NETWORK ANALYSIS

• US 20110307936A1
• Filed: 06/10/2011
• Published: 12/15/2011
• Est. Priority Date: 12/17/2008
• Status: Abandoned Application

• Current Assignee: ABB Research Ltd. (ABB Ltd.)
• Original Assignee: ABB Research Ltd. (ABB Ltd.)
• Inventors: Braendle, Markus, Schierholz, Ragnar, Hadeli, Hadeli, Tuduce, Cristian
• Application Number:
  US13/158,031
• Publication Number:
  US 20110307936A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: Y04S 40/00 Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method and system are provided for analyzing a network. The method and system convert network specification information into a single intermediate representation of the network. The intermediate representation can then be used to determine security parameters as well as expected data traffic parameters.

Claims

1. A method of analyzing a network, comprising the steps of:

receiving description data which includes specification information concerning a specification of a network;

automatically determining, in a parser, model data by extracting explicit and implicit data from the description data, the explicit data being explicitly contained in the description data, and the implicit data being derived from the explicit data and predetermined rules and conditions; and

building a representation of the network using such model data.

2. A method as claimed in claim 1, further comprising

automatically determining a plurality of security parameters from the representation of the network;

and

configuring security measures using the determined security parameters.

4. A method as claimed in claim 2, wherein the security parameters include parameters for a firewall, and

wherein the method comprises configuring a firewall to prevent unauthorized access in dependence upon the security parameters.

5. A method as claimed in claim 2, wherein the security parameters include parameters for intrusion detection, and

wherein the method comprises configuring an intrusion detection unit in dependence upon the security parameters.

6. A method as claimed in claim 2, wherein the security parameters include parameters for expected data traffic, and

wherein the method comprises automatically monitoring data traffic, and signaling a lack of expected data traffic in dependence upon the security parameters.

7. A method as claimed in claim 1, wherein the model data include information concerning at least one of expected data traffic, inter-node communication patterns, and device security information.

8. A method as claimed in claim 1, wherein the description data represent design information for the network.

9. A method as claimed in claim 1, wherein the specification information includes information regarding at least one of network node information, node interconnection information, installed software information, and device configuration information.

16. A method as claimed in claim 4, wherein the security parameters include parameters for intrusion detection, and

wherein the method comprises configuring an intrusion detection unit in dependence upon the security parameters.

17. A method as claimed in claim 16, wherein the security parameters include parameters for expected data traffic, and

wherein the method comprises automatically monitoring data traffic, and signaling a lack of expected data traffic in dependence upon the security parameters.

18. A method as claimed in claim 17, wherein the model data include information concerning at least one of expected data traffic, inter-node communication patterns, and device security information.

19. A method as claimed in claim 17, wherein the description data represent design information for the network.

20. A method as claimed in claim 17, wherein the specification information includes information regarding at least one of network node information, node interconnection information, installed software information, and device configuration information.

3. A method of analyzing a network, comprising the steps of:

receiving description data which includes specification information concerning a specification of a network;

automatically determining, in a configuration generator, a plurality of security parameters from a representation of the network based on the received description data; and

configuring, in the configuration generator, security measures using the determined security parameters,

wherein the automatically determining of the plurality of security parameters includes automatically determining model data by extracting explicit and implicit data from the description data, the explicit data being explicitly contained in the description data and the implicit data being derived from the explicit data and predetermined rules and conditions, and building a representation of the network using the determined model data.

21. The method as claimed in claim 3, wherein the automatically determining of the model data, and the building of the representation of the network is performed in a parser.

22. A method as claimed in claim 3, wherein the security parameters include parameters for a firewall, and

wherein the method comprises configuring a firewall to prevent unauthorized access in dependence upon the security parameters.

23. A method as claimed in claim 22, wherein the security parameters include parameters for intrusion detection, and

wherein the method comprises configuring an intrusion detection unit in dependence upon the security parameters.

24. A method as claimed in claim 23, wherein the security parameters include parameters for expected data traffic, and

wherein the method comprises automatically monitoring data traffic, and signaling a lack of expected data traffic in dependence upon the security parameters.

25. A method as claimed in claim 3, wherein the security parameters include parameters for intrusion detection, and

wherein the method comprises configuring an intrusion detection unit in dependence upon the security parameters.

26. A method as claimed in claim 3, wherein the security parameters include parameters for expected data traffic, and

wherein the method comprises automatically monitoring data traffic, and signaling a lack of expected data traffic in dependence upon the security parameters.

27. A method as claimed in claim 3, wherein the model data include information concerning at least one of expected data traffic, inter-node communication patterns, and device security information.

28. A method as claimed in claim 3, wherein the description data represent design information for the network.

29. A method as claimed in claim 3, wherein the specification information includes information regarding at least one of network node information, node interconnection information, installed software information, and device configuration information.

10. A system for analyzing a network, comprising:

a parser connected to receive description data which includes specification information concerning a specification of a network,

wherein the parser is configured for automatically determining model data by extracting explicit and implicit data from the received description data, the explicit data being explicitly contained in the description data, and the implicit data being derived from the explicit data and predetermined rules and conditions, and the parser being configured for building representation data of the network using the determined model data.

11. A system as claimed in claim 10, further comprising:

a configuration generator connected for receiving representation data from the parser, and automatically determining a plurality of security parameters from the received representation data for transmission to a security unit.

12. A system as claimed in claim 11, further comprising a security unit connected to receive security parameters from the configuration generator, and configured for executing at least one security measure using the received security parameters.

14. A system as claimed in claim 10, wherein the security parameters include parameters for a firewall, and the security unit is configured for executing a firewall to prevent unauthorized network access in dependence upon the security parameters.

15. A system as claimed in claim 10, wherein the security parameters include parameters for expected data traffic, and the security unit configured for automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters.

30. A system as claimed in claim 12, wherein the security parameters include parameters for a firewall, and the security unit is configured for executing a firewall to prevent unauthorized network access in dependence upon the security parameters.

31. A system as claimed in claim 30, wherein the security parameters include parameters for expected data traffic, and the security unit configured for automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters.

13. A system for analyzing a network, comprising:

a security unit configured for receiving security parameters and configuring at least one security measure using the received security parameters;

a configuration generator connected to receive representation data, the configuration generator being configured for generating the security parameters and automatically determining a plurality of security parameters from the received representation data for transmission to the security unit; and

a parser connected to receive description data which includes specification information concerning a specification of a network, the parser being configured for generating the representation data and automatically determining model data by extracting explicit and implicit data from received description data, the explicit data being explicitly contained in the description data, and the implicit data being derived from the explicit data and predetermined rules and conditions, and the parser being configured for building representation data of the network using the determined model data.

32. A system as claimed in claim 13, wherein the security parameters include parameters for a firewall, and the security unit is configured for executing a firewall to prevent unauthorized network access in dependence upon the security parameters.

33. A system as claimed in claim 32, wherein the security parameters include parameters for expected data traffic, and the security unit configured for automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters.

34. A system as claimed in claim 13, wherein the security parameters include parameters for expected data traffic, and the security unit configured for automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters.