified network vulnerability points.

88. The method of claim 83, wherein the status of the mitigation responses include new, open, assigned to a mitigation response team, or closed.

89. The method of claim 83, further including:

receiving new mitigation response status information indicating a new statuses of the mitigation responses; and

updating the network vulnerability symbols on the map to indicate the new statuses of the mitigation responses.