Method and system for protective distribution system (PDS) and infrastructure protection and management

• US 9,455,999 B2
• Filed: 09/10/2015
• Issued: 09/27/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Cybersecure Ips, LLC
• Original Assignee: Scott Rye, Stephen Sohn
• Inventors: Sohn, Stephen, Rye, Scott
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Wilcox, James J
• Application Number:
  US14/849,746
• Publication Number:
  US 20150381640A1
• Time in Patent Office: 383 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method and system for managing a protective distribution system is disclosed. In some embodiments, an information transmission line may be monitored. A disturbance on the information transmission line may be detected. The detected disturbance may not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances. Responsive to the detection, a count for the number of disturbances within a preset time period that do not exceed the first preset threshold may be determined. A determination of whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold may be effectuated. The second preset threshold may correspond to a preset number of allowable disturbances within the preset time period. An alert of the first alert type may be triggered responsive to a determination that the count exceeds the second preset threshold.

Claims

1. A method for managing a protective distribution system, comprising:

monitoring a fiber optic information transmission line;

detecting, via one or more sensors, a disturbance on the fiber optic information transmission line, wherein the detected disturbance does not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances, and wherein the one or more sensors comprise at least one of a vibration sensor, a frequency sensor, an acoustic sensor, and reflective sensor;

determining, responsive to the detection via the one or more sensors, a count for the number of disturbances within a preset time period that do not exceed the first preset threshold;

determining whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold for triggering alerts of the first alert type, wherein the second preset threshold corresponds to a preset number of allowable disturbances, not exceeding the first preset threshold and within the preset time period, before one or more alerts of the first alert type are to be triggered; and

triggering an alert of the first alert type responsive to a determination that the count exceeds the second preset threshold.

2. The method of claim 1, wherein (1) the detected disturbance is of a first disturbance type, (2) the first preset threshold is a threshold for triggering alerts of the first alert type based on detected disturbances of the first disturbance type, and (3) the second preset threshold corresponds to a preset number of allowable disturbances of the first disturbance type within the preset time period.

3. The method of claim 2, wherein the detected disturbance of the first disturbance type comprises at least one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading, and a disturbance of a second disturbance type comprises at least a different one of a vibration, a frequency change, an acoustic change, and a change in distance based on reflectometer reading.

4. The method of claim 1, wherein the detected disturbance comprises a vibration-related disturbance, and wherein the first preset threshold is a threshold for triggering alerts based on detected vibration-related disturbances.

5. The method of claim 1, wherein the detected disturbance comprises a frequency-change-related disturbance, and wherein the first preset threshold is a threshold for triggering alerts based on detected frequency-change-related disturbances.

6. The method of claim 1, wherein the detected disturbance comprises an acoustic-change-related disturbance, and wherein the first preset threshold is a threshold for triggering alerts based on detected acoustic-change-related disturbances.

7. The method of claim 1, wherein the detected disturbance comprises a disturbance related to a change in signal propagation distance, and wherein the first preset threshold is a threshold for triggering alerts based on detected disturbances related to a change in signal propagation distance.

8. The method of claim 1, further comprising:

initiating a response to the detected disturbance responsive to the triggering of the alert of the first alert type, wherein the response comprises at least one of opening a case, dispatching an investigator to investigate the detected disturbance, and documenting the investigation in the case.

9. The method of claim 1, further comprising:

initiating a response to the detected disturbance responsive to the triggering of the alert of the first alert type, wherein the response comprises at least one of disabling a data collection, adjusting a physical security device, rerouting a data collection, and performing network analysis.

10. The method of claim 1, further comprising:

causing the detected disturbance to be presented in comparison to the first preset threshold in real-time responsive to the detection of the disturbance.

11. The method of claim 1, wherein the count is for the number of disturbances within the preset time period that do not exceed the first preset threshold, but exceeds a third preset threshold.

12. A system for managing a protective distribution system, comprising:

a computer system comprises one or more processors programmed to execute computer program instructions which, when executed, cause the computer system to;

monitor a fiber optic information transmission line;

detect, via one or more sensors, a disturbance on the fiber optic information transmission line, wherein the detected disturbance does not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances, and wherein the one or more sensors comprise at least one of a vibration sensor, a frequency sensor, an acoustic sensor, and reflective sensor;

determine, responsive to the detection via the one or more sensors, a count for the number of disturbances within a preset time period that do not exceed the first preset threshold;

determine whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold for triggering alerts of the first alert type, wherein the second preset threshold corresponds to a preset number of allowable disturbances, not exceeding the first preset threshold and within the preset time period, before one or more alerts of the first alert type are to be triggered; and

trigger an alert of the first alert type responsive to a determination that the count exceeds the second preset threshold.

13. The system of claim 12, further comprising:

an intrusion detector coupled to the computer system,

the disturbance is detected by the computer system via the intrusion detector.

14. The system of claim 13, further comprising:

an optical line terminal or network switch;

an optical circuit switch;

an optical test access point device;

a network analytic tool; and

a video camera.

15. The system of claim 12, wherein (1) the detected disturbance is of a first disturbance type, (2) the first preset threshold is a threshold for triggering alerts of the first alert type based on detected disturbances of the first disturbance type, and (3) the second preset threshold corresponds to a preset number of allowable disturbances of the first disturbance type within the preset time period.

16. The system of claim 15, wherein the detected disturbance of the first disturbance type comprises at least one of a vibration, a frequency change, an acoustic change, and a change in signal propagation distance, and a disturbance of a second disturbance type comprises at least a different one of a vibration, a frequency change, an acoustic change, and a change in signal propagation distance.

17. The system of claim 12, wherein the computer system is further caused to:

initiating a response to the detected disturbance responsive to the triggering of the alert of the first alert type, wherein the response comprises at least one of opening a case, dispatching an investigator to investigate the detected disturbance, documenting the investigation in the case, disabling a data collection, adjusting a physical security device, rerouting a data collection, and performing network analysis.

18. The system of claim 12, wherein the computer system is further caused to:

causing the detected disturbance to be presented in comparison to the first preset threshold in real-time responsive to the detection of the disturbance.

19. The system of claim 12, wherein the count is for the number of disturbances within the preset time period that do not exceed the first preset threshold, but exceeds a third preset threshold.

20. A non-transitory computer-readable medium for storing computer instructions therein, the computer-readable medium comprising a set of instructions which when executed causes a processor to perform a method for managing a protective distribution system, the method comprising:

monitoring a fiber optic information transmission line;

detecting, via one or more sensors, a disturbance on the fiber optic information transmission line, wherein the detected disturbance does not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances, and wherein the one or more sensors comprise at least one of a vibration sensor, a frequency sensor, an acoustic sensor, and reflective sensor;

determining, responsive to the detection via the one or more sensors, a count for the number of disturbances within a preset time period that do not exceed the first preset threshold;

determining whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold for triggering alerts of the first alert type, wherein the second preset threshold corresponds to a preset number of allowable disturbances, not exceeding the first preset threshold and within the preset time period, before one or more alerts of the first alert type are to be triggered; and

triggering an alert of the first alert type responsive to a determination that the count exceeds the second preset threshold.