Patent Document ID: 9774628
Application ID: 14829889
Patent Flag: 1

Claim One:
1. A method for analyzing a suspicious activity on an aircraft network, comprising the steps of: creating a sandbox network in communication with the aircraft network, the sandbox network simulating the aircraft network and comprising a plurality of sandbox nodes corresponding to a plurality of nodes of the aircraft network, a first set of sandbox links corresponding to a plurality of links of the aircraft network that provide communication between a subset of the plurality of nodes of the aircraft network, and a second set of sandbox links providing communication between sandbox nodes not in communication via the first set of sandbox links; generating network traffic over the sandbox network such that the sandbox network models a behavior of the aircraft network; routing the suspicious activity from the aircraft network to the sandbox network, wherein the suspicious activity originates from a node on the aircraft network or a user interface to an avionics system; and analyzing the suspicious activity as the suspicious activity traverses through the sandbox network, wherein analyzing the suspicious activity comprises collecting forensic data about the suspicious activity.