Patent Description:
Communication systems, including communication satellites, are potential targets for malicious actors. Detecting intrusions by these malicious actors can be difficult as monitoring every communication between satellites and other communication systems may not be practical as the configurations and topology of the devices and networks can be constantly changing over time. Accordingly, additional security or systems that improve the detection capabilities of communication systems would be advantageous.

Document <CIT>, according to its abstract, states a mechanism is provided for generating a packet inspection policy for a policy enforcement point in a centralized management environment. Data of a network topology for the policy enforcement point corresponding to a network infrastructure is updated according to metadata of the policy enforcement point, the metadata including a capability of the policy enforcement point. The packet inspection policy for the policy enforcement point is generated according to the data of the network topology and the capability of the policy enforcement point. The packet inspection policy is then deployed to the policy enforcement point.

Document <CIT>, according to its abstract, states a device may include one or more processors to receive network topology information of a network and device capability information of devices in the network; detect a threat to the network; determine threat information associated with the threat; select a security policy and an enforcement device of the network to enforce the security policy based on the network topology information, the device capability information, and the threat information; and perform an action associated with the threat based on the security policy and the enforcement device.

This Background section is intended to introduce the reader to various aspects of art that may be related to various aspects of the present disclosure, which are described and/or claimed below.

The presently claimed invention is defined by the appended independent claims.

The Figures described below depict various aspects of the systems and methods disclosed therein. It should be understood that each Figure depicts an example of a particular aspect of the disclosed systems and methods, and that each of the Figures is intended to accord with a possible example thereof. Further, wherever possible, the following description refers to the reference numerals included in the following Figures, in which features depicted in multiple Figures are designated with consistent reference numerals.

There are shown in the drawings arrangements, which are presently discussed, it being understood, however, that the present examples are not limited to the precise arrangements and instrumentalities shown, wherein:.

The field relates generally to intrusion detection, and more specifically, to detecting malicious traffic flows in a known, controlled, and constantly changing environment by analyzing the configuration and topology of time-varying networks. In one example, a communication device network analyzer ("CDNA") computer device determines a communication network based on the current time and the available communication devices, and generates and implements one or more policies for the communication devices on the communication network to analyze the communications on the communication network for potential cybersecurity threats.

The disclosed systems and methods include software defined networking (SDN) systems to control and manage one or more security algorithms using available context information about the network, the topology of the network, user information, connection attributes, and/or demand attributes to detect malicious traffic flows. The context information can include the SDN networking architecture for time varying satellite topology. The context information can also include, the full knowledge and control of the satellites in a specific constellation at a specific point in time, including where the satellites are, which satellite is connected to which other device, and which devices should be connected to which other devices at a specific point in time, and for what duration. The context information can further include, but is not limited to, knowing how the users are connected, the types of connections between the satellites and between the satellites and the users, the MOD/COD (modulation and coding, where coding refers to FEC (forward error correction) overhead), data rates, and/or traffic profiles (what kind of traffic users and/or devices are expected to generate).

Example systems and methods determine that for a given topology in time, context information can be used to create and deploy security policies. The context information can be provided, collected, calculated, and/or any collated combination of the above by SDN applications. These SDN applications can include, but are not limited to, a traffic engineering manager, a topology manager, a user manager, etc. Furthermore, for a set of known future topologies, the SDN applications can use the available context information to determine in advance which algorithms to use and to pre-compute one or more security policies for the known future topologies. With the algorithms and security policies in place, the SDN applications can use the algorithms to monitor the data flow information based on the corresponding security policies to monitor for and detect malicious traffic flows.

The CDNA system is configured to obtain and/or store information about the topology, network, and users (i.e., connections, demands, etc.) at a plurality of points in time. For example, the CDNA system can determine what the topology should look like, where the devices are, how the devices are connected, and how the devices should be connected. This especially works in situations where the network devices are controlled by strict schedules, such as satellites. In these situations, the CDNA system would determine where the devices should be and how the devices should be connected based on a schedule. Since the CDNA knows the network and connections, it can determine the best algorithm and security policy for each side of a connection between two communication devices for monitoring that connection.

Example systems and methods recognize that network topology and configuration can change overtime, especially those networks that include mobile communication devices, such as those associated with, but not limited to, satellites, aircraft, watercraft, spacecraft, vehicles, drones, and/or individuals. The systems and methods described herein address the security issues of these changing networks by generating and providing up-to-date security policies for the communication devices based on the current network topology. Updated security policies are also provided for when then network topology changes. By setting the security policies for the communication devices, algorithms, such as those executing on the communication devices, can determine when those security policies are being violated, which may indicate a cybersecurity threat, such as a cyber-intrusion, the presence of malicious code, and/or another threat.

Described herein are computer systems such as the CDNA computer devices and related computer systems. As described herein, such computer systems include a processor and a memory. However, any processor in a computer device referred to herein can also refer to one or more processors wherein the processor can be in one computing device or a plurality of computing devices acting in parallel. Additionally, any memory in a computer device referred to herein can also refer to one or more memories wherein the memories can be in one computing device or a plurality of computing devices acting in parallel.

The systems and processes are not limited to the specific examples described herein. In addition, components of each system and each process can be practiced independent and separate from other components and processes described herein. Each component and process also can be used in combination with other assembly packages and processes.

<FIG> illustrates a block diagram of an example communication satellite system <NUM>, in accordance with one example of the present disclosure. The example satellite system <NUM> includes a network processor <NUM>, a storage unit <NUM>, and a payload processor <NUM>, which are all connected to an Ethernet switch <NUM>. The Ethernet switch <NUM> is further connected to one or more bus controllers <NUM>, which facilitate communication with satellite bus subsystems <NUM> and a packet switch <NUM>. In some examples, the packet switch <NUM> is a programmable data plane with security that allows for the execution of algorithms to monitor a plurality of ports <NUM> that are used for communication connections <NUM> from and to the satellite <NUM>. The plurality of ports <NUM> can include, but are not limited to, inter-satellite links (ISL), down links (DL), and ports <NUM> that can act as either ISL or DL.

<FIG> illustrates a block diagram of an example network <NUM> in a first network configuration <NUM> including the example communication satellite system <NUM> (shown in <FIG>). Network <NUM> includes a plurality of satellites <NUM>. As shown in the first network configuration <NUM>, the plurality of satellites <NUM> are at a plurality of orbits, such as geosynchronous earth orbit (GEO) <NUM>, medium earth orbit (MEO) <NUM>, and low earth orbit (LEO) <NUM>. Network <NUM> can also include satellites <NUM> in highly elliptical orbit, lunar orbits, or any other non-geostationary (NGSO) orbit around celestial bodies, where their connections and locations are known and/or can be predicted.

Network <NUM> also includes a plurality of user devices <NUM>. The user devices <NUM> can include aircraft, spacecraft, watercraft, ground-based vehicles, ground stations, and/or space stations, where the user devices <NUM> connect to the network <NUM>.

As shown in the first network configuration <NUM>, the satellites <NUM> each have one or more ISL connections <NUM>. There are also DL connections <NUM> to the satellites <NUM> from the user devices <NUM>. While not shown as fully connected in the Figures, each DL connection <NUM> connects a user device <NUM> on the network <NUM> to a satellite <NUM>.

Per the nature of satellites <NUM>, the different satellites <NUM> orbit the earth at different rates, such that the satellites <NUM> in the network configuration <NUM> at time A will be different than that at time B. For example, satellites <NUM> in LEO <NUM> will orbit the Earth in <NUM> to <NUM> minutes, while those in MEO <NUM> may take <NUM> hours to complete an orbit. This means that the satellites <NUM> that make up the network <NUM> will change overtime. Accordingly, knowing when the network configuration <NUM> of the network <NUM> will change is important to properly securing and monitoring the network <NUM>.

<FIG> illustrate the transition of the network <NUM> from one configuration to another as time changes. <FIG> illustrates a block diagram of a transition <NUM> from the first network configuration <NUM> to a second network configuration <NUM>. In the transition <NUM>, the ISL connection <NUM> between satellite #<NUM> and satellite #<NUM> ends and a new ISL connection <NUM> is created between satellite <NUM> and satellite <NUM>. <FIG> illustrates a block diagram of a transition <NUM> from the second network configuration <NUM> to a third network configuration <NUM>. In transition <NUM>, satellites #<NUM>, #<NUM>, and #<NUM> are replaced by satellites #<NUM>, #<NUM>, and #<NUM>. The ISL connection <NUM> between satellite #<NUM> and satellite #<NUM> is replaced by an ISL connection <NUM> between satellite #<NUM> and satellite #<NUM>. Furthermore, the ISL connection <NUM> between satellite #<NUM> and satellite #<NUM> is replaced by an ISL connection <NUM> between satellite #<NUM> and satellite #<NUM>. <FIG> illustrates a block diagram of a transition <NUM> from the third network configuration <NUM> to an Nth network configuration <NUM> (e.g., where N is a most any whole number greater than <NUM>). In the Nth network configuration <NUM>, the ISL connection <NUM> between the satellites <NUM> in GEO <NUM> and MEO <NUM> is between satellite #<NUM> and satellite #<NUM>.

Each network configuration <NUM>, <NUM>, <NUM>, and <NUM>, represents the network <NUM> at a different point in time. <FIG> illustrates a block diagram of the transitions of the network <NUM> (shown in <FIG>) between the network configurations <NUM>, <NUM>, <NUM>, and <NUM> (shown in <FIG>, <FIG>, <FIG>, and <FIG> respectively). While only four network configurations <NUM>, <NUM>, <NUM>, and <NUM> are shown, there are a plurality of potential different network configurations for network <NUM>. Each different network configuration can include different ISL connections <NUM> between the satellites <NUM> and different DL connections <NUM> between the satellites <NUM> and the user devices <NUM> as well as different <NUM> and <NUM> on the network <NUM>.

<FIG> illustrates a simplified block diagram of an example communication device network analyzer ("CDNA") system <NUM> for setting the context of the network <NUM> (shown in <FIG>) in accordance with one example of the present disclosure. In the example, CDNA system <NUM>, or an SDN application, is used for monitoring the configuration of the network <NUM> and controlling the operation of algorithms for monitoring the communications of satellites <NUM> (shown in <FIG>) and other devices on the network <NUM>. The algorithms monitor the communications on the network <NUM> for malicious data flows that can indicate cyber-security threats and attacks to allow other systems to potential respond to the identified detected cybersecurity threats and attacks.

The CDNA system <NUM> includes a plurality of client devices <NUM> in communication with a communication device network analyzer ("CDNA") computer device <NUM>. The CDNA computer device <NUM> is in communication with a database server <NUM> for retrieving and storing data in a database <NUM>. The CDNA computer device <NUM> is also in communication with a plurality of algorithm controllers <NUM>.

The CDNA computer device <NUM> is programmed to receive context information about different configuration of the computer network <NUM>. The context information can include, but is not limited to, the knowledge of the satellites <NUM> (shown in <FIG>) in the network <NUM> at a specific point in time, including where the satellites <NUM> are, which device <NUM> and <NUM> is connected to which, and which device <NUM> and <NUM> should be connected to which at each specific point in time, and what is the duration of each connection <NUM>. The context information can also include, but is not limited to, how the user devices <NUM> (shown in <FIG>) are connected to the network <NUM> and the satellites <NUM>, the types of connections <NUM> between the satellites <NUM> and between the satellites <NUM> and the user devices <NUM>, the MOD/COD (modulation and coding, where coding refers to FEC (forward error correction) overhead), the data rates, and the traffic profiles (what kind of traffic are users expected to generate) along the network <NUM> for each network configuration <NUM>, <NUM>, <NUM>, and <NUM> (shown in <FIG>, <FIG>, <FIG>, and <FIG>, respectively). In some examples, the CDNA computer device <NUM> receives the context information from one or more client devices <NUM>. In other examples, the CDNA computer device <NUM> receives at least a portion of the context information from the user devices <NUM> themselves, such as when a user device <NUM> connects to an ad-hoc network <NUM>. In some examples, all of the connections <NUM> and <NUM> (both shown in <FIG>) are known in advance. In other examples, one or more user devices <NUM> may be able to connect to the network <NUM> on an ad-hoc basis. In these examples, the new user device <NUM> negotiates a connection <NUM> to the network <NUM>. The new user device's information is passed to the CDNA computer device <NUM>, which generates a new security policy for the new user device <NUM> and for the devices <NUM> and <NUM> that have connections <NUM> to the new user device <NUM>.

The CDNA computer device <NUM> uses the context information to determine security policies for each side of each connection <NUM>. In the example, the CDNA computer device <NUM> generates security policies for each connection <NUM> on the network <NUM> that includes a satellite <NUM>. In other examples, the CDNA computer device <NUM> generates security policies for all connections <NUM> including those that are between user devices <NUM> on the network <NUM>. The CDNA computer device <NUM> also determines which algorithms to use for monitoring each connection <NUM>, where the algorithms are configured to use the security policies to monitor one or more connections <NUM> for malicious traffic flows. The CDNA computer device <NUM> activates the appropriate algorithms and the appropriate policies when the network <NUM> is in the corresponding configuration.

For example, based on network configurations <NUM>, <NUM>, <NUM>, and <NUM>, the CDNA computer device <NUM> determines that the first network configuration <NUM> will be valid from Time A to Time B, the second network configuration <NUM> will be valid from Time B to Time C, the third network configuration <NUM> will be valid from Time C to Time D, and the fourth network configuration <NUM> will be valid from Time D to Time E. Furthermore, the CDNA computer device <NUM> obtains the context information for each network configuration <NUM>, <NUM>, <NUM>, and <NUM>. This context information can be stored in database <NUM> or received from one or more client devices <NUM>.

For each network configuration <NUM>, <NUM>, <NUM>, and <NUM>, the CDNA computer device <NUM> determines which algorithm to use monitoring each connection <NUM> and generates a security policy for each of those connections <NUM>. For example, in the first network configuration <NUM>, the CDNA computer device <NUM> determines which algorithm to run on satellite #<NUM> for the ISL connection <NUM> to satellite #<NUM>. The CDNA computer device <NUM> also generates a security policy for that algorithm to use in monitoring the ISL connection <NUM> to satellite #<NUM>. The security policies can include information, such as, but not limited to, when a user is supposed to connect, how long they will connect, the MOD/COD of the connection <NUM>, the data rate of the connection <NUM>, the demand over the connection <NUM> will be for a defined number of flows, information about those flows, such as packet sizes, how the application is transmitting those packets, arrival times, protocols (if available) and the like. All of that information is compiled on a per connection <NUM> basis. The CDNA computer device <NUM> determines which algorithm to run on satellite #<NUM> for the ISL connection <NUM> and generates a security policy for satellite #<NUM>'s algorithm to monitor the ISL connection <NUM>. The algorithms and security policies executing on each satellite <NUM> may be different on different satellites <NUM> or even different ports <NUM> of the same satellite <NUM>. The CDNA computer device <NUM> selects the algorithms and security policies based on one or more attributes of the satellites in question and/or the configuration of the network <NUM>.

The CDNA computer device <NUM> ensures that the appropriate algorithms and security policies are activated on the corresponding satellites <NUM> at the correct time. In some examples, the CDNA computer device <NUM> uploads the security policies and algorithms onto the satellite <NUM> in advance, along with a schedule of active periods that instructs the satellite <NUM> when to activate each algorithm and security policy. For example, the CDNA computer device <NUM> can upload the algorithms and security policies for the first network configuration <NUM>, the second network configuration <NUM>, the third network configuration <NUM>, and the fourth network configuration <NUM>. When Time A begins, then each satellite <NUM> activates a first predetermined algorithm and security policies associated with the first network configuration <NUM>. When Time B is reached, then each satellite <NUM> deactivates the first algorithm and security policies, and activates a second predetermined algorithm and security policies associated with the second network configuration <NUM>, and so forth. In these examples, the CDNA computer device <NUM> can transmit the algorithms and security policies to the satellites well in advance of the beginning of the corresponding network configurations. Furthermore, in some examples, a network configuration can be repeated at multiple points in time. In these examples, each satellite <NUM> can store a plurality of algorithms and security policies and the CDNA computer device <NUM> can transmit a signal to the satellite <NUM> including which algorithm and security policy to activate/deactivate. In other examples, the CDNA computer device <NUM> transmits one or more of the appropriate algorithms and the security policies at the beginning of a new network configuration. While the above is stated with respect satellites <NUM>, any communication device can be used with the systems and methods describe herein. In some examples, instead of a schedule, each of the security policies includes an active time attribute, and the CDNA computer device <NUM> activates that security policy at the appropriate time.

In the example, client devices <NUM> are computers and other SDN applications that have context information about the time-varying network that include a web browser or a software application, which enables client devices <NUM> to communicate with the CDNA computer device <NUM> using the Internet, a local area network (LAN), or a wide area network (WAN). In some examples, the client devices <NUM> are communicatively coupled to the Internet through many interfaces including, but not limited to, at least one of a network, such as the Internet, a LAN, a WAN, or an integrated services digital network (ISDN), a dial-up-connection, a digital subscriber line (DSL), a cellular phone connection, a satellite connection, and a cable modem. Client devices <NUM> can be any device capable of accessing a network, such as the Internet, including, but not limited to, a desktop computer, a laptop computer, a personal digital assistant (PDA), a cellular phone, a smartphone, a tablet, a phablet, or other web-based connectable equipment. In at least one example, one or more client devices <NUM> include a web browser that can be used to output information to the CDNA computer device <NUM>, such as to provide context information about one or more configurations of the network <NUM>. In some examples, the client devices <NUM> monitor or control the path of a satellite <NUM> and provide information about the satellite <NUM>. In other examples, the client devices <NUM> facilitate communication between the CDNA computer device <NUM> and one or more satellites <NUM>.

The CDNA computer device <NUM> includes at least one application executing on the CDNA computer device <NUM> to perform the network analysis. The application includes information about the satellites <NUM> and the user devices <NUM> in the network <NUM> and is able to determine which algorithms and which security policies to use to with which satellites <NUM> to monitor the data flows of the computer network <NUM>. The application can be provided as a cloud-based web-service over the Internet or other network.

A database server <NUM> is communicatively coupled to a database <NUM> that stores data. In one example, the database <NUM> includes a plurality of satellite communication attributes, a plurality of attributes of algorithms, a plurality of security policy information, and additional information about user devices <NUM>. In some examples, the database <NUM> is stored remotely from the CDNA computer device <NUM>. In some examples, the database <NUM> is decentralized. In the example, a person can access the database <NUM> via the client device <NUM> by logging onto CDNA computer device <NUM>.

In the example, algorithm controllers <NUM> are systems, such as the packet switch <NUM> (shown in <FIG>) that can execute algorithms and security policies to monitor communications <NUM> on ports <NUM> (both shown in <FIG>). In the example, the algorithm controllers <NUM> are in communication with the CDNA computer device <NUM> to receive signals about which algorithms and security policies to use when. In the example, the algorithm controllers <NUM> can communicate with the CDNA computer device <NUM> over ISL connections <NUM> and DL connections <NUM>. The algorithm controllers <NUM> can also provide information to the CDNA computer device <NUM>, user devices <NUM> (shown in <FIG>), Security Information and Event Management (SIEM) systems, or other client devices <NUM> about detected potential malicious data flows or other deviations from the security policies. In other examples, the algorithms could be executed in a centralized location, where a computer device at the centralized location monitors communications (i.e., data flows) in the network <NUM> and reviews those communications in view of the appropriate security policies. Algorithm controllers <NUM> can be a part of satellites <NUM> or user devices <NUM>, where connections <NUM> over ports <NUM> are available to be monitored.

At a high level, the algorithm is executing on an FPGA or other processor that is a part of the algorithm controllers <NUM>. The algorithm generates data, such as statistical data in the form of logs. The algorithm can be collocated on a satellite <NUM> or user device <NUM> and also running on a computer device, such as a client device <NUM>. The computer device then interprets the logs. Based on the review of the algorithm's logs something may be detected. Based on detection, the algorithm controllers <NUM>, the CDNA computer device <NUM>, or other client device can notify an operations center, a security center, or take an action. Actions could include, but are not limited to, providing notifications, alerts, triggering another program, changing the topology of the network, or blocking traffic.

<FIG> illustrates an example process <NUM> for determining the context of the network <NUM> (shown in <FIG>) and using the system <NUM> (shown in <FIG>). The steps of process <NUM> can be performed by the CDNA computer device <NUM> (shown in <FIG>). The CDNA computer device <NUM> executes one or more applications to perform the steps of process <NUM>. The CDNA computer device <NUM> is in communication with one or more of the devices in the network <NUM>. The devices in the network can include, but are not limited to, satellites <NUM> (shown in <FIG>), user devices <NUM> (shown in <FIG>), client devices <NUM>, and algorithm controllers <NUM> (both shown in <FIG>).

The CDNA computer device <NUM> stores <NUM> a plurality of context information about the network <NUM> including a plurality of devices <NUM> and <NUM>. The context information can include, but is not limited to, the knowledge of the satellites <NUM> in the network <NUM> at a specific point in time, including where the satellites <NUM> are, which device <NUM> and <NUM> is connected to which, and which device <NUM> and <NUM> should be connected to which at each specific point in time, and what is the duration of each connection <NUM>. The context information can also include, but is not limited to, how the user devices <NUM> are connected to the network <NUM> and the satellites <NUM>, the types of connections <NUM> between the satellites <NUM> and between the satellites <NUM> and the user devices <NUM>, the MOD/COD (modulation and coding), the data rates, and the traffic profiles along the network <NUM> for each network configuration <NUM>, <NUM>, <NUM>, and <NUM> (shown in <FIG>, <FIG>, <FIG>, and <FIG>, respectively). In some examples, the CDNA computer device <NUM> receives the context information from one or more client devices <NUM>. In other examples, the CDNA computer device <NUM> receives at least a portion of the context information from the user devices <NUM> themselves, such as when a user device <NUM> connects to an ad-hoc network <NUM>. In some examples, all of the connections <NUM> and <NUM> (both shown in <FIG>) are known in advance. In other examples, one or more user devices <NUM> can connect to the network <NUM> on an ad-hoc basis. In these examples, the new user device <NUM> negotiates a connection <NUM> to the network <NUM>. The new user device's information is passed to the CDNA computer device <NUM>, which generates a new security policy for the new user device <NUM> and for the devices <NUM> and <NUM> that have connections <NUM> to the new user device <NUM>.

The CDNA computer device <NUM> determines <NUM> a network configuration <NUM> of the network <NUM> at a specific point in time. The network configuration <NUM> can be any one of network configurations <NUM>, <NUM>, <NUM>, and <NUM> or a new configuration, such as if a new user device <NUM> joins the second network configuration <NUM>. In some examples, the CDNA computer device <NUM> determines <NUM> the network configuration <NUM> prior to the specific point in time. In these examples, the CDNA computer device <NUM> can determine <NUM> the network configurations for a plurality of points in time based on the store information.

The CDNA computer device <NUM> generates <NUM> one or more security policies for one or more of the plurality of devices <NUM> and <NUM> in the network <NUM> based on the network configuration <NUM> and the plurality of context information. The security policies can include information, such as, but not limited to, when a user is supposed to connect, how long they will connect, the MOD/COD of the connection <NUM>, the data rate of the connection <NUM>, the demand over the connection <NUM> will be for some number of flows, information about those flows, such as packet sizes, how the application is transmitting those packets, arrival times, protocols (if available). All of that information is compiled on a per connection <NUM> basis. In some examples, the CDNA computer device <NUM> generates <NUM> a security policy for each device of the plurality of devices <NUM> and <NUM>. In other examples, the CDNA computer device <NUM> generates <NUM> a security policy for each side of a connection <NUM> involving one or more satellites <NUM>. In these examples, the CDNA computer device <NUM> generates <NUM> a security policy for each port <NUM> (shown in <FIG>) of each satellite <NUM> that will have a connection <NUM> in the network configuration <NUM>. In further examples, the CDNA computer device <NUM> generates <NUM> a security policy for each port <NUM> of each device <NUM> and <NUM> that will have a connection <NUM> in the network configuration <NUM>.

In further examples, for the network configuration <NUM>, the CDNA computer device <NUM> determines which algorithm to use for monitoring each connection <NUM> and generates a security policy to configure the algorithm for each of those connections <NUM>. For example, in the first network configuration <NUM>, the CDNA computer device <NUM> determines which algorithm to run on satellite #<NUM> for the ISL connection <NUM> to satellite <NUM>. The CDNA computer device <NUM> also generates a security policy for that algorithm to use in monitoring the ISL connection <NUM> to satellite #<NUM>.

The CDNA computer device <NUM> deploys <NUM> the one or more security policies to the one or more devices <NUM> and <NUM> in the network <NUM>. The one or more devices <NUM> and <NUM> are configured to execute an algorithm to monitor communications on the network <NUM> in view of the corresponding security policy.

The CDNA computer device <NUM> repeats Steps <NUM>-<NUM> of Process <NUM> for each network configuration based on the times where the network configuration will be active. As devices <NUM> and <NUM> are added and/or removed from the network <NUM>, the network configuration will change and the CDNA computer device <NUM> will perform process <NUM> to determine the appropriate security policy and/or algorithm for each device <NUM> and <NUM> in the computer network <NUM> at that point in time.

The CDNA computer device <NUM> receives <NUM> an indication of a potential malicious traffic flow from an algorithm executing a security policy. The algorithm controller <NUM> executes the appropriate algorithm and security policy to monitor communications along its connection <NUM>. If the data on that connection violates the connection <NUM> in a way that the algorithm judges to be a malicious data flow, then the algorithm controller <NUM> notifies the CDNA computer device <NUM>, one or more client devices <NUM>, other security monitoring devices, activates a program to respond to the detected malicious data flow, or blocks the connection <NUM>, depending on the configuration of system <NUM>. In some examples, the CDNA computer device <NUM> routes the indication to the appropriate destination, such as, but not limited to a Security Information and Event Management (SIEM) system.

The CDNA computer device <NUM> determines <NUM> a first network configuration <NUM> at a first time. The CDNA computer device <NUM> generates <NUM> and deploys <NUM> the one or more security policies for that first network configuration <NUM>. The CDNA computer device <NUM> can also determine <NUM> a second network configuration <NUM> for the network <NUM> at a second time. The CDNA computer device <NUM> generates <NUM> one or more additional security policies for the one or more devices <NUM> and <NUM> in the network <NUM> based on the second network configuration <NUM> and the plurality of context information. The CDNA computer device <NUM> then deploys <NUM> the one or more additional security policies to the one or more devices <NUM> and <NUM> in the network <NUM>. When the topology of the network <NUM> changes to the second network configuration <NUM> at the second time, the one or more additional security policies are activated.

The CDNA computer device <NUM> also determines the algorithm to execute on the device <NUM> and <NUM>. Each device <NUM> and <NUM> can execute multiple different algorithms as different algorithms can be more effective for different connections <NUM>. For example, the algorithm for an ISL connection <NUM> can be different than a DL connection <NUM> as the expected communications, types of communications, and make-up of the communications can all be different between the two types of connections. Furthermore, the ISL connections <NUM> between satellites <NUM> at the same orbit may require different algorithms than those between different orbits. And the different orbits may also require different algorithms between those in the same orbit. Furthermore, the algorithms to monitor different types of communications may also be different.

The CDNA computer device <NUM> determines a first algorithm to execute on a first device <NUM> of the plurality of devices <NUM> at the specific point in time. The CDNA computer device <NUM> generates a first security policy for the first algorithm and the first device <NUM> at the specific point in time. The CDNA computer device <NUM> deploys the first algorithm and the first security policy to the first device <NUM>. The CDNA computer device <NUM> determines a second algorithm to execute on the first device <NUM> at a subsequent point in time. The CDNA computer device <NUM> generates a second security policy for the second algorithm and the first device <NUM> at the subsequent point in time. The CDNA computer device <NUM> deploys the second algorithm and the second security policy to the first device <NUM>. In some examples, the first device <NUM> stores the first algorithm, the first security policy, the second algorithm, and the second security policy. The CDNA computer device <NUM> transmits a signal to the first device to execute the first algorithm and the first security policy at the specific point in time. The CDNA computer device <NUM> transmits another signal to the first device to execute the second algorithm and the second security policy at the subsequent point in time.

In some examples where the device <NUM> and <NUM> stores one or more security policies (and one or more algorithms), the CDNA computer device <NUM> deploys <NUM> the one or more policies by transmitting each security policy (and algorithm) to the corresponding device <NUM> and <NUM> when the security policy (and algorithm) is to be activated. In other examples where the device <NUM> and <NUM> stores one or more security policies (and one or more algorithms), the CDNA computer device <NUM> deploys <NUM> the one or more policies by transmitting a signal to the corresponding device <NUM> and <NUM> when the security policy (and algorithm) is to be activated. In further examples where the device <NUM> and <NUM> stores one or more security policies (and one or more algorithms), the CDNA computer device <NUM> can also transmit a script to the corresponding device <NUM> and <NUM>. The script comprises the times of when each algorithm and security policy is to be activated. The device <NUM> and <NUM> activates the corresponding algorithm and security policy based on the script. For example, the script can include all of the algorithms and security policies to be used during a day, hour, or other period of time, where the CDNA computer device <NUM> is capable of executing process <NUM> in advance to set-up the network <NUM>.

In some examples, ad-hoc networks can also be accommodated, where the CDNA computer device <NUM> receives updated network configuration data for the network <NUM>. The CDNA computer device <NUM> generates at least one updated security policy based on the updated network configuration data. The CDNA computer device <NUM> deploys the at least one updated security policy to the appropriate device <NUM> and <NUM>. For example, the CDNA computer device <NUM> can determine the algorithms and security policies for a period of time and upload that information the devices <NUM> and <NUM>. However, a new device can be added to the network <NUM>, or the CDNA computer device <NUM> learns about a change to one of the devices <NUM> and <NUM> in a configuration <NUM>. In these cases, the CDNA computer device <NUM> can update the network configuration <NUM> and the corresponding algorithms and security policies.

<FIG> illustrates an example configuration of a user computer device <NUM> such as the client device <NUM> used in the CDNA system <NUM> (both shown in <FIG>), in accordance with one example of the present disclosure. User computer device <NUM> is operated by a user <NUM>. The user computer device <NUM> can include, but is not limited to, satellites <NUM> (shown in <FIG>), user devices <NUM> (shown in <FIG>), the client device <NUM>, and the algorithm controller <NUM> (both shown in <FIG>). The user computer device <NUM> includes a processor <NUM> for executing instructions. In some examples, executable instructions are stored in a memory area <NUM>. The processor <NUM> can include one or more processing units (e.g., in a multi-core configuration). The memory area <NUM> is any device allowing information such as executable instructions and/or transaction data to be stored and retrieved. The memory area <NUM> can include one or more computer-readable media.

The user computer device <NUM> also includes at least one media output component <NUM> for presenting information to the user <NUM>. The media output component <NUM> is any component capable of conveying information to the user <NUM>. In some examples, the media output component <NUM> includes an output adapter (not shown) such as a video adapter and/or an audio adapter. An output adapter is operatively coupled to the processor <NUM> and operatively coupleable to an output device such as a display device (e.g., a cathode ray tube (CRT), liquid crystal display (LCD), light emitting diode (LED) display, or "electronic ink" display) or an audio output device (e.g., a speaker or headphones). In some examples, the media output component <NUM> is configured to present a graphical user interface (e.g., a web browser and/or a client application) to the user <NUM>. A graphical user interface can include, for example, an interface for viewing the context information about a network <NUM> (shown in <FIG>). In some examples, the user computer device <NUM> includes an input device <NUM> for receiving input from the user <NUM>. The user <NUM> can use the input device <NUM> to, without limitation, input context information or network configuration information. The input device <NUM> can include, for example, a keyboard, a pointing device, a mouse, a stylus, a touch sensitive panel (e.g., a touch pad or a touch screen), a gyroscope, an accelerometer, a position detector, a biometric input device, and/or an audio input device. A single component such as a touch screen can function as both an output device of the media output component <NUM> and the input device <NUM>.

The user computer device <NUM> can also include a communication interface <NUM>, communicatively coupled to a remote device such as the CDNA computer device <NUM> (shown in <FIG>). The communication interface <NUM> can include, for example, a wired or wireless network adapter and/or a wireless data transceiver for use with a mobile telecommunications network.

Stored in the memory area <NUM> are, for example, computer-readable instructions for providing a user interface to the user <NUM> via the media output component <NUM> and, optionally, receiving and processing input from the input device <NUM>. A user interface can include, among other possibilities, a web browser and/or a client application. Web browsers enable users, such as the user <NUM>, to display and interact with media and other information typically embedded on a web page or a website from the CDNA computer device <NUM>. A client application allows the user <NUM> to interact with, for example, the CDNA computer device <NUM>. For example, instructions can be stored by a cloud service, and the output of the execution of the instructions sent to the media output component <NUM>.

The processor <NUM> executes computer-executable instructions for implementing aspects of the disclosure.

<FIG> illustrates an example configuration of a server computer device <NUM> used in the CDNA system <NUM> (shown in <FIG>), in accordance with one example of the present disclosure. Server computer device <NUM> can include, but is not limited to, the CDNA computer device <NUM> and the database server <NUM> (both shown in <FIG>). The server computer device <NUM> also includes a processor <NUM> for executing instructions. Instructions can be stored in a memory area <NUM>. The processor <NUM> can include one or more processing units (e.g., in a multi-core configuration).

The processor <NUM> is operatively coupled to a communication interface <NUM> such that the server computer device <NUM> is capable of communicating with a remote device such as another server computer device <NUM>, another CDNA computer device <NUM>, or the client device <NUM> (shown in <FIG>). For example, the communication interface <NUM> can receive requests from the client device <NUM> via the Internet, as illustrated in <FIG>.

The processor <NUM> can also be operatively coupled to a storage device <NUM>. The storage device <NUM> is any computer-operated hardware suitable for storing and/or retrieving data, such as, but not limited to, data associated with the database <NUM> (shown in <FIG>). In some examples, the storage device <NUM> is integrated in the server computer device <NUM>. For example, the server computer device <NUM> can include one or more hard disk drives as the storage device <NUM>. In other examples, the storage device <NUM> is external to the server computer device <NUM> and can be accessed by a plurality of server computer devices <NUM>. For example, the storage device <NUM> can include a storage area network (SAN), a network attached storage (NAS) system, and/or multiple storage units such as hard disks and/or solid state disks in a redundant array of inexpensive disks (RAID) configuration.

In some examples, the processor <NUM> is operatively coupled to the storage device <NUM> via a storage interface <NUM>. The storage interface <NUM> is any component capable of providing the processor <NUM> with access to the storage device <NUM>. The storage interface <NUM> can include, for example, an Advanced Technology Attachment (ATA) adapter, a Serial ATA (SATA) adapter, a Small Computer System Interface (SCSI) adapter, a RAID controller, a SAN adapter, a network adapter, and/or any component providing the processor <NUM> with access to the storage device <NUM>.

The processor <NUM> executes computer-executable instructions for implementing aspects of the disclosure. In some examples, the processor <NUM> is transformed into a special purpose microprocessor by executing computer-executable instructions or by otherwise being programmed. For example, the processor <NUM> is programmed with instructions such as those shown in <FIG>.

As used herein, a processor can include any programmable system including systems using micro-controllers; reduced instruction set circuits (RISC), application-specific integrated circuits (ASICs), logic circuits, and any other circuit or processor capable of executing the functions described herein. The above examples are example only, and are thus not intended to limit in any way the definition and/or meaning of the term "processor.

As used herein, the term "cybersecurity threat" includes an unauthorized attempt to gain access to a subject system. Cybersecurity threats, also known as cyber-attacks or cyber-threats, attempt to breach computer systems by taking advantage of vulnerabilities in the computer systems. Some cybersecurity threats include attempts to damage or disrupt a subject system. These cybersecurity threats can include, but are not limited to, active intrusions, spyware, malware, viruses, and worms. Cybersecurity threats can take many paths (also known as attack paths) to breach a system. These paths can include operating system attacks, misconfiguration attacks, application level attacks, and shrink wrap code attacks. Cybersecurity threats can be introduced by individuals or systems directly accessing a computing device, remotely via a communications network or connected system, or through an associated supply chain.

As used herein, the term "database" can refer to either a body of data, a relational database management system (RDBMS), or to both. As used herein, a database can include any collection of data including hierarchical databases, relational databases, flat file databases, object-relational databases, object-oriented databases, and any other structured collection of records or data that is stored in a computer system. The above examples are example only, and thus are not intended to limit in any way the definition and/or meaning of the term database. Examples of RDBMS' include, but are not limited to including, Oracle® Database, MySQL, IBM® DB2, Microsoft® SQL Server, Sybase®, and PostgreSQL. However, any database can be used that enables the systems and methods described herein. (Oracle is a registered trademark of Oracle Corporation, Redwood Shores, California; IBM is a registered trademark of International Business Machines Corporation, Armonk, New York; Microsoft is a registered trademark of Microsoft Corporation, Redmond, Washington; and Sybase is a registered trademark of Sybase, Dublin, California.

In another example, a computer program is provided, and the program is embodied on a computer-readable medium. In an example, the system is executed on a single computer system, without requiring a connection to a server computer. In a further example, the system is being run in a Windows® environment (Windows is a registered trademark of Microsoft Corporation, Redmond, Washington). In yet another example, the system is run on a mainframe environment and a UNIX® server environment (UNIX is a registered trademark of X/Open Company Limited located in Reading, Berkshire, United Kingdom). In a further example, the system is run on an iOS® environment (iOS is a registered trademark of Cisco Systems, Inc. located in San Jose, CA). In yet a further example, the system is run on a Mac OS® environment (Mac OS is a registered trademark of Apple Inc. located in Cupertino, CA). In still yet a further example, the system is run on Android® OS (Android is a registered trademark of Google, Inc. of Mountain View, CA). In another example, the system is run on Linux® OS (Linux is a registered trademark of Linus Torvalds of Boston, MA). The application is flexible and designed to run in various different environments without compromising any major functionality.

Furthermore, references to "example" or "one example" of the present disclosure are not intended to be interpreted as excluding the existence of additional examples that also incorporate the recited features. Further, to the extent that terms "includes," "including," "has," "contains," and variants thereof are used herein, such terms are intended to be inclusive in a manner similar to the term "comprises" as an open transition word without precluding any additional or other elements.

As used herein, the terms "software" and "firmware" are interchangeable, and include any computer program stored in memory for execution by a processor, including RAM memory, ROM memory, EPROM memory, EEPROM memory, and non-volatile RAM (NVRAM) memory. The above memory types are example only, and are thus not limiting as to the types of memory usable for storage of a computer program.

Furthermore, as used herein, the term "real-time" refers to at least one of the time of occurrence of the associated events, the time of measurement and collection of predetermined data, the time to process the data, and the time of a system response to the events and the environment. In the examples described herein, these activities and events occur substantially instantaneously.

The methods and system described herein may be implemented using computer programming or engineering techniques including computer software, firmware, hardware, or any combination or subset. As disclosed above, at least one technical problem with prior systems is that there is a need for systems for monitoring communication networks, where the networks change over time. The system and methods described herein address that technical problem. Additionally, at least one of the technical solutions to the technical problems provided by this system can include: (i) improved accuracy in monitoring communications over the network, (ii) reduced chance of false positive based on included context information for analysis; (iii) inclusion of all applicable data in communication performance analysis; (iv) up-to-date analysis of communication performance; and (v) accurate integration of information about all of the devices on the network.

The methods and systems described herein can be implemented using computer programming or engineering techniques including computer software, firmware, hardware, or any combination or subset thereof, wherein the technical effects can be achieved by performing at least one of the following steps: a) store a plurality of context information about the network including a plurality of devices, wherein the one or more devices of the plurality of devices are satellites, wherein each device of the plurality of devices is configured to execute an algorithm and a security policy for each connected port of the device; b) determine a network configuration of the network at a specific point in time, wherein the specific point in time is a first specific time, wherein the network configuration is a first network configuration; c) generate one or more security policies for one or more devices of the plurality of devices in the network based on the network configuration and the plurality of context information; d) deploy the one or more security policies to the one or more devices in the network, wherein the one or more devices are configured to execute an algorithm to monitor communications on the network in view of a corresponding security policy of the one or more security policies; e) receive an indication of a potential malicious traffic flow from the algorithm; f) determine a second network configuration for the network at a second specific time; g) generate one or more additional security policies for the one or more devices in the network based on the second network configuration and the plurality of context information; h) deploy the one or more additional security policies to the one or more devices in the network, wherein a topology of the network changes at the second specific time; i) determine a first algorithm to execute on a first device of the plurality of devices at the specific point in time; j) generate a first security policy for the first algorithm and the first device at the specific point in time; k) deploy the first algorithm and the first security policy to the first device; <NUM>) transmit a signal to the first device to execute the first algorithm and the first security policy, m) determine a second algorithm to execute on the first device at a subsequent point in time; n) generate a second security policy for the second algorithm and the first device at the subsequent point in time; o) deploy the second algorithm and the second security policy to the first device; p) receive updated network configuration data for the network; q) generate at least one updated security policy based on the updated network configuration data; r) deploy the at least one updated security policy; s) transmit each security policy to the corresponding device when the security policy is to be activated; t) deploy the one or more policies the at least one processor is further programmed to transmit a signal to the corresponding device when the security policy is to be activated, wherein each device of the plurality of devices stores the one or more security policies; and u) transmit a schedule to the corresponding device, wherein the schedule comprises activation time periods during which each security policy is to be activated, wherein each device of the plurality of devices stores the one or more security policies, and wherein the device is configured to activate the corresponding security policy based on the schedule.

In some further examples, the technical effects can also be achieved by performing at least one of the following steps: a) store a plurality of security policies, at least one algorithm, and a schedule, wherein the plurality of security policies are based on at least one configuration of the network; b) determine a security policy of the plurality of security policies and an algorithm of the at least one algorithm to be active based on the schedule and a first point in time; c) activate the algorithm and the security policy, wherein the security policy configures the algorithm; and d) monitor message traffic on at least one port based on the algorithm and the security policy; e) determine a second security policy of the plurality of security policies to be active based on the schedule and a second point in time, wherein the algorithm is a first algorithm and the security policy is a first security policy; f) activate the first algorithm and the second security policy, wherein the second security policy configures the first algorithm; and g) monitor message traffic on at least one port based on the first algorithm and the second security policy.

The computer-implemented methods discussed herein can include additional, less, or alternate actions, including those discussed elsewhere herein. The methods can be implemented via one or more local or remote processors, transceivers, servers, and/or sensors (such as processors, transceivers, servers, and/or sensors mounted on vehicles or mobile devices, or associated with smart infrastructure or remote servers), and/or via computer-executable instructions stored on non-transitory computer-readable media or medium. Additionally, the computer systems discussed herein can include additional, less, or alternate functionality, including that discussed elsewhere herein. The computer systems discussed herein can include or be implemented via computer-executable instructions stored on non-transitory computer-readable media or medium. As used herein, the term "non-transitory computer-readable media" is intended to be representative of any tangible computer-based device implemented in any method or technology for short-term and long-term storage of information, such as, computer-readable instructions, data structures, program modules and sub-modules, or other data in any device. Therefore, the methods described herein can be encoded as executable instructions embodied in a tangible, non-transitory, computer readable medium, including, without limitation, a storage device and/or a memory device. Such instructions, when executed by a processor, cause the processor to perform at least a portion of the methods described herein. Moreover, as used herein, the term "non-transitory computer-readable media" includes all tangible, computer-readable media, including, without limitation, non-transitory computer storage devices, including, without limitation, volatile and nonvolatile media, and removable and non-removable media such as a firmware, physical and virtual storage, CD-ROMs, DVDs, and any other digital source such as a network or the Internet, as well as yet to be developed digital means, with the sole exception being a transitory, propagating signal.

Claim 1:
A Communication Device Network Analyzer, CDNA, system (<NUM>) for detecting malicious traffic flows in a network (<NUM>), the CDNA system (<NUM>) comprising a computer device (<NUM>) including at least one processor (<NUM>) in communication with at least one memory area (<NUM>), wherein the at least one processor (<NUM>) is programmed to:
store a plurality of context information about the network (<NUM>) including a plurality of satellites (<NUM>);
repeat the following steps for each network configuration (<NUM>) based on the times where the network configuration (<NUM>) will be active:
• determine a network configuration (<NUM>) of the network (<NUM>) at a specific point in time;
• generate one or more security policies for one or more satellites (<NUM>) of the plurality of satellites (<NUM>) in the network (<NUM>) based on the network configuration (<NUM>) and the plurality of context information; and
• deploy the one or more security policies to the one or more satellites (<NUM>) in the network (<NUM>),
wherein the one or more satellites (<NUM>) are configured to execute an algorithm to monitor communications on the network (<NUM>) in view of a corresponding security policy of the one or more security policies.