Patent ID: 7548897
Filing Date: 2009-06-16
Classification: H04L

Abstract:
1. A method for network defense, comprising the steps of: detecting mission events by processing communications packets and traffic streams; forming mission tracks by processing said mission events, determining active mission types, using said mission events; determining state of each mission, using said mission events, including producing a mission state vector for each mission; estimating mission sensitivities by processing said mission tracks; prioritizing network operations by processing said mission sensitivities; and correlating network alarms to missions by processing said mission sensitivities, wherein said steps include a database of dynamic and a priori information, wherein estimating mission sensitivities by processing said missiontracks comprises estimating mission sensitivity to network perturbations, using mission tracks; using a system dynamics model and a set of network perturbations to produce a nominal version of the mission state at k+1 and a perturbed version of the mission state at k+1, by injecting the perturbed version with the set of network perturbations at a predetermined time; propagating out the nominal version of the mission state at k+1 and the perturbed version of the mission state at k+1, to a computation horizon; and computing the difference between the overall mission effectiveness along the nominal version of the mission state and the perturbed version of the mission state; predicting mission impact of network perturbations and implementation of a network-operations Course Of Action (COA) with respect to expected impact on operational effectiveness.