Geographical intrusion response prioritization mapping system

• US 8,091,130 B1
• Filed: 08/12/2004
• Issued: 01/03/2012
• Est. Priority Date: 11/20/1985
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: McConnell, James Trent
• Primary Examiner(s): Vu, Kimyen
• Assistant Examiner(s): Debnath, Suman
• Application Number:
  US10/916,873
• Time in Patent Office: 2,700 Days
• Field of Search: 726 22- 25, 709/223, 715/734, 715/763
• US Class Current: 726/23
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

Systems and methods for geographically mapping an intrusion into a network having one or more network points include receiving intrusion information identifying a intrusion into a point of the network, correlating the intrusion information with location information for the identified network point, and network identification information for the identified network point, and generating a map displaying a geographical location of the intrusion.

Claims

1. A method for displaying an intrusion into a network, the method comprising:

receiving network intrusion information indicating that a network intrusion has occurred, the network intrusion comprising an unauthorized access of a computing device connected to the network;

identifying an Internet Protocol (IP) address associated with the computing device and corresponding to a network intrusion point at which the network intrusion has occurred;

retrieving, from an Address Routing Protocol (ARP) database using the IP address, a router address corresponding to the network intrusion point;

retrieving, from a location database using the retrieved router address, geographical location information corresponding to the network intrusion point;

determining a geographical location of the network intrusion point based on the retrieved geographical location information;

generating a geographical map displaying an area including at least the geographical location of the network intrusion point; and

displaying a network intrusion symbol on the map to designate the geographical location of the network intrusion point.

2. The method of claim 1, wherein the network intrusion comprises a plurality of network intrusions corresponding to computers in the network.

3. The method of claim 2, wherein the plurality of network intrusions correspond to different computers in the network.

4. The method of claim 1, wherein the ARP database data originates in a router on the network.

5. The method of claim 1, wherein the network intrusion symbol is a push-pin symbol.

6. The method of claim 1, wherein the network intrusion symbol represents a quantity of intrusions.

7. The method of claim 1, wherein the method further comprises updating a status of a mitigation response to the network intrusion.

8. The method of claim 7, wherein the network intrusion symbol is a push pin symbol, and updating further comprises changing a color of the push pin symbol, the color indicative of the status of the mitigation response to the network intrusion.

9. The method of claim 1, wherein the method further comprises updating the map to reflect a change of status of a mitigation response to the network intrusion.

10. A non-transitory computer-readable storage medium containing instructions, which, when executed, perform a method for displaying an intrusion into a network, the method comprising:

receiving network intrusion information indicating that a network intrusion has occurred, the network intrusion comprising an unauthorized access of a computing device connected to the network;

identifying an Internet Protocol (IP) address associated with the computing device and corresponding to a network intrusion point at which the network intrusion has occurred;

retrieving from an Address Routing Protocol (ARP) database using the IP address, a router address corresponding to the network intrusion point;

retrieving from a location database using the retrieved router address, geographical location information corresponding to the network intrusion point;

determining a geographical location of the network intrusion point based on the retrieved geographical location information;

generating a geographical map displaying an area including at least the geographical location of the network intrusion point; and

displaying a network intrusion symbol on the map to designate the geographical location of the network intrusion point.

11. The non-transitory computer-readable storage medium of claim 10, wherein the network intrusion comprises a plurality of network intrusions corresponding to computers in the network.

12. The non-transitory computer-readable storage medium of claim 11, wherein the plurality of network intrusions correspond to different computers in the network.

13. The non-transitory computer-readable storage medium of claim 10 wherein the ARP database originates in a router on the network.

14. The non-transitory computer-readable storage medium of claim 10, wherein the network intrusion symbol in a push-pin.

15. The non-transitory computer-readable storage medium of claim 10, wherein the network intrusion symbol represents a quantity of intrusions.

16. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises updating a status of a mitigation response to the network intrusion.

17. The non-transitory computer-readable storage medium of claim 16, wherein the network intrusion symbol is a push pin symbol and updating further comprises changing a color of the push pin symbol, the color indicative of the status of the mitigation response to the network intrusion.

18. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises updating the map to reflect a change of status of a mitigation response to the network intrusion.

19. A system for geographically mapping an intrusion into a network, the system comprising:

a map database storing map information;

an Address Routing Protocol (ARP) database storing network location information;

a location database storing location information;

a computer in electronic communication with the map database and configured to;

receive network intrusion information indicating that a network intrusion has occurred, the network intrusion comprising an unauthorized access of a computing device connected to the network;

identify an Internet Protocol (IP) address associated with the computing device and corresponding to a network intrusion point at which the network intrusion has occurred;

retrieve, from the ARP database using the IP address, a router address corresponding to the network intrusion point;

retrieve, from the location database using the retrieved router address, geographical location information corresponding to the network intrusion point;

determine a geographical location of the network intrusion point based on the retrieved geographical location information;

generate a geographical map of an area including at least the determined geographical location of the network intrusion point;

displaying on the map a network intrusion symbol to designate the determined geographical location of the network intrusion point; and

a display device in electronic communication with the computer for displaying the generated map.

20. The system of claim 19, wherein the network intrusion comprises a plurality of network intrusions corresponding to computers in the network.

21. The system of claim 20, wherein the plurality of network intrusions correspond to different computers in the network.

22. The system of claim 19, wherein the computer is further configured to:

correlate the IP address and the router address; and

store the correlated IP address and router address in a network intrusion database.

23. The system of claim 19, wherein the ARP database originates in a router on the network.

24. The system of claim 19, further comprising a network intrusion database, wherein the computer is further configured to:

correlate the geographical location information with the IP address and the router address; and

store the correlated information in network intrusion database.

25. The system of claim 19, wherein the network intrusion symbol is a push pin symbol.

26. The system of claim 25, wherein the network intrusion symbol indicates a status of a mitigation response to the network intrusion.

27. The system of claim 26, wherein the computer is further configured to display a change of the status of the mitigation response to the network intrusion.

28. The system of claim 27, wherein the network intrusion symbol is a push-pin symbol, and the computer is configured to display a change in the status of the mitigation response to the network intrusion by changing a color of the push pin symbol on the map, the color indicative of the status of the mitigation response to the network intrusion.

29. The system of claim 19, wherein the network intrusion symbol indicates a status of a mitigation response to the network intrusion.

30. The system of claim 29, wherein the network intrusion symbol is a push pin, and a color of a push pin symbol indicates the status of the mitigation response to the network intrusion.

31. A system for geographically mapping an intrusion into a network, the system comprising:

map database means for storing map information;

Address Routing Protocol (ARP) database means for storing network location information;

location database means for storing geographical location information;

computing means, in electronic communication with the map database, for;

receiving network intrusion information indicating that a network intrusion has occurred, the network intrusion comprising an unauthorized access of a computing device connected to the network;

identifying an Internet Protocol (IP) address associated with the computing device and corresponding to a network intrusion point at which the network intrusion has occurred;

retrieving, from the ARP database using the IP address, a router address corresponding to the network intrusion point;

retrieving, from the location database using the retrieved router address, geographical location information corresponding to the network intrusion point;

determining a geographical location of the network intrusion point based on the retrieved geographical location information;

generating a geographical map of an area including at least the determined geographical location of the network intrusion point;

displaying on the map a network intrusion symbol to designate the determined geographical location of the network intrusion point; and

display means in electronic communication with the computer for displaying the generated map.

32. The system of claim 31, wherein the system further comprises network intrusion database means for storing network intrusion information.

33. The system of claim 32, wherein the computing means further comprises means for retrieving the network intrusion information from the network intrusion database and for storing the retrieved intrusion information in the map database.

34. The system of claim 31, further comprising an intrusion database, wherein the computing means further comprises means for storing the retrieved IP address and router address in the intrusion database.

35. The system of claim 31, wherein the ARP database means originates in a router on the network.

36. The system of claim 31, further comprising an intrusion database, wherein the computing means further comprises means storing the retrieved geographical location information in the intrusion database.

37. The system of claim 31, wherein the network intrusion symbol is a push pin symbol.

38. The system of claim 37, wherein the network intrusion symbol indicates a status of a mitigation response to the network intrusion.

39. The system of claim 38, wherein the computing means further comprises means for indicating a change of the status of the network intrusion on the map.

40. The system of claim 39, wherein the network intrusion symbol is a push pin symbol, and the means for indicating the change of the status indicates the change in the status of the mitigation response to the network intrusion by changing a color of the push pin symbol, the color indicative of the status of the mitigation response to the network intrusion.

41. A method for displaying an intrusion into a network, the method comprising:

receiving network intrusion information indicating that a network intrusion has occurred, the network intrusion comprising an unauthorized access of a computing device connected to the network;

identifying an Internet Protocol (IP) address associated with the computing device and corresponding to a network intrusion point at which the network intrusion has occurred;

retrieving, from an Address Routing Protocol (ARP) database using the IP address, a router address corresponding to the network intrusion point;

retrieving, from a location database using the retrieved router address, geographical location information corresponding to the network intrusion point;

determining a geographical location of the network intrusion point based on the retrieved geographical location information;

generating a geographical map displaying an area including at least the geographical location of the network intrusion point;

displaying a network intrusion symbol on the map to designate the geographical location of the network intrusion point;

correlating the received network intrusion information, the IP address of the computing device, the retrieved router address, and the retrieved geographical location information;

generating a network intrusion record for the intrusion based on the correlated information; and

storing the network intrusion record in an intrusion database.

42. The method of claim 41, further comprising:

receiving updated intrusion information;

updating the intrusion database and the map based on the updated intrusion information.