Method and system for protective distribution system (PDS) and infrastructure protection and management

• US 9,160,758 B2
• Filed: 03/17/2014
• Issued: 10/13/2015
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Cybersecure Ips, LLC
• Original Assignee: Scott Rye, Stephen Sohn
• Inventors: Sohn, Stephen, Rye, Scott
• Primary Examiner(s): Abrishamkar, Kaveh
• Assistant Examiner(s): Wilcox, James J
• Application Number:
  US14/217,259
• Publication Number:
  US 20140283074A1
• Time in Patent Office: 575 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method and system for managing a protective distribution system is disclosed. The method includes monitoring an information transmission line, detecting a disturbance on the information transmission line, displaying the disturbance as a graphical representation, comparing the disturbance to a preset threshold, and triggering an alert if the disturbance is greater than the preset threshold or the number of disturbances less than the preset threshold meets a preset number within a preset time period. A system for managing a protective distribution system is also provided. The system includes a set of instructions which when executed causes a processor to perform a method for managing an information transmission line. The system further includes an intrusion detector, an optical line terminal and/or network switch, an optical circuit switch, an optical test access point device, and a network analytic tool.

Claims

1. A method for managing a protective distribution system, comprising:

monitoring an information transmission line, wherein the information transmission line comprises a first segment and a second segment that are assigned to one segment group and one or more other segments that are assigned to another segment group, the first segment of the information transmission line does not include a trunk cable, and the second segment of the information transmission line includes a trunk cable;

detecting a disturbance on the first segment of the information transmission line, wherein the detected disturbance does not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances;

determining, responsive to the detection, a count for the number of disturbances within a first preset time period that do not exceed the first preset threshold;

determining whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold, wherein the second preset threshold corresponds to a preset number of allowable disturbances within the first preset time period;

triggering an alert of the first alert type responsive to a determination that the count exceeds the second preset threshold;

determining whether an alert of a second alert type with respect to the second segment has occurred within a second preset time period;

determining whether a mode associated with the first segment of the information transmission line indicates an issue with the second segment of the information transmission line; and

modifying the mode associated with the first segment of the information transmission line to indicate an issue with the second segment of the information transmission line responsive to a determination that the alert of the second alert type has occurred within the second preset time period and that the mode associated with the first segment of the information transmission line does not indicate an issue with the second segment of the information transmission line.

2. The method of claim 1, wherein:

(1) the detected disturbance is of a first disturbance type;

(2) the first preset threshold is a threshold for triggering alerts of the first alert type based on detected disturbances of the first disturbance type; and

(3) the second preset threshold corresponds to a preset number of allowable disturbances of the first disturbance type within the first preset time period.

3. The method of claim 2, wherein the detected disturbance of the first disturbance type comprises at least one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading, and a disturbance of a second disturbance type comprises at least a different one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading.

4. The method of claim 1, further comprising:

initiating a response to the detected disturbance based on the triggering of the alert of the first alert type, wherein the response comprises at least one of opening a case, dispatching an investigator to investigate the detected disturbance, and documenting the investigation in the case.

5. The method of claim 4, wherein the response further comprises at least one of disabling a data collection, adjusting a physical security device, rerouting a data collection, and performing network analysis.

6. The method of claim 1, wherein the count is for the number of disturbances within the first preset time period that do not exceed the first preset threshold, but exceeds a third preset threshold.

7. The method of claim 1, further comprising collecting data on the disturbance.

8. The method of claim 1, further comprising:

modifying modes associated with other segments of the information transmission line that are assigned to the same segment group as the first segment and the second segment responsive to the determination that the alert of the second alert type has occurred within the second preset time period and that the mode associated with the first segment does not indicate an issue with the second segment.

9. A non-transitory computer-readable medium for storing computer instructions therein, the computer-readable medium comprising a set of instructions which when executed causes a processor to perform a method for managing a protective distribution system, the method comprising:

monitoring an information transmission line, wherein the information transmission line comprises a first segment and a second segment that are assigned to one segment group and one or more other segments that are assigned to another segment group, the first segment of the information transmission line does not include a trunk cable, and the second segment of the information transmission line includes a trunk cable;

detecting a disturbance on the first segment of the information transmission line, wherein the detected disturbance does not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances;

determining, responsive to the detection, a count for the number of disturbances within a first preset time period that do not exceed the first preset threshold;

determining whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold, wherein the second preset threshold corresponds to a preset number of allowable disturbances within the first preset time period;

triggering an alert of the first alert type responsive to a determination that the count exceeds the second preset threshold;

determining whether an alert of a second alert type with respect to the second segment has occurred within a second preset time period;

determining whether a mode associated with the first segment of the information transmission line indicates an issue with the second segment of the information transmission line; and

modifying the mode associated with the first segment of the information transmission line to indicate an issue with the second segment of the information transmission line responsive to a determination that the alert of the second alert type has occurred within the second preset time period and that the mode associated with the first segment of the information transmission line does not indicate an issue with the second segment of the information transmission line.

10. The non-transitory computer-readable medium of claim 9, wherein:

(1) the detected disturbance is of a first disturbance type;

(2) the first preset threshold is a threshold for triggering alerts of the first alert type based on detected disturbances of the first disturbance type; and

(3) the second preset threshold corresponds to a preset number of allowable disturbances of the first disturbance type within the first preset time period.

11. The non-transitory computer-readable medium of claim 10, wherein the detected disturbance of the first disturbance type comprises at least one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading, and a disturbance of a second disturbance type comprises at least a different one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading.

12. The non-transitory computer-readable medium of claim 9, wherein the count is for the number of disturbances within the first preset time period that do not exceed the first preset threshold, but exceeds a third preset threshold.

13. A system for managing an information transmission line, comprising:

a computer system comprises one or more processors programmed to execute computer program instructions which, when executed, cause the computer system to;

monitor an information transmission line, wherein the information transmission line comprises a first segment and a second segment that are assigned to one segment group and one or more other segments that are assigned to another segment group, the first segment of the information transmission line does not include a trunk cable, and the second segment of the information transmission line includes a trunk cable;

detect a disturbance on the first segment of the information transmission line, wherein the detected disturbance does not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances;

determine, responsive to the detection, a count for the number of disturbances within a first preset time period that do not exceed the first preset threshold;

determine whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold, wherein the second preset threshold corresponds to a preset number of allowable disturbances within the first preset time period;

trigger an alert of the first alert type responsive to a determination that the count exceeds the second preset threshold;

determine whether an alert of a second alert type with respect to the second segment has occurred within a second preset time period;

determine whether a mode associated with the first segment of the information transmission line indicates an issue with the second segment of the information transmission line; and

modify the mode associated with the first segment of the information transmission line to indicate an issue with the second segment of the information transmission line responsive to a determination that the alert of the second alert type has occurred within the second preset time period and that the mode associated with the first segment of the information transmission line does not indicate an issue with the second segment of the information transmission line.

14. The system of claim 13, further comprising:

an intrusion detector coupled to the computer system,

wherein the disturbance is detected by the computer system via the intrusion detector.

15. The system of claim 14, further comprising:

an optical line terminal or network switch;

an optical circuit switch;

an optical test access point device;

a network analytic tool; and

a video camera.

16. The system of claim 13, wherein:

(1) the detected disturbance is of a first disturbance type;

(2) the first preset threshold is a threshold for triggering alerts of the first alert type based on detected disturbances of the first disturbance type; and

(3) the second preset threshold corresponds to a preset number of allowable disturbances of the first disturbance type within the first preset time period.

17. The system of claim 16, wherein the detected disturbance of the first disturbance type comprises at least one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading, and a disturbance of a second disturbance type comprises at least a different one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading.

18. The system of claim 13, wherein the count is for the number of disturbances within the first preset time period that do not exceed the first preset threshold, but exceeds a third preset threshold.