Geographical intrusion response prioritization mapping through authentication and flight data correlation

• US 9,591,004 B2
• Filed: 10/28/2013
• Issued: 03/07/2017
• Est. Priority Date: 08/12/2004
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: McConnell, James T., Tucker, Steven
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US14/065,333
• Publication Number:
  US 20160226891A1
• Time in Patent Office: 1,226 Days
• Field of Search: 726 22- 25, 713/188, 709223-225, 380/258, 380/270
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G08G 5/0008 with other aircraft
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Preferred systems and methods for geographically mapping intrusions through network or authentication data and flight data correlation are described. In one aspect, methods and systems include receiving threat data, receiving network or authentication data, receiving flight location data, correlating the threat data and the network or authentication data with the flight location data to generate map data, and generating a map displaying a geographical location of the intrusion based on the map data.

Claims

1. A method for displaying data associated with a cyber-attack threat against an airline, comprising:

receiving threat data associated with a network point of an airline, wherein the threat data relates to at least one of a vulnerability or an intrusion;

retrieving flight identification data from a flight information database in response to receiving the threat data, wherein the flight identification data comprises an Internet Protocol (IP) address of the network point;

retrieving flight location data from a flight location database using the flight identification data;

correlating the threat data, the flight identification data, and the flight location data to generate a record using a processor, wherein the threat data comprises a source IP address and a destination IP address, and wherein correlating comprises associating the IP address of the flight identification data with at least one of the source IP address of the threat data and the destination IP address of the threat data; and

outputting a graphical representation reflecting the record.

2. The method of claim 1, wherein outputting the graphical representation comprises graphically distinguishing the record based on a current status of a mitigation response to the threat.

3. The method of claim 1, wherein the threat data further comprises an attack event name.

4. The method of claim 3, wherein the record comprises the attack event name, the destination IP address, and the flight location data.

5. The method of claim 1, wherein the flight identification data further comprises at least one of authentication information of a user and aircraft information.

6. The method of claim 1, wherein the flight location data comprises aircraft information and a current aircraft location.

7. A method for displaying data associated with a cyber-attack threat against an airline, comprising:

receiving threat data associated with a network point of an airline network, wherein the threat data relates to at least one of a vulnerability or an intrusion;

identifying an Internet Protocol (IP) address associated with the network point;

retrieving a router address corresponding to the network point from an Address Routing Protocol KARP) database using the IP address associated with the network point;

retrieving a geographical location for the network point from a network location database using the router address;

correlating the threat data and the geographical location to generate a map database record using a processor, wherein the threat data comprises a source IP address and a destination IP address, and wherein correlating comprises associating the geographical location with at least one of the source IP address of the threat data and the destination IP address of the threat data; and

outputting the map database record.

8. The method of claim 7, further comprising indicating in the map database record when the at least one of a vulnerability or an intrusion is new.

9. The method of claim 7, wherein outputting the map database record comprises graphically distinguishing the map database record based on a current status of a mitigation response to the threat.

10. The method of claim 9, further comprising updating the map database record based on a change in the current status of the mitigation response to the threat.

11. The method of claim 7, wherein the threat data further comprises an attack event name.

12. The method of claim 7, wherein the network location database resides in a router on the airline network.

13. A method for displaying data associated with a cyber-attack threat against an airline network, comprising:

receiving vulnerability information identifying a network vulnerability at a network vulnerability point;

identifying, based on the vulnerability information, an Internet Protocol (IP) address associated with the network vulnerability point;

retrieving, from an Address Routing Protocol (ARP) database using the IP address associated with the network vulnerability point, an address corresponding to the network vulnerability point using a processor, wherein the ARP database resides in a router on the network;

retrieving, from a network location database using the address corresponding to the network vulnerability point, geographical location information associated with the network vulnerability point;

storing a vulnerability record for the network vulnerability point reflecting a current status of a mitigation response to the network vulnerability; and

outputting a graphical representation reflecting the vulnerability record.

14. The method of claim 13, wherein the network vulnerability comprises a plurality of vulnerabilities corresponding to different computers on the airline network.

15. The method of claim 13, further comprising adjusting the graphical representation based on a quantity of identified network vulnerability points in a geographical area.

16. The method of claim 13, further comprising updating the current status of the mitigation response to the network vulnerability indicated by the vulnerability record.

17. The method of claim 16, further comprising adjusting the graphical representation to reflect a change of the current status of the mitigation response to the network vulnerability.

18. The method of claim 13, further comprising indicating in the vulnerability record when the network vulnerability is new.