METHODS AND SYSTEMS FOR PRIORITIZING NETWORK ASSETS

• US 20110302291A1
• Filed: 06/02/2010
• Published: 12/08/2011
• Est. Priority Date: 06/02/2010
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: DRAUGELIS, Michael
• Granted Patent: US 8,533,319 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods and systems for restoring networks to normal behavior are disclosed. For example, in various embodiments an apparatus for addressing device abnormalities in a network may include node monitoring circuitry configured to monitor device abnormalities in the network, and ranking circuitry that may receive information from the node monitoring device and, upon receiving information from the monitoring circuitry that multiple devices in the network are compromised, may provide ranking information as to which of the multiple compromised devices in the network is to be attended to first.

Claims

1. An apparatus for addressing device abnormalities in a network, comprising:

monitoring circuitry configured to monitor device abnormalities in the network; and

ranking circuitry that receives information from the monitoring circuitry and, upon receiving information from the monitoring circuitry that multiple devices in the network are compromised, provides ranking information as to which of the multiple compromised devices in the network is to be attended to first.

2. The apparatus of claim 1, wherein the ranking circuitry uses a weighted Hyperlink Induced Topic Search (HITS) algorithm to produce a hub-ranking set containing hub scores representing relative values of connections between devices in the network.

3. The apparatus of claim 2, wherein the ranking circuitry provides ranking information also based upon a type of failure of at least one compromised device in the network.

4. The apparatus of claim 3, wherein the ranking circuitry uses the weighted HITS algorithm to also produce an authority-ranking set containing authority scores representing relative values of individual devices in the network.

5. The apparatus of claim 4, wherein the ranking circuitry provides ranking information also based upon a type of attack upon at least one compromised device in the network.

6. The apparatus of claim 1, wherein the ranking circuitry uses a weighted Hyperlink Induced Topic Search (HITS) algorithm to produce an authority-ranking set containing authority scores representing relative values of individual devices in the network.

7. The apparatus of claim 6, wherein the ranking circuitry provides ranking information also based upon a type of attack upon at least one compromised device in the network.

8. The apparatus of claim 1, wherein the ranking circuitry uses a weighted Hyperlink Induced Topic Search (HITS) algorithm to produce an hub-ranking set containing hub scores representing relative values of connections between devices in the network and an authority-ranking set containing authority scores representing relative values of individual devices in the network;

and

wherein the weighted HITS algorithm uses human-subjective values on the importance of at least one of a mission of each device used in the network and a mission of each data type used in the network.

9. The apparatus of claim 8, wherein the weighted HITS algorithm uses human-subjective values on a mission of each device used in the network and a mission of each data type used in the network.

10. The apparatus of claim 8, wherein the weighted HITS algorithm uses objective criteria including at least an amount of data transferred between at least two devices in the network.

11. A method for addressing device abnormalities in a network, comprising:

monitoring device abnormalities in the network to produce monitoring information; and

when the monitoring information indicates that that multiple devices in the network are compromised, providing ranking information as to which of the multiple compromised devices in the network is to be attended to first.

12. The method of claim 11, wherein the ranking information is provided using a weighted Hyperlink Induced Topic Search (HITS) algorithm and a hub-ranking set containing hub scores representing relative values of connections between devices in the network.

13. The method of claim 12, wherein the ranking information is produced based upon a type of failure of at least one compromised device in the network.

14. The method of claim 11, wherein the ranking information is provided using a weighted Hyperlink Induced Topic Search (HITS) algorithm and an authority-ranking set containing authority scores representing relative values of individual devices in the network.

15. The method of claim 14, wherein the ranking information is produced based upon a type of attack upon at least one compromised device in the network.

16. The method of claim 11, wherein the ranking information is provided using a weighted Hyperlink Induced Topic Search (HITS) algorithm, an authority-ranking set containing hub scores representing relative values of connections between devices in the network, and an authority-ranking set containing authority scores representing relative values of individual devices in the network.

17. The method of claim 16, wherein the weighted HITS algorithm uses human-subjective values on the importance of at least one of a mission of each device used in the network and a mission of each data type used in the network.

18. The method of claim 17, wherein the weighted HITS algorithm uses human-subjective values on a mission of each device used in the network and a mission of each data type used in the network.

19. The method of claim 18, wherein the weighted HITS algorithm uses objective criteria including at least an amount of data transferred between at least two devices in the network.

20. An apparatus for addressing device abnormalities in a network, comprising:

monitoring means for monitoring device abnormalities in the network; and

ranking means for receiving information from the monitoring means and, upon receiving information from the monitoring means that multiple devices in the network are compromised, providing ranking information as to which of the multiple compromised devices in the network is to be attended to first;

wherein the ranking means is configured to provide ranking information using a hub-ranking set containing hub scores representing relative values of connections between devices in the network and an authority-ranking set containing authority scores representing relative values of individual devices in the network, wherein both the hub-ranking set and the authority-ranking set are derived using a weighted Hyperlink Induced Topic Search (HITS) algorithm; and

wherein the ranking means is also configured to produce ranking information based upon at least one of information relating to a type of failure of at least one compromised device in the network and a type of attack upon at least one compromised device in the network.