Methods and systems for prioritizing network assets

• US 8,533,319 B2
• Filed: 06/02/2010
• Issued: 09/10/2013
• Est. Priority Date: 06/02/2010
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Draugelis, Michael
• Primary Examiner(s): Nguyen, Thuong (Tina)
• Assistant Examiner(s): NAJEE-ULLAH, TARIQ S
• Application Number:
  US12/792,289
• Publication Number:
  US 20110302291A1
• Time in Patent Office: 1,196 Days
• Field of Search: 709/224, 726/25
• US Class Current: 709/224
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods and systems for restoring networks to normal behavior are disclosed. For example, in various embodiments an apparatus for addressing device abnormalities in a network may include node monitoring circuitry configured to monitor device abnormalities in the network, and ranking circuitry that may receive information from the node monitoring device and, upon receiving information from the monitoring circuitry that multiple devices in the network are compromised, may provide ranking information as to which of the multiple compromised devices in the network is to be attended to first.

Claims

1. An apparatus for addressing device abnormalities in a network, comprising:

monitoring circuitry configured to monitor device abnormalities in the network; and

ranking circuitry that receives information from the monitoring circuitry and, upon receiving information from the monitoring circuitry that multiple devices in the network are compromised, provides ranking information as to which of the multiple compromised devices in the network is to be attended to first,

the ranking circuitry uses at least a matrix representation of the network, the matrix representation including a plurality of entries, each entry representing presence or absence of link between at least two of the multiple devices, and at least two weighting vectors to calculate a rank of a device in the network as

2. The apparatus of claim 1, wherein the ranking circuitry uses the at least two weighting vectors to modify Hyperlink Induced Topic Search (HITS) algorithm to produce a hub-ranking set containing hub scores representing relative values of connections between devices in the network.

3. The apparatus of claim 2, wherein the ranking circuitry provides ranking information also based upon a type of failure of at least one compromised device in the network.

4. The apparatus of claim 3, wherein the ranking circuitry uses the modified HITS algorithm to also produce an authority-ranking set containing authority scores representing relative values of individual devices in the network.

5. The apparatus of claim 4, wherein the ranking circuitry provides ranking information also based upon a type of attack upon at least one compromised device in the network.

6. The apparatus of claim 1, wherein the ranking circuitry uses the at least two weighting vectors to modify Hyperlink Induced Topic Search (HITS) algorithm to produce an authority-ranking set containing authority scores representing relative values of individual devices in the network.

7. The apparatus of claim 6, wherein the ranking circuitry provides ranking information also based upon a type of attack upon at least one compromised device in the network.

8. The apparatus of claim 1, wherein the ranking circuitry uses the at least two weighting vectors to modify Hyperlink Induced Topic Search (HITS) algorithm to produce a hub-ranking set containing hub scores representing relative values of connections between devices in the network and an authority-ranking set containing authority scores representing relative values of individual devices in the network;

and

wherein the modified HITS algorithm uses human-subjective values on the importance of at least one of a mission of each device used in the network and a mission of each data type used in the network.

9. The apparatus of claim 8, wherein the modified HITS algorithm uses human-subjective values on a mission of each device used in the network and a mission of each data type used in the network.

10. The apparatus of claim 8, wherein the modified HITS algorithm uses objective criteria including at least an amount of data transferred between at least two devices in the network.

11. A method for addressing device abnormalities in a network, comprising:

monitoring device abnormalities in the network to produce monitoring information;

when the monitoring information indicates that that multiple devices in the network are compromised, providing ranking information as to which of the multiple compromised devices in the network is to be attended to first, wherein

the ranking information is provided using at least a matrix representation of the network, the matrix representation includes a plurality of entries, each entry representing presence or absence of link between at least two of the multiple devices and at least two weighting vectors;

calculating a rank of a device in the network as

12. The method of claim 11, wherein the ranking information is provided using the at least two weighting vectors to modify Hyperlink Induced Topic Search (HITS) algorithm to produce a hub-ranking set containing hub scores representing relative values of connections between devices in the network.

13. The method of claim 12, wherein the ranking information is produced based upon a type of failure of at least one compromised device in the network.

14. The method of claim 11, wherein the ranking information is provided using the at least two weighting vectors to modify Hyperlink Induced Topic Search (HITS) algorithm to produce an authority-ranking set containing authority scores representing relative values of individual devices in the network.

15. The method of claim 14, wherein the ranking information is produced based upon a type of attack upon at least one compromised device in the network.

16. The method of claim 11, wherein the ranking information is provided using the at least two weighting vectors to modify Hyperlink Induced Topic Search (HITS) algorithm to produce a hub-ranking set containing hub scores representing relative values of connections between devices in the network, and an authority-ranking set containing authority scores representing relative values of individual devices in the network.

17. The method of claim 16, wherein the modified HITS algorithm uses human-subjective values on the importance of at least one of a mission of each device used in the network and a mission of each data type used in the network.

18. The method of claim 17, wherein the modified HITS algorithm uses human-subjective values on a mission of each device used in the network and a mission of each data type used in the network.

19. The method of claim 18, wherein the modified HITS algorithm uses objective criteria including at least an amount of data transferred between at least two devices in the network.

20. An apparatus for addressing device abnormalities in a network, comprising:

monitoring means for monitoring device abnormalities in the network; and

ranking means for receiving information from the monitoring means and, upon receiving information from the monitoring means that multiple devices in the network are compromised, providing ranking information as to which of the multiple compromised devices in the network is to be attended to first, wherein;

the ranking means is configured to provide ranking information using a matrix representation of the network, the matrix representation includes a plurality of entries, each entry representing presence or absence of link between at least two of the multiple devices, and a hub-ranking set containing hub scores representing relative values of connections between devices in the network and an authority-ranking set containing authority scores representing relative values of individual devices in the network, wherein both the hub-ranking set and the authority-ranking set are derived using at least two weighting vectors and Hyperlink Induced Topic Search (HITS) algorithm; and

the ranking means is further configured to produce ranking information based upon at least one of information relating to a type of failure of at least one compromised device in the network and a type of attack upon at least one compromised device in the network and to calculate a rank of a device in the network as