Geographical vulnerability mitigation response mapping system

• US 8,082,506 B1
• Filed: 08/12/2004
• Issued: 12/20/2011
• Est. Priority Date: 11/20/1985
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: McConnell, James Trent
• Primary Examiner(s): Bashore, William
• Assistant Examiner(s): PHANTANA ANGKOOL, DAVID
• Application Number:
  US10/916,872
• Time in Patent Office: 2,686 Days
• Field of Search: 715/736, 715/734, 715/763, 709/223
• US Class Current: 715/736
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and methods for geographically mapping a vulnerability of a network having one or more network points include receiving vulnerability information identifying a vulnerability of a point of the network, correlating the vulnerability information with location information for the identified network point, and network identification information for the identified network point, and generating a map displaying a geographical location of the vulnerability.

Claims

1. A method for displaying a vulnerability of a network comprising one or more network points, the method comprising:

receiving vulnerability information identifying a point of the network as containing a vulnerability, the network vulnerability point comprising a computing device connected to the network and susceptible to unauthorized access;

identifying, based on the vulnerability information, an Internet Protocol (IP) address associated with the network vulnerability point;

retrieving, from an Address Routing Protocol (ARP) database using the IP address, a router address corresponding to the identified network vulnerability point;

retrieving, from a network location database using the retrieved router address, geographical location information associated with the identified network vulnerability point;

storing a vulnerability record for the identified network vulnerability point, the vulnerability record containing the IP address, the router address, the geographical location information, and a current status of a mitigation response to the vulnerability;

generating a geographical map displaying an area including at least the geographical location of the identified network vulnerability point;

displaying a network vulnerability symbol on the map designating the geographical location of the network vulnerability point; and

graphically distinguishing a characteristic of the displayed network vulnerability symbol based on the current status of the mitigation response to the vulnerability.

2. The method of claim 1, wherein the vulnerability comprises a plurality of vulnerabilities corresponding to different computers in the network.

3. The method of claim 1, wherein the ARP database resides in a router on the network.

4. The method of claim 1, wherein the network vulnerability symbol is a push-pin symbol.

5. The method of claim 1, further comprising graphically distinguishing a characteristic of the network vulnerability symbol based on a quantity of identified network vulnerability points in the area.

6. The method of claim 1, further comprising updating the current status of the mitigation response to the vulnerability indicated by the vulnerability record.

7. The method of claim 6, wherein:

the network vulnerability symbol comprises a push-pin symbol,

the characteristic of the network vulnerability symbol includes a color of the network vulnerability symbol, and

updating further comprises changing the color of the push-pin symbol based on the updated status of the mitigation response to the vulnerability.

8. The method of claim 1, further comprising modifying the characteristic of the network vulnerability symbol to reflect a change of the current status of the mitigation response to the vulnerability.

9. A computer-readable storage medium containing instructions, which, when executed, perform a method for displaying a vulnerability of a network comprising one or more network points, the method comprising:

receiving vulnerability information identifying a point of the network as containing a vulnerability, the network vulnerability point comprising a computing device connected to the network and susceptible to unauthorized access;

identifying, based on the vulnerability information, an Internet Protocol (IP) address associated with the network vulnerability point;

retrieving, from an Address Routing Protocol (ARP) database using the IP address, a router address corresponding to the identified network vulnerability point;

retrieving, from a network location database using the retrieved router address, geographical location information associated with the identified network vulnerability point using;

storing a vulnerability record for the identified network vulnerability point, the vulnerability record containing the IP address, the router address, the geographical location information, and a current status of a mitigation response to the vulnerability;

generating a geographical map displaying an area including at least the geographical location of the identified network vulnerability point;

displaying a network vulnerability symbol on the map designating the geographical location of the network vulnerability point; and

graphically distinguishing a characteristic of the displayed network vulnerability symbol based on the current status of the mitigation response to the vulnerability.

10. A computer-readable storage medium of claim 9, wherein the vulnerability comprises a plurality of vulnerabilities corresponding to different computers in the network.

11. A computer-readable storage medium of claim 9, wherein the ARP database resides in a router on the network.

12. A computer-readable storage medium of claim 9, wherein the network vulnerability symbol comprises a push-pin symbol.

13. A computer-readable storage medium of claim 9, further comprising graphically distinguishing a characteristic of the network vulnerability symbol based on a quantity of identified network vulnerability points in the area.

14. A computer-readable storage medium of claim 9, wherein the method further comprises updating the current status of the mitigation response to the vulnerability indicated by the vulnerability record.

15. A computer-readable storage medium of claim 14, wherein:

the network vulnerability symbol comprises a push-pin symbol,

the characteristic of the network vulnerability symbol includes a color of the network vulnerability symbol, and

updating comprises changing the color of the push-pin symbol based on the updated status of the mitigation response to the vulnerability.

16. A computer-readable storage medium of claim 9, wherein the method further includes modifying the characteristic of the network vulnerability symbol to reflect a change of the current status of the mitigation response to the vulnerability.

17. A system for geographically mapping a vulnerability of a network comprising a plurality of network points, the system comprising:

a network location database storing geographical location information about points on the network;

a map database storing map information;

an Address Routing Protocol (ARP) database storing network location information;

a computer configured to;

receive vulnerability information identifying a vulnerability of a point of the network, the network vulnerability point comprising a computing device connected to the network and susceptible to unauthorized access;

identify, based on the vulnerability information, an Internet Protocol (IP) address associated with the network vulnerability point;

retrieve, from the ARP database using the IP address, a router address associated with the identified network vulnerability point;

retrieve, from the network location database using the retrieved router address, geographical location information associated with the identified network vulnerability point;

generate a vulnerability record for the identified network vulnerability point, the vulnerability record containing the IP address, the router address, the geographical location information, and a current status of a mitigation response to the vulnerability;

generate a geographical map displaying an area including at least the geographical location of the identified network vulnerability point;

display a network vulnerability symbol on the map designating the geographical location of the identified network vulnerability point; and

graphically distinguishing a characteristic of the displayed network vulnerability symbol on the map based on the current status of the mitigation response to the vulnerability; and

a display device in electronic communication with the computer for displaying the generated map.

18. The system of claim 17, wherein the vulnerability comprises a plurality of vulnerabilities corresponding to different computers in the network.

19. The system of claim 17, wherein the system further comprises a vulnerability database storing information identifying vulnerabilities in the network.

20. The system of claim 19, wherein the computer is further configured to retrieve the vulnerability information from the vulnerability database and store the retrieved information in the map database.

21. The system of claim 17, wherein the computer is further configured to store the retrieved router address in the map database.

22. The system of claim 17, wherein the ARP database resides in a router on the network.

23. The system of claim 17, wherein the computer is further configured to modify the characteristic of the network vulnerability symbol based on a change of the current status of the mitigation response to the vulnerability.

24. The system of claim 23, wherein:

the network vulnerability symbol comprises a push-pin symbol,

the characteristic of the network vulnerability symbol includes a color of the network vulnerability symbol, and

the computer is further configured to change the color of the push-pin symbol based on the change in the current status of the mitigation response to the vulnerability.

25. The system of claim 17, wherein the network vulnerability symbol comprises a push-pin symbol, and a color of the push-pin symbol indicates the current status of the mitigation response to the vulnerability.

26. A method for displaying a vulnerability of a network comprising one or more network points, the method comprising:

receiving vulnerability information identifying a point of the network as containing a vulnerability, the network vulnerability point comprising a computing device connected to the network and susceptible to unauthorized access;

identifying, based on the vulnerability information, an Internet Protocol (IP) address associated with the network vulnerability point;

retrieving, from an Address Routing Protocol (ARP) database using the IP address, a router address corresponding to the identified network vulnerability point;

retrieving, from a network location database using the retrieved router address, geographical location information associated with the identified network vulnerability point;

receiving status information regarding a mitigation response to the vulnerability, the status information indicating whether the vulnerability is pending or closed;

generating a geographical map displaying an area including at least the geographical location of the identified network vulnerability point;

displaying a network vulnerability symbol on the map designating the geographical location of the network vulnerability point;

visually distinguishing the displayed network vulnerability symbol based on the status information, including;

visually distinguishing the displayed network vulnerability in a first manner when the status information indicates vulnerability is pending; and

visually distinguishing the displayed network vulnerability symbol in a second manner, distinct from the first manner, when the status information indicates the vulnerability is closed.

27. The method of claim 26, wherein the status information further indicates whether the vulnerability is new, and the method further includes visually distinguishing the displayed network vulnerability symbol in a third manner, distinct from the first and second manners, when the status information indicates the vulnerability is new.