Patent Publication Number: US-2007112512-A1

Title: Methods and systems for locating source of computer-originated attack based on GPS equipped computing device

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
      This is a continuation-in-part of prior co-pending U.S. patent application Ser. No. ______, filed Jun. 30,2006, entitled “METHODS AND SYSTEMS FOR LOCATING SOURCE OF COMPUTER-ORIGINATED ATTACK BASED ON GPS EQUIPPED COMPUTING DEVICE,” and prior co-pending U.S. patent application Ser. No. ______, filed ______, entitled “GEOGRAPHICAL INTRUSION MAPPING SYSTEM USING TELECOMMUNICATION BILLING AND INVENTORY SYSTEMS,” which itself is a continuation-in-part of prior co-pending U.S. patent application Ser. No.______, filed Jun. 30, 2006, entitled “METHODS AND SYSTEMS FOR GEOGRAPHICAL INTRUSION RESPONSE PRIORITIZATION MAPPING THROUGH AUTHENTICATION AND BILLING CORRELATION,” prior co-pending U.S. patent application Ser. No. 10/916,873, filed Aug. 12, 2004, entitled “GEOGRAPHICAL INTRUSION RESPONSE PRIORITIZATION MAPPING SYSTEM,” and prior co-pending U.S. patent application Ser. No. 10/916,872, filed Aug. 12, 2004, entitled “GEOGRAPHICAL VULNERABILITY MITIGATION RESPONSE MAPPING SYSTEM.” The contents of all the aforementioned applications are incorporated herein by reference in their entirety. 
    
    
     BACKGROUND  
      When an intrusion in computer or telecommunications systems is discovered, response resources must be directed to a physical location of the equipment associated with the intrusion. In practice, this requires extensive efforts to correlate existing threat information, router traffic information and physical location of the router and impacted/suspect device, dramatically reducing response time. For example, today, most responses to an intrusion require manual review of TCP/IP switch information, manual drawing of network “maps” and, most importantly, trying to mitigate an intrusion in a sequential or business prioritization order while these efforts are being undertaken. These response schemes do not allow for an organization&#39;s management to easily identify the geographical location of the problem(s) and the location(s) at which resources are most needed. Furthermore, current response schemes do not allow an organization&#39;s response or management team timely access to geographical view(s) of the location of the intrusions together with information relating to the status or progress of the response to the intrusion.  
      A digital or cyber intrusion may take the form of a direct attack, an introduction of malicious software such as virus and worm, or other intrusion generated by a computing device incorporating a Global Positioning System (“GPS”) receiver. Accordingly, a PDA, a Smartphone, or a laptop with embedded and/or integrated GPS capabilities (“GPS Device”) can be a source of a computer-originated attack, for example, a computer-triggered attack to remotely activate explosives.  
      A GPS device may be used to trigger a computer-originated attack in many ways. In one scenario, a GPS device may initiate a computer-originated attack directly, for example, by starting a digital or cyber attack. Alternatively, a GPS device, when vulnerable, may be at the receiving end of a first digital or cyber attack. Once the vulnerable GPS device is compromised, it may then fall under the influence of the first digital or cyber attack and itself initiate a computer-originated attack.  
      Fortunately, a GPS device may capture its location information via a protocol such as National Marine Electronics Association (“NMEA”) 0183. The captured location information can then be transmitted via another protocol such as TCP or UDP to an incident response environment. For example, an existing security software vendor, such as Antivirus, may identify a digital or cyber attack, detect that the device is also receiving GPS information, and subsequently transmit the attack information and GPS information back to an incident response environment.  
      Response resources can be directed to a physical location of a GPS device under attack. In practice, however, this requires extensive efforts to correlate existing threat data or. vulnerability data with GPS data collected and subsequently transmitted, thus reducing response time similar to a physical disaster or attack. So, even with the availability of GPS data, most current responses to an intrusion or vulnerability require manual review of TCP/IP switch information, manual drawing of network “maps” and, most importantly, trying to mitigate an intrusion or vulnerability in a sequential order, as described above. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       FIG. 1  is a block diagram of an exemplary environment in which the systems and methods of the present invention may be implemented;  
       FIG. 2  is a block diagram of an exemplary embodiment of a mapping computer;  
       FIG. 3  is a flowchart of an exemplary method for geographically mapping response information;  
       FIG. 4  is an exemplary screenshot of records in an intrusion database containing intrusion information;  
       FIG. 5  is an exemplary screenshot of records in an ARP database;  
       FIG. 6  is an exemplary screenshot of records in a location database;  
      FIG. 7  is an exemplary screenshot of records in a map database containing information for mapping intrusions;  
       FIG. 8  is an exemplary screenshot of a map geographically mapping vulnerabilities consistent with the present invention; and  
       FIG. 9  is a flowchart showing an exemplary method for updating a geographic map with progress information.  
       FIG. 10  is a block diagram of a second exemplary environment in which systems and methods consistent with the present invention may be implemented;  
       FIG. 11A  is a first example of records in a customer database;  
       FIG. 11B  is a second example of records in a customer database;  
       FIG. 12  is a second exemplary screenshot of a map geographically mapping vulnerabilities;  
       FIG. 13  is a flowchart of an exemplary method for geographically mapping intrusion response;  
       FIG. 14A  is a block diagram of an exemplary method for geographically correlating and mapping threats wherein the mapping system communicates directly with the identification system;  
       FIG. 14B  is a block diagram of an exemplary method for geographically correlating and mapping threats wherein the mapping system does not communicate directly with the identification system;  
       FIG. 15  is a second example of records in a threat database;  
       FIG. 16A  is an example of records in an authentication database;  
       FIG. 16B  is an example of records in a call database;  
       FIG. 17  is a block diagram of a third exemplary environment in which systems and methods consistent with the present invention may be implemented;  
       FIG. 18  is a flowchart of an exemplary method for locating a source of a computer-originated attack based on a GPS equipped computing device;  
       FIG. 19A  is a block diagram of an exemplary method for locating a source of a computer-originated attack based on a GPS equipped computing device wherein the network-based system does not communicate directly with the GPS device;  
       FIG. 19B  is a block diagram of an exemplary method for locating a source of a computer-originated attack based on a GPS equipped computing device wherein the network-based system communicates directly with the GPS device;  
       FIG. 20  is an exemplary screenshot of GPS Data;  
       FIG. 21  is an exemplary screenshot of records in a mapping database containing information for mapping intrusions; 
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS  
      Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts. It is to be understood that the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.  
      As used herein, an “intrusion” is an unauthorized use, attempt, or successful entry into a digital, computerized, or automated system, requiring a response from a human administrator or response team to mitigate any damage or unwanted consequences of the entry. For example, the introduction of a virus and the unauthorized entry into a system by a hacker are each “intrusions” within the spirit of the present invention. An “intrusion response” is a response by systems or human operators to limit or mitigate damage from the intrusion or prevent future intrusions. One of ordinary skill in the art will recognize that, within the spirit and scope of the present invention, “intrusions” of many types and natures are contemplated.  
      In addition, as used herein, a “vulnerability” is a prospective intrusion, that is, a location in a digital, computerized, or automated system, at which an unauthorized use, attempt, or successful entry is possible or easier than at other points in the system. For example, a specific weakness may be identified in a particular operating system, such as Microsoft&#39;s Windows™ operating system when running less than Service Pack  6 . Then, all computers running the Windows operating system with less than Service Pack  6  will therefore have this vulnerability. One of ordinary skill in the art will recognize that this and other vulnerabilities may be identified by commercially available software products. While methods of locating such vulnerabilities are outside the scope of the present invention, one of ordinary skill in the art will recognize that any of the vulnerabilities identified or located by such software products, now known or later developed, are within the spirit of the present invention.  
      In addition, as used herein, a “mitigation response” is the effort undertaken to reduce unwanted consequences or to eliminate the intrusion. For example, such a response may entail sending a human computer administrator to the site of the location to update software, install anti-virus software, eliminate a virus, or perform other necessary tasks. In addition, a response may entail installing a patch to the vulnerable computer, such as across a network. One of ordinary skill in the art will recognize that the present invention does not contemplate any specific responses. Instead, any response to an intrusion requiring the organization of resources is within the scope and spirit of the present invention.  
      For the ease of discussion, the following discussion will focus on the systems and methods of the present invention in terms of mapping “intrusions.” However, the same systems and methods may be applicable to the mapping of vulnerabilities. Reference to “threats” includes both intrusions and vulnerabilities.  
       FIG. 1  is a block diagram of one exemplary environment in which the systems and methods of the present invention may be implemented. As shown in  FIG. 1 , system  100  employs mapping computer  102 . In addition, system  100  may also employ databases such as intrusion database  104 , Address Routing Protocol (ARP) database  106 , location database  108 , and map database  110 , each in electronic communication with mapping computer  102 . System  100  also includes a display  114 , such as a video display, for displaying the geographic information correlated and mapped by computer  102  using the methods discussed herein, and a network  112 , in electronic communication with computer  102 , in which the intrusions may occur.  
      In one embodiment, intrusion database  104  may contain information identifying an intrusion in the system, such as, for example, the intrusion type, description, and point of possible entry or exit (i.e., network point or computer). ARP database  106  may contain network location or identification information such as the IP and/or MAC address for one or more network points representing a potential point of entry or exit (i.e., network point or computer). Location database  108  may contain geographical information such as the physical address or GPS coordinates of a potential point of entry or exit. Finally, map database  110  may correlate and contain information from the intrusion, ARP, and location databases as described below to map the intrusions.  
       FIG. 2  is a block diagram illustrating an exemplary mapping computer  102  for use in system  100 , consistent with the present invention. Computer  102  includes a bus  202  or other communication mechanism for communicating information, and a processor  204  coupled to bus  202  for processing information. Computer  102  also includes a main memory, such as a random access memory (RAM)  206 , coupled to bus  202  for storing information and instructions during execution by processor  204 . RAM  206  also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor  204 . Computer system  102  further includes a read only memory (ROM)  208  or other storage device coupled to bus  202  for storing static information and instructions for processor  204 . A mass storage device  210 , such as a magnetic disk or optical disk, is provided and coupled to bus  202  for storing information and instructions.  
      Computer  102  may be coupled via bus  202  to a display  212 , such as a cathode ray tube (CRT), for displaying information to a computer user. Display  212  may, in one embodiment, operate as display  114 .  
      Computer  102  may further be coupled to an input device  214 , such as a keyboard, coupled to bus  202  for communicating information and command selections to processor  204 . Another type of user input device is a cursor control  216 , such as a mouse, a trackball or cursor direction keys for communicating direction information and command selections to processor  204  and for controlling cursor movement on display  212 . Cursor control  216  typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), which allow the device to specify positions in a plane.  
      According to one embodiment, computer  102  executes instructions for geographic mapping of intrusion information. Either alone or in combination with another computer system, computer  102  thus permits the geographic mapping of intrusions in response to processor  204  executing one or more sequences of instructions contained in RAM  206 . Such instructions may be read into RAM  206  from another computer-readable medium, such as storage device  210 . Execution of the sequences of instructions contained in RAM  206  causes processor  204  to perform the functions of mapping computer  102 , and/or the process stages described herein. In an alternative implementation, hard-wired circuitry may be used in place of, or in combination with software instructions to implement the invention. Thus, implementations consistent with the principles of the present invention are not limited to any specific combination of hardware circuitry and software.  
      The term “computer-readable medium” as used herein refers to any media that participates in providing instructions to processor  204  for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device  210 . Volatile media includes dynamic memory, such as RAM  206 . Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus  202 . Transmission media may also take the form of acoustic or light waves, such as those generated during radio- wave and infra- red data communications.  
      Common forms of computer-readable media include, for example, a floppy disk, flexible disk, hard disk, magnetic tape, or any other magnetic medium, CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, RAM, PROM, EPROM, FLASH-EPROM, any other memory chip or cartridge, carrier wave, or any other medium from which a computer may read. For the purposes of this discussion, carrier waves are the signals which carry the data to and from computer  102 .  
      Various forms of computer-readable media may be involved in carrying one or more sequences of one or more instructions to processor  204  for execution. For example, the instructions may initially be carried on the magnetic disk of a remote computer. The remote computer may load the instructions into a dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer  102  may receive the data on the telephone line and use an infra- red transmitter to convert the data to an infra- red signal. An infra- red detector coupled to bus  202  may receive the data carried in the infra- red signal and place the data on bus  202 . Bus  202  carries the data to main memory  206 , from which processor  204  retrieves and executes the instructions. The instructions received by main memory  206  may optionally be stored on storage device  210  either before or after execution by processor  204 .  
      Computer  102  may also include a communication interface  218  coupled to bus  202 . Communication interface  218  provides a two-way data communication coupling to a network link  220  that may be connected to network  112 . Network  112  may be a local area network (LAN), wide area network (WAN), or any other network configuration. For example, communication interface  218  may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. Computer  102  may communicate with a host  224  via network  112 . As another example, communication interface  218  may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface  218  sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.  
      Network link  220  typically provides data communication through one or more networks to other data devices. In this embodiment, network  112  may communicate with an Internet Service Provider (ISP)  226 . For example, network link  220  may provide a connection to data equipment operated by the ISP  226 . ISP  226 , in turn, provides data communication services from another server  230  or host  224  to computer  102 . Network  112  may use electric, electromagnetic or optical signals that carry digital data streams.  
      Computer  102  may send messages and receive data, including program code, through network  112 , network link  220  and communication interface  218 . In this embodiment, server  230  may download an application program to computer  102  via network  112  and communication interface  218 . Consistent with the present invention, one such downloaded application geographically maps vulnerability or intrusion information, such as, for example, by executing methods  300  and/or  900 , to be described below. The received code may be executed by processor  204  as it is received and/or stored in storage device  210 , or other non-volatile storage for later execution.  
      Although computer system  102  is shown in  FIG. 2  as connectable to server  230 , those skilled in the art will recognize that computer system  102  may establish connections to multiple servers on Internet  228  and/or network  112 . Such servers may include HTML-based Internet applications to provide information to computer system  102  upon request in a manner consistent with the present invention.  
      Returning to  FIG. 1 , display  114  may, in one embodiment, be implemented as display  212  ( FIG. 2 ), directly connected to computer  102 . In an alternative embodiment, display  114  may be connected to computer  102  via network  112 . For example, display  114  may be a display connected to another computer on network  112 , or may be a stand-alone display device such as a video projector connected to computer  102  via network  112 .  
      In addition, databases  104 ,  106 ,  108 , and  110  may each reside within computer  102  or may reside in any other location, such as on network  112 , so long as they are in electronic communication with computer  102 . In one embodiment, ARP database  106  may be a technical table such as the type typically resident in router points in a computer network, in which information such as the MAC address, IP address and Router (IP/MAC address) is kept.  
      In one embodiment, location database  108  is a static database in which the physical location of routers or network points is located. Such location information may include router (IP/MAC) address, and router (or network point) physical address (geographic location), such as GPS coordinates. Accordingly, one of ordinary skill in the art will recognize that ARP database  106  and location database  108  may be kept in accordance with any now known or later developed methods for implementing and maintaining ARP information at router points, or physical location information, respectively.  
      In an alternative embodiment, databases  104 ,  106 ,  108 , and  110 , may be implemented as a single database, or may-be implemented as any number of databases. For example, one of ordinary skill in the art will recognize that system  100  may include multiple ARP databases, such as having one for each router (not shown) in the system. Similarly, system  100  may include multiple intrusion, location, and map databases. Furthermore, in one embodiment, databases  104 ,  106 ,  108 , and  110  may be implemented as a single database containing all of the described information. One of ordinary skill in the art will recognize that system  100  may include any number (one or more) of databases so long as the information discussed herein may be retrieved and correlated as discussed herein.  
      Finally, databases  104 ,  106 ,  108 , and  110  may be implemented using any now known or later developed database schemes or database software. For example, in one embodiment, each of the databases may be implemented using a relational database scheme, and/or may be built using Microsoft Access™ or Microsoft Excel™ software. While, more likely, one or more databases will be implemented to take into account other factors outside the scope of the present invention (for example, ARP database  106  may require specific format or implementation dependent on the router within which it resides), one of ordinary skill in the art will recognize that any implementation (and location) of the present databases is contemplated within the scope and spirit of the present invention.  
       FIG. 3  shows a method  300  for execution, such as by computer  102 , for geographic mapping of intrusion information, consistent with the present invention. Method  300  begins by receiving intrusion information, stage  302 , such as from a computer administrator, as the output of software designed to detect intrusions, from an intrusion detection system, router, network management system, security information manager, or from any other source. In one embodiment, the intrusion information may include an identification (such as the IP address) of the computer where the intrusion started or ended, the name and description of the intrusion, and possibly other data. Upon receipt of the intrusion information, it is stored in intrusion database  104  at stage  304 .  FIG. 4  shows one embodiment of intrusion information  400  within intrusion database  104 .  
      Returning to  FIG. 3 , computer  102  then retrieves, for computers (or network points) at which an intrusion started or ended, ARP information for that computer (or network point) from ARP database  106 , at stage  306 . In one embodiment, the intrusion information (such as the IP address) may be used as a key to retrieve the appropriate record from ARP database  106 . The ARP information may include the MAC address, and router IP/MAC address or any other network address information of the network point at which the intrusion started or ended, as necessary.  FIG. 5  shows one exemplary embodiment  500  of the ARP information within ARP database  106 .  
      In addition, computer  102  may also retrieve geographic location information for the computer at which the intrusion started or ended, from location database  108 , at stage  308 . In one embodiment, the intrusion data (such as IP address) and/or the ARP data (such as the router IP/MAC address) may be used as a key to identify a record corresponding to the location database record(s), corresponding to the network point. The location information retrieved may include such information as the physical location (e.g., mailing address or GPS coordinates) for the identified network point or computer.  FIG. 6  shows one exemplary embodiment  600  of the location information within location database  108 .  
      Once this information has been retrieved from databases  104 ,  106 , and  108 , it is stored in map database  110  at stage  310 . Within map database  110 , the retrieved information is preferably correlated such that all information for a particular intrusion is stored in a record for that intrusion. For example,  FIG. 7  shows an exemplary screenshot  700  of records of map information for mapping intrusions, such as may be stored in map database  110 . As shown, map database records may contain the intrusion information, the network address (such as the IP or MAC address from ARP database  106 ), and the physical location, such as the mailing address or GPS information (from location database  108 ). In addition, map database records may also include a status of the intrusion and an indication of the response person or team assigned to respond to the intrusion.  
      Upon correlating this information within map database  110 , computer  102  then maps the location of the intrusion at stage  312 . In one embodiment, the location information for each record is imported into a commercially available mapping program such as MapPoint™ by Microsoft, to visually locate the intrusion points with network  112  on a map. In one embodiment, the map may represent each of the intrusions as a symbol on the map, for example, as a push pin. An exemplary map  800  using this push pin approach is shown as  FIG. 8 . Within map  800 , each pushpin  802 ,  804 , shows the location of a point of intrusion requiring a response.  
      Using map  800 , response teams or system administrators will be able to identify “pockets” of intrusions and will be able to better prioritize and more efficiently schedule response personnel to respond and mitigate or eliminate the intrusion, based on geographic location. In addition, by continually updating the map and watching it change over time, system operators will be able to geographically view the spread, if any, of an intrusion. Furthermore, by also tracking system updates, the administrator will be able to identify new entry points.  
       FIG. 9  shows a flowchart of a method  900  for updating the geographic map with progress information. Method  900  begins with a response team or system administrator sending an update to the system to advise of a new status of a intrusion at stage  902 . For example, the response team may advise the system that the intruded computer must be replaced, and be rendered inactive until it is replaced, (i.e., the intrusion is “open”) or may advise the system that the intruded computer has been upgraded and is no longer compromised.  
      Once this information is received, the map database record for the identified intrusion is updated at stage  904 . For example, each intrusion record in the database may contain a field to identify the status of the intrusion (see  FIG. 7 ). Possible status indicators may reflect that the intrusion is “new,” “open” (i.e., not yet responded to), “assigned to a response team,” “closed” (i.e., responded to and fixed), or any other status that may be of use to the organization for which the system has been implemented.  
      Once the map database record has been updated, map computer  102  can update map  800  to reflect the updated status of the intrusion. For example, one way that map  800  can show the status information is to display color-coded push pin symbols to reflect the status. In one embodiment, a red push pin may signify an “open” or “new” intrusion, a yellow push pin may signify a intrusion that has been assigned, but not yet fixed, and a green push pin may signify a closed intrusion. By mapping this information together with the locations of the intrusions, administrators can better track the progress of their response teams, and more fluidly schedule responses to new intrusions as they arise.  
      One of ordinary skill in the art will recognize that, while the present invention discusses the systems and methods for mapping intrusions of a system, similar systems and methods may be utilized to map vulnerabilities to the system. For example, referring to  FIG. 1 , database  104  may maintain vulnerability information rather than intrusion information. Therefore, using database  104 , computer  102 , through the execution of methods  300  and  900 , may geographically map vulnerabilities and update the status of responses to those vulnerabilities. Such methods and systems are further described in the aforementioned U.S. patent application Ser. No. 10/916,872, entitled “Geographical Vulnerability Mitigation Response Mapping System,” filed concurrently herewith, the contents of which is incorporated by reference herein in its entirety.  
      One of ordinary skill in the art will recognize that any symbol or representation may be used to identify an intrusion on the map, including, but not limited to, a push-pin symbol. These symbols and representations may be used to identify the quantity of intrusions in that area of the map, such as by varying the color of the symbol to identify such quantity. In addition, the symbol or representation may be linked to the underlying data such that a user, using an input device, may select a symbol on the map causing computer  102  to display the status, quantity, address, or other information corresponding to the selected symbol.  
      The preferred intrusion/vulnerability mapping systems and methods may applied in various environments using various equipment and data analogous to the described above. Described below are various specific implementations thereof in the context of certain network environments.  
       FIG. 10  is a block diagram of a second exemplary environment  1000  in which preferred systems and methods consistent with the present invention may be implemented. The number of components in environment  1000  is not limited to what is shown and other variations in the number of arrangements of components are possible. The components of  FIG. 10  may be implemented through hardware, software, and/or firmware.  
      As shown in  FIG. 10 , environment  1000  may include a network security system  1020 , an identification system  1030 , a location system  1040 , and a mapping system  1050 , each directly or indirectly in electronic communication with the other systems. Similarly to the environment  100  of  FIG. 1 , such communication may be conducted through a network  112  as described above. Also similarly to the environment  100  of  FIG. 1 , environment  1000  also includes a display device  114 , such as a video display, for displaying the geographical intrusion information correlated and mapped by the mapping system  1050  using the methods discussed herein.  
      Exemplary network security system  1020  includes various systems that can provide information related to network intrusions, vulnerabilities or other security threats. For example, network security system  1020  may include an Intrusion Detection System (“IDS”), firewall logs, or other systems which may be useful in identifying a threat in the environment. For example, the IDS or firewall logs may identify attacks and contain information such as the attack type, description, and impacted device information such as an IP address of the impacted device (e.g., a router, a connected computer). Network security system  1020  may also include threat database  1022 , which stores threat information, such as the aforementioned attack-related information (e.g., threat type, threat description, and impacted device information such as an IP address of the impacted device).  FIG. 4  illustrates one example of threat information  400  that may be stored in threat database  1022 .  FIG. 15  illustrates a second example of threat information  1500  that may be stored in threat database  1022 . Other examples are of course possible.  
      Exemplary identification system  1030  may include various systems that can provide information useful for identifying network points (e.g., network equipment, connected computers, users, etc.) within environment  1000 . For example, in environment  1000 , identification system  1030  includes an authentication system  1031 . Authentication system  1031  may be implemented, for example, through the RADIUS Authentication Protocol, to verify that a user is indeed authorized to operate in environment  1000 . RADIUS is used commonly with embedded network devices such as routers, modem servers, and switches. A typical RADIUS packet includes fields such as code, identifier, length, authenticator, and attributes. In one example, a RADIUS packet may contain attributes such as username and password, which may be used to identify a particular user in the network. When a RADIUS packet is sent from a network point in a telecom system, it may also contain telephony attributes such as a calling party telephone number (e.g., “Caller ID” information).  
      A user or client may initiate an authentication process by sending a RADIUS Access-Request packet to a server in authentication system  1031 . The server will then process the packet and send back a response packet to the client if the server possesses a shared secret for the client. Once the authentication is confirmed by the client, authentication system  1031  may store pertinent authentication data in authentication database  1032 . Authentication data may contain, for example, an IP address, user information, caller ID information and authentication identification (e.g., crypto-keys). Authentication database  1032  thus may serve as a source for identification information for network points in environment  1000 .  FIG. 16A  illustrates one example of records storing authentication data  1600  in authentication database  1032 . Other examples are of course possible.  
      In some implementations (e.g., telecom networks), identification system  1030  may also include a call database  1033 , which may store data related to call transactions, such as calling party telephone number, called party telephone number, other network addresses associated with a caller or network equipment used in a call (e.g., MINs, IP/MAC addresses), etc. For example, in a Voice over IP system, and IP address may be associated with a conventional telephone number, in order to perform proper call routing. Call database  1033  thus may serve as a source for identification information for network points in environment  1000 .  FIG. 16B  illustrates one example of records storing call data  1601  in a call database  1033 . Other examples are of course possible.  
      In some implementations, identification system  1030  may include a router database  1034 . Router database may comprise ARP database  106  (see  FIG. 1 ) or any other database that is useful to identify network elements (e.g., switches, routers, platforms) within network  110 . As noted above,  FIG. 5  illustrates one example of records storing router identification data (e.g., MAC addresses). Other examples are of course possible.  
      Exemplary location system  1040  includes various systems that are useful in identifying physical (geographic) locations associated with network points in environment  1000 . For example, location system  1040  may include a customer database  1042 , which may contain geographical information such as the physical address or geographic coordinates (e.g., mailing address, latitude and longitude) for the customers (or other parties) that use network  114 . Information in customer database  1042  may be identified by various data that is associated with a particular customer entity, such as authentication data (illustrated in  FIG. 11A  as location data  1100 ), caller ID information (illustrated in  FIG. 11B  as location data  1101 ), a combination thereof and/or other customer-specific identifiers. Location system  1040  may also include a network element database  1043 , which may comprise the aforementioned location database  108  (see  FIG. 1 ,  FIG. 6 ) and/or other databases that track physical locations of network switching elements.  
      Exemplary mapping system  1050  may be configured to correlate data from the various databases described above, and to map threats accordingly (as further described below). Mapping system  1050  may be implemented using computer  102 , map database  110  and display  114  as described above (see  FIG. 2 ). Computer  102  may be configured to execute instructions that perform the various operations associated with the exemplary threat mapping processes described herein.  
      As was the case for environment  100 , network security system  1020 , identification system  1030 , location system  1040  and mapping system  1050  of environment  1000  may be interconnected directly or indirectly, with or without network  112 . Moreover, elements of each of these systems may be distributed across multiple computing platforms, or concentrated into only one or a few computing platforms. For example, network security system  1020 , identification system  1030 , and location system  1040  may each reside within mapping system  1050 , or may reside in any other location in any combination, so long as they are in electronic communication with mapping system  1050 . Likewise the various databases may be implemented as a single database, or may be implemented as any number of databases. For example, one of ordinary skill in the art will recognize that environment  1000  may include multiple authentication databases, such as having one for each geographical region served by environment  1000 . Similarly, environment  1000  may include multiple threat, authentication, call, customer location and/or mapping databases, or a single database containing all of the described information. One of ordinary skill in the art will recognize that any implementation (and configuration) of the system environment described herein is contemplated.  
       FIG. 13  shows a preferred method  1300  which may be performed in conjunction with mapping system  1050  to geographically correlate and map threats in environment  1000 . Method  1300  is similar in many respects to method  300  (see  FIG. 3 ), and is presented here as specifically applicable to the exemplary environment  1000 . Method  1300  begins (similarly to method  300  of  FIG. 3 ) by receiving threat data at stage  1302  and recording the threat data in threat database  1022  in stage  1304 . As noted above, threat data may be any information describing or identifying a threat. Threat data can be received from a computer administrator, from the output of software designed to detect or discover intrusions from IDS or firewall logs, from a network management system, from a security information manager, or from any other source.  FIGS. 4 and 15  illustrate examples of threat data recorded in threat database  1022 .  
      Returning to  FIG. 13 , in stage  1305  the mapping system receives the threat data from threat database  1022 . In stage  1306 , mapping system  150  retrieves identification information from at least one of authentication database data  1032  and call database  1033 , for those network points at which the threats started (or ended). In one embodiment, at least one part of the threat data (such as the IP address or Caller ID information) may be used as a key to retrieve the associated record(s) in authentication database  1032  and/or call database  1033 . As shown by the examples in  FIGS. 5, 16A  and  16 B, the retrieved identification data can include authentication identification, IP address, caller ID information, and/or any other network address information of the network point at which the threat started or ended, as necessary.  
      At stage  1308 , mapping system  1050  retrieves geographical location data, for the computer or device at which the intrusion(s) started or ended, from location system  1040 . In one embodiment, at least one part of the identification data (such as authentication identification or caller ID information) may be used as a key to identify and retrieve the associated record(s) in at least one of customer database  1042  and/or network element database  1043 . The location data retrieved may include such information as the physical location (e.g., mailing address or geographic coordinates) for the identified attacked network point or device.  FIGS. 6, 11A  and  11 B show examples of such location data.  
      At stage  1310 , the retrieved data are preferably correlated such that all information for a particular threat is stored in a record or records for that intrusion. In one embodiment, the correlated data are stored as map data in mapping database  110 .  FIG. 7  shows an example of records in mapping database  110 . As shown, mapping database records may contain the threat information, the network address (such as the IP address), and the physical location such as the mailing address or coordinate information. In addition, mapping database records may also include a status of the threat and an indication of the response person or team assigned to respond to the threat.  
      Returning to  FIG. 13 , at stage  1312 , mapping system  150  maps the location of the threat. In one embodiment, the map data for each threat are imported into a commercially available mapping program such as Microsoft MapPoint™ to visually locate the threat points on a map presented on display  114 . In one embodiment, the map may represent each of the threats as a symbol on the map, for example, as a “pushpin.” An exemplary map  800  using this pushpin approach is shown in  FIG. 8 . Within map  800 , each pushpin symbol  802 ,  804 , shows the location of a point of threat requiring a response. The color of the pushpin symbol or representation on the map may be used to identify the quantity of threats in an area on the map, allowing the administrators to easily identify problem areas. In addition, the symbol (i.e., pushpin or other symbol) may be linked to the underlying data. For example,  FIG. 12  illustrates a map  1200 , which includes description windows associated with each pushpin location  1202 ,  1204  (e.g., specifying the address associated with each pushpin). In some embodiments, a system user may, using an input device, select a symbol on the map to initiate a display of data such as the intrusion type, IP address, status of the response, or other information.  
       FIGS. 14A and 14B  are block diagrams showing two exemplary methods for geographically mapping threats through correlation. In  FIG. 14A , mapping system  1050  receives, from threat database  1022  in network security system  1020 , threat data containing, for example, one or more of a source IP address, destination IP address, and attack event name, at stage  1412 . In addition, at stage  1414 , mapping system  1050  receives identification data from one or more of the authentication database  1032 , the call database  1033  and the router database  1034  of identification system  1030 . The identification data may contains, for example, one or more of an IP address, authentication identification, caller ID information or MAC address. At stage  1416 , mapping system  150  receives location data from one or more of customer database  1042  and network element database  1043  in location system  1040 . Location data may contain, for example, one or more of authentication identification, IP address, MAC address, and/or geographic information such as a mailing addresses. One of ordinary skill in the art will recognize that these stages, namely,  1412 ,  1414  and  1416 , may take place in other sequences than described here.  
      After receiving threat, identification, and location data, mapping system  1050  correlates threat data and identification data with location data to generate map data. In one embodiment, mapping system  1050  joins tables from the aforementioned databases, utilizes IP address as a key to identify the record(s) indicating the source or destination of the threat and the identity of the network point experiencing the threat, uses the identification data to locate associated geographic coordinates, and generates map data containing IP address, attack event name, and geographic coordinates for storage in mapping database  110 . One of ordinary skill in the art will recognize that this correlation may be implemented in many other ways. At stage  1418 , mapping system  150  generates a map displaying a geographical location of the threat(s) based on the map data from mapping database  110 .  
      In another embodiment,  FIG. 14B  shows an exemplary method where the mapping system does not communicate directly with the identification system. In  FIG. 14B , identification system  1030  receives, from network security system  1020 , threat data describing or identifying the threat(s), at stage  1420 . Also at stage  1420 , identification system  1030  queries the table(s) in one or more of authentication database  1032 , call database  1033  and/or router database  1034 , utilizing either source IP address or destination IP address of the threat(s) in threat database  1022  as a key to identify the record(s) containing identification information associated with the IP address. At stage  1422 , location system  1040  receives identification data from identification system  1030 , and uses this data to identify the record(s) containing location data associated with the identification data from one or more of customer database  1042  and network element database  1043 .  
      Mapping system  1050  receives location data from location system  1040  at stage  1424  and threat data identifying the source or destination of the threat(s) from threat database  1022  at stage  1426 . Mapping system  1050  correlates the threat data with location data and generates map data containing IP address, attack event name, and geographic coordinates for storage in mapping database  110 . In one embodiment, after stage  1422 , location data contain an identifier such as IP address and the correlation is implemented by matching the identifiers between location data and threat data. However, one of ordinary skill in the art will recognize that this correlation may be implemented in many ways. At stage  1428 , mapping system  1050  generates a map displaying a geographical location of the threat(s) based on the map data from mapping database  110 .  
      The map data in mapping database  110  may be periodically updated, as described above with respect to  FIG. 9 .  
       FIG. 17  is a block diagram of a third exemplary environment  1700  in which preferred systems and methods consistent with the present invention may be implemented. The number of components in environment  1700  is not limited to what is shown and other variations in the number of arrangements of components are possible. The components of  FIG. 17  may be implemented through hardware, software, and/or firmware.  
      As shown in  FIG. 17 , environment  1700  may include a network security system  1020  and a mapping system  1750  similar those depicted in  FIG. 10  and described above, with modifications as noted below. Also similarly to the environment  100  of  FIG. 1 , environment  1700  also includes a display device  114 , such as a video display, for displaying the geographical intrusion information correlated and mapped by the mapping system  1750  using the methods discussed herein. Identification system  1030  and location system  1040  of  FIG. 10 , although not shown in  FIG. 17 , may be included in system environment  1700  in a manner similar to described above. Communication between systems in environment  1700  may be conducted through a network  112  as described above.  
      In addition, environment  1700  may include a GPS device  1740 , from which the network security system  1020  and/or mapping system  1750  receives GPS data in a format such as NMEA  0183  via software transmitting this data using TCP or UDP. GPS device  1740  may communicate with network security system  1020  and/or mapping system  1750  via one or more well known data transmission capabilities or software.  
       FIG. 18  shows a preferred method  1800  which may be performed by mapping system  1750  to locate sources of computer-originated attacks based on GPS devices. Method  1800  begins by recording threat data at stage  1802 . Similar to step  302  of method  300 , threat data may be any information describing or identifying a threat. In one embodiment, the threat data may include an identification (such as the IP address) of the GPS device or network point where the computer-originated attack started, and the name and description of the attack event, among other information. The threat data are stored in threat database  1022 . As noted above,  FIG. 5  shows one embodiment of threat data within threat database  1022 .  
      Returning to  FIG. 18 , at stage  1804 , the threat data stored in network security system  1020  is retrieved. At stage  1806 , mapping system  1750  retrieves GPS data for GPS devices  1740  at which the computer-originated attack(s) started. In one embodiment, at least one part of the threat data (such as the IP address) may be used as a key to retrieve the appropriate GPS record(s). The GPS data may include IP address and location information, such as geographic coordinates, of the GPS device  1740  at which the computer-originated attack(s) started, as necessary.  FIG. 20  shows one exemplary embodiment of GPS data  2000 , which may be provided by GPS device  1740 .  
      Once the relevant data have been retrieved from threat database  1022  and GPS device  1740 , they may be stored in mapping system  1750  (e.g., in mapping database  1752 ). At stage  1808 , the retrieved threat data and GPS data are preferably correlated such that all information for a particular computer-originated attack is stored in a record or records for that attack. In one embodiment, the correlated data are stored as map data in mapping database  1752 .  FIG. 21  shows an exemplary embodiment of records  2100  in mapping database  1752 . As shown, mapping database records  2100  may contain attack event name, the network address (such as the IP address from threat database  1022 ), and the physical location such as geographic coordinates (from GPS device  1740 ). In addition, mapping database records may also include a status of the threat and an indication of the response person or team assigned to respond to the threat.  
      Returning to  FIG. 18 , at stage  1810 , mapping system  1750  maps the location of the source of the computer-originated attack. In one embodiment, the map data for each computer-originated attack are imported into a commercially available mapping program such as Microsoft MapPoint™ to visually locate the intrusion points on a map presented on display  114 . As noted above, the map may represent each of the threats as a symbol on the map, for example, as a “pushpin,” such as illustrated in  FIG. 8 , where each pushpin symbol  802 ,  804 , shows the location of a point of intrusion or vulnerability. As in the previously described embodiments, the mapping provided herein may allow response teams to identify “pockets” of threats and will be able to better prioritize and more efficiently schedule response personnel to respond and mitigate or eliminate the threats, based on geographical location. The map may be updated when threat information becomes updates, as noted above. In addition, due the mobile nature of GPS devices, the map may be updated at regular intervals using currently available GPS data from GPS devices  1740 .  
       FIGS. 19A and 19B  are block diagrams showing two exemplary methods for locating a source of a computer-originated attack based on a GPS device. In the method depicted in  FIG. 19A , in a stage  1912 , mapping system  1750  receives, from threat database  1022  in network security system  1020 , threat data containing, for example, source IP address, destination IP address, and attack event name. In addition, at stage  1914 , mapping system  1750  receives GPS data from GPS device  1740 . GPS data contains, for example, IP address and geographic coordinates of the impacted GPS device. These stages  1912  and  1914  may take place simultaneously or in any sequences.  
      After receiving threat and GPS data, mapping system  1750  correlates threat data with GPS data to generate map data, as noted above. In one embodiment, mapping system  1750  joins tables from threat database  1022  with GPS data, utilizes the IP address in the GPS data as a key to identify the record(s) indicating the source of the intrusion or computer-originated attack from threat database  1022 , and generates map data containing IP address, attack event name, and geographic coordinates in mapping database  1752 . At stage  1916 , mapping system  1750  generates a map displaying a geographical location of the source of the intrusion(s) or vulnerabilit(ies) based on the map data from mapping database  1752 .  
      In the exemplary method depicted in  FIG. 19B , the network security system communicates directly with the GPS device. As shown, network security system  1020  receives GPS data describing or identifying the impacted GPS device from GPS device  1740  at stage  1920 . Also at stage  1920 , network security system  1020  queries the table(s) in threat database  1022 , utilizing the IP address of the GPS data as a key to identify the record(s) describing or identifying the threat(s) from threat database  1022 .  
      At stage  1922 , mapping system  1750  receives threat data describing or identifying the threat(s) from threat database  1022 . At stage  1924 , mapping system  1750  receives GPS data from GPS device  1740 . Mapping system  1750  further correlates threat data with GPS data and generates map data containing IP address, attack event name, and geographic coordinates in mapping database  1752 . In one embodiment, the correlation is implemented by matching the IP addresses between GPS data and threat data, although other correlation methods are possible. At stage  1926 , mapping system  1750  generates a map displaying geographical location of the source of the intrusion(s) or vulnerabilit(ies) based on the map data from mapping database  1752 .  
      While the preferred embodiments implemented consistent with the present invention have been described herein, other embodiments may be implemented consistent with the present invention as will be apparent to those skilled in the art from consideration and practice of the preferred embodiments described in this specification. It is intended that the specification and examples described herein be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.