CYBERSECURITY SYSTEM WITH DIFFERENTIATED CAPACITY TO DEAL WITH COMPLEX CYBER ATTACKS

• US 20170099308A1
• Filed: 10/01/2015
• Published: 04/06/2017
• Est. Priority Date: 10/01/2015
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Mead, Jadranka, Vasatka, James E., Craig, John A.
• Granted Patent: US 10,148,678 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An improved cyber security protection system with differentiated capacity to deal with complex cyber attacks in complex, highly-connected industries. The system architecture is goal-oriented and separates security goals and concerns by layers that are assigned specific functions to address only those goals. The functions operate concurrently within the layers and provide insight on their respective layers. The layers are interconnected with connection modules using bi-directional interfacing to establish a feedback look within the entire system. Complex adaptive systems (CAS) algorithms are used to identify the probably threats to the system.

Claims

1. A cyber security system comprising:

a sublayer that monitors and tracks cybersecurity data for forensic analysis;

an overlayer that monitors, tracks, and measures cybersecurity data across a plurality of cyber environments;

a CAS algorithm that is used to learn, predict, and take action based on the cybersecurity data;

wherein the overlayer and the sublayer exchange cybersecurity data.

2. The cyber security system of claim 1 wherein each of the sublayer and overlayer further comprise functions that operate within the sublayer and overlayer.

3. The cyber security system of claim 1 wherein the sublayer and overlayer exchange the cybersecurity data via a bi-directional connection module and the exchanged cybersecurity data is correlated.

4. The cyber security system of claim 3 wherein the connection module facilitates a feedback loop throughout the system.

5. The cyber security system of claim 1 further comprising a complex adaptive system (CAS) algorithm that predicts cyber attacks and based on the cybersecurity data.

6. The cyber security system of claim 5 wherein the CAS algorithm is modified to:

create state machines representing the cyber security system;

run the state machines and record their transitions;

associate probabilities with the transitions;

predict outcomes based on the probabilities;

determine if action needs to be taken; and

take action if a level of probability is over predetermined threshold.