Embedded model interaction within attack projection framework of information system

• US 8,433,768 B1
• Filed: 10/14/2004
• Issued: 04/30/2013
• Est. Priority Date: 10/14/2004
• Status: Expired due to Fees

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Bush, Stephen Francis, Kulkarni, Amit Bhavanishankar
• Primary Examiner(s): Li, Guang
• Application Number:
  US10/965,249
• Time in Patent Office: 3,120 Days
• Field of Search: 709/207, 709/246
• US Class Current: 709/207
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An information system includes a bulletin board-type interface that enables virtual messages propagating through the system, to interface with one another. The virtual messages are created by a virtual system embedded within the information system. The virtual messages may model any of various network services and predict traffic based on the network services. The virtual messages may represent an attack model on the network. Models of system resources are also created and the models interact by posting and/or retrieving information from the bulletin board-type interface. The interface provides for a negotiation process regarding the availability of future system resources and the impact upon the modeled network service.

Claims

1. An information interface in an information system that includes a virtual system embedded therein, said information interface comprising:

a computer executing instructions for;

defining a bulletin board interface configured to store information provided by virtual messages, the bulletin board interface allowing said virtual messages to post information to and retrieve information from, said bulletin board interface;

receiving at said bulletin board interface, first virtual messages generated by a first predictive system model of said virtual system and second virtual messages generated by a second predictive system model of said virtual system each of said first and second virtual messages carrying state information of said virtual system expected to exist in the future;

storing in said bulletin board interface, said state information provided by said first and second virtual messages; and

interacting said first virtual messages with said second virtual messages via said stored state information.

2. The information interface system as in claim 1, wherein said first predictive system model comprises a first network service model and said second predictive system model comprises a second network service model.

3. The information interface system as in claim 1, wherein said first predictive system model comprises a virtual system attack model and said second predictive system model comprises a model of components of said information system.

4. The information interface system as in claim 1, wherein said information includes at least one of bandwidth, cpu utilization, input/output buffer capacity, and memory.

5. The information interface system as in claim 1, wherein said virtual messages are time-stamped messages of future states and wherein said virtual messages are stored in time order.

6. The information interface system as in claim 1, wherein said interacting includes negotiating said second virtual messages with said first virtual messages.

7. The information interface system as in claim 1, wherein said interacting includes said first virtual messages posting information to said information interface and said second virtual messages reading said information from said information interface.

8. A method for operating an information system comprising:

providing, in a computer process, an information system with a virtual system and an information interface embedded therein, wherein said information interface defines a bulletin board interface configured to store information provided by virtual messages, the bulletin board interface allowing said virtual messages to post information to, and retrieve information from, said bulletin board interface;

causing, in a computer process, first and second predictive system models of said virtual system to respectively generate first virtual messages and second virtual messages, each of said first and second virtual messages carrying state information of said virtual system expected to exist in the future; and

in a computer process, said first virtual messages interfacing with said second virtual messages by way of said bulletin board interface.

9. The method as in claim 8, wherein said first virtual messages interfacing comprises said first virtual messages posting information to said information interface and said second virtual messages reading said information from said information interface.

10. The method as in claim 9, wherein at least one of said second virtual messages post further information to said information interface, and said first virtual messages read said further information from said information interface.

11. The method as in claim 8, wherein said first virtual messages interfacing includes storing information provided by at least one of said first virtual messages and said second virtual messages at said information interface.

12. The method as in claim 11, wherein said causing includes said first virtual messages being time-stamped and including information on future states at identified future times and said storing comprises storing in time order.

13. The method as in claim 11, wherein said information includes information on resources of said information system.

14. The method as in claim 13, wherein said resources comprise at least one of bandwidth, memory, cpu utilization, number of packets sent, buffer capacity, number of packets transmitted, and cpu cycles.

15. The method as in claim 11, wherein said first virtual messages are time-stamped and further comprising said second virtual messages querying about future states of said information system.

16. The method as in claim 15, further comprising negotiating after said querying.

17. The method as in claim 8, wherein said first virtual messages interfacing comprises said first virtual negotiating with said second virtual messages.

18. The method as in claim 17, wherein said negotiating comprises sending requests about information system resources and responding to said requests.

19. The method as in claim 8, wherein said negotiating further comprises sending amended requests responsive to said responding.

20. The method as in claim 8, wherein said first predictive system model comprises a system attack model and said second predictive system model comprises a model of normal operation of said information system.

21. The method as in claim 20, wherein said system attack model comprises one of a flood attack model and a denial-of-service attack model.

22. The method as in claim 8, wherein at least one of said first virtual messages and said second virtual messages carry code.

23. The method as in claim 8, wherein at least one of said first predictive system model and said second predictive system model comprises a model of a network service.