System and method for context aware cybersecurity

Abstract

To provide a system that detects malicious traffic flows, a method, and a program.SOLUTION: A communication satellite system includes a processor in communication with a memory device. The processor is programmed to store multiple pieces of context information about a network including a plurality of devices. The processor is also programmed to determine a network configuration of the network at a specific point in time. The processor is further programmed to generate one or more security policies for one or more devices of the plurality of devices in the network based on the network configuration and the multiple pieces of context information. In addition, the processor is programmed to deploy the one or more security policies to the one or more devices in the network. The one or more devices are configured to monitor communications on the network in view of a corresponding security policy of the one or more security policies.SELECTED DRAWING: Figure 8

Description

Background Art

[0001] This field generally relates to intrusion detection, and more specifically to detecting malicious traffic flows in known controlled and constantly changing environments.

[0002] Communication systems (including communication satellites) can be targets of malicious actors. Detecting an intrusion by such a malicious actor can be difficult. This is because it may not be practical to monitor all communications between a satellite and other communication systems, as the configurations and topologies of devices and networks can constantly change over time. Therefore, it would be advantageous to have additional security or systems that improve the detection capabilities of communication systems.

[0003] This "Background Art" section is for introducing readers to various aspects of the technical field that may be related to various aspects of the present disclosure, and the description and / or claims of the present disclosure are made below. This description section is considered useful in providing readers with background technical information to facilitate a deeper understanding of various aspects of the present disclosure. Therefore, it should be understood that these descriptions should be read from this perspective and not as admissions of prior art.

Summary of the Invention

[0004] In one embodiment, a system is provided for detecting malicious traffic flows in a network. This system includes a computer system including at least one processor that communicates with at least one memory device. This at least one processor is programmed to store multiple contextual pieces of information about a network including multiple devices. The at least one processor is also programmed to determine the network configuration of the network at a particular point in time. The at least one processor is further programmed to generate one or more security policies for one or more of the multiple devices in the network based on the network configuration and the multiple contextual pieces of information. In addition, the at least one processor is programmed to deploy one or more security policies to one or more devices in the network. One or more devices are configured to monitor communications on the network by executing algorithms based on the corresponding security policy among the one or more security policies.

[0005] In another embodiment, a method is provided for detecting malicious traffic flows in a network. This method is implemented by a computer system including at least one processor communicating with at least one memory device. The method includes storing multiple contextual information about a network including multiple devices. The method also includes determining the network configuration of the network at a particular point in time. The method further includes generating one or more security policies for one or more of the multiple devices in the network based on the network configuration and the multiple contextual information. In addition, the method includes deploying one or more security policies to one or more devices in the network. One or more devices are configured to run algorithms to monitor communications on the network, taking into account the corresponding security policy among the one or more security policies.

[0006] Various improvements exist to the features described in relation to the embodiments described above. Further features may also be incorporated into the embodiments described above. Such improvements and further features may exist individually or in some combination. For example, the various features described later in relation to any of the examples provided may be incorporated into any of the embodiments described above, either individually or in some combination.

[0007] The figures described below depict various aspects of the systems and methods disclosed therein. Each figure should be understood as illustrating an example of a particular aspect of the disclosed systems and methods, and is intended to correspond to a feasible example of such an aspect. Furthermore, the following explanations refer to the reference numerals included in the figures below whenever possible, and in these figures, features described in multiple figures are referred to by the same reference numeral.

[0008] While the diagrams presented here illustrate the configuration, please understand that the examples in this book are not strictly limited to the configurations and instruments shown in the following diagrams. [Brief explanation of the drawing]

[0009] [Figure 1] An example block diagram of an exemplary communications satellite system is shown in this disclosure. [Figure 2] Figure 1 shows a block diagram of the exemplary network in the first network configuration, which includes the exemplary communications satellite system shown. [Figure 3] Figure 2 shows a block diagram illustrating the transition from the first network configuration to the second network configuration. [Figure 4] Figure 3 shows a block diagram illustrating the transition from the second network configuration to the third network configuration. [Figure 5] Figure 4 shows a block diagram illustrating the transition from the third network configuration to the Nth network configuration. [Figure 6]Figure 2 shows block diagrams illustrating the transitions between the network configurations shown in Figures 2, 3, 4, and 5, respectively. [Figure 7] An example of this disclosure is shown in Figure 2, which presents a simplified block diagram of an exemplary communications device network analyzer (CDNA) system for setting the context of the network shown. [Figure 8] This illustrates an exemplary process for determining the context of the network shown in Figure 2, using the system shown in Figure 7. [Figure 9] An example configuration of a user computer device (such as a client device used in the system shown in Figure 7) is shown in this disclosure. [Figure 10] Figure 7 shows an exemplary configuration of a server computer device used in the system shown in this disclosure. [Modes for carrying out the invention]

[0010] This field generally relates to breach detection, and more specifically, to detecting malicious traffic flows in known, controlled, and constantly changing environments by analyzing the configuration and topology of time-varying networks. For example, a Communications Device Network Analyzer (CDNA) computer device determines a communications network based on the time and available communications devices, and generates and implements one or more policies for the communications devices on such a communications network to analyze communications on the network for potential cybersecurity threats.

[0011] The systems and methods of this disclosure include a software-defined network architecture (SDN) system for controlling and managing one or more security algorithms using available contextual information about the network, network topology, user information, connection attributes, and / or request attributes to detect malicious traffic flows. Contextual information may include an SDN network architecture for a time-varying satellite topology. Contextual information may also include complete knowledge and control of satellites in a particular constellation at a particular point in time (including where the satellites are located, which satellites are connected to which other devices, and which devices should be connected to which other devices for how long at a particular point in time). Contextual information may further include, but is not limited to, knowledge of how users are connected, the type of connection between satellites and between satellites and users, MOD / COD (modulation and coding, where coding refers to FEC (forward error correction) overhead), data rate, and / or traffic profile (what types of traffic users and / or devices are expected to generate).

[0012] The exemplary systems and methods determine that contextual information may be used in a timely manner with respect to a given topology to create and deploy security policies. Contextual information may be provided, collected, calculated, and / or any matched combination thereof may be performed by an SDN application. Such an SDN application may include, but is not limited to, a traffic engineering manager, topology manager, user manager, etc. Furthermore, with respect to a set of known future topologies, the SDN application may use the available contextual information to predetermine which algorithm to use and precalculate one or more security policies for such known future topologies. If the algorithm and security policies are properly prepared, the SDN application may use this algorithm to monitor data flow information based on the corresponding security policies in order to monitor and detect malicious traffic flows.

[0013] A CDNA system is configured to acquire and / or store information about topology, network, and users (i.e., connections and requests, etc.) at multiple points in time. For example, a CDNA system can determine what the topology should be, where devices are located, how devices are connected, and how devices should be connected. This is particularly effective in situations where network devices are controlled by a strict schedule (e.g., satellites). In such situations, the CDNA system will determine, based on the schedule, where devices should be located and how they should be connected. Because CDNA is familiar with the network and connections, it can determine the best algorithms and security policies for monitoring connections on each side of a connection between two communication devices.

[0014] The exemplary systems and methods acknowledge that the topology and configuration of networks, particularly those involving mobile communication devices (including, but not limited to, satellites, aircraft, ships, spacecraft, vehicles, drones, and / or those associated with humans), can change over time. The systems and methods described herein address the security issues of such variable networks by generating and providing security policies that are updated in a timely manner based on the current network topology. Updated security policies are also provided when the network topology changes. By setting security policies for communication devices, algorithms (e.g., those running on the communication devices) can determine when such security policies are being violated (which may indicate a cybersecurity threat, such as a cyber breach, the presence of malicious code, and / or another threat).

[0015] This book describes computer systems (e.g., CDNA computer devices and related computer systems). As described in this book, such computer systems include processors and memory. However, any processors within computer devices referred to in this book may refer to one or more processors, and a processor may reside in one computing device or in multiple computing devices operating in parallel. In addition, any memory within computer devices referred to in this book may refer to one or more memory, and a memory may reside in one computing device or in multiple computing devices operating in parallel.

[0016] The systems and processes described in this book are not limited to the specific examples provided. Furthermore, each system component and process can be implemented independently and may be separate from other components and processes described in this book. Each component and process may also be used in combination with other assembly packages and processes.

[0017] Figure 1 shows a block diagram of an exemplary communications satellite system 100 according to an example of the present disclosure. The exemplary satellite system 100 includes a network processor 102, a storage unit 104, and a payload processor 106, all connected to an Ethernet switch 108. The Ethernet switch 108 is further connected to one or more bus controllers 110, which facilitate communication with the satellite bus subsystem 112 and a packet switch 114. In some examples, the packet switch 114 is a secure, programmable data plane, which enables the execution of algorithms for monitoring a number of ports 116 used for communication connections 118 with the satellite 100. The number of ports 116 may include, but are not limited to, an interstellar link (ISL), a downlink (DL), and a port 116 that can function as either an ILS or DL.

[0018] Figure 2 shows a block diagram of an exemplary network 200 in a first network configuration 202, which includes an exemplary communications satellite system 100 (see Figure 1). Network 200 includes multiple satellites 100. As illustrated in the first network configuration 202, the multiple satellites 100 are in multiple orbits (e.g., geostationary Earth orbit (GEO) 204, medium Earth orbit (MEO) 206, and low Earth orbit (LEO) 208). Network 200 may also include satellites 100 in non-geostationary (NGSO) orbits around celestial bodies, such as highly elliptical orbits, lunar orbits, or any other (where their connectivity and location are known and / or predictable).

[0019] Network 200 includes a plurality of user devices 210. The user devices 210 can include aircraft, spacecraft, ships, ground-based vehicles, ground stations, and / or space stations (when the user devices 210 are connected to the network 200).

[0020] As shown in the first network configuration 202, each of the satellites 100 has one or more ISL connections 212. There are also DL connections 214 from the user devices 210 to the satellites 100. Each DL connection 214 connects the user device 210 on the network 200 and the satellite 100 (although not shown as fully connected in the figure).

[0021] Due to the characteristics of the satellites 100, different satellites 100 orbit the Earth at different speeds. For example, the satellites 100 within the network configuration 202 at time A will be different from those at time B. For example, the satellites 100 on LEO 208 orbit the Earth in 90 - 120 minutes, while the satellites 100 on MEO 206 may take 12 hours to complete one orbit. This means that the satellites 100 constituting the network 200 change over time. Therefore, knowing when the network configuration 202 of the network 200 changes is important for properly securing and monitoring the network 200.

[0022] Figures 3 through 6 show network 200 transitioning from one configuration to another over time. FIG. 3 shows a block diagram of transition 300 from the first network configuration 202 to the second network configuration 302. In transition 300, the ISL connection 212 between satellite #4 and satellite #7 ends, and a new ISL connection 212 is created between satellite 5 and satellite 8. FIG. 4 shows a block diagram of transition 400 from the second network configuration 302 to the third network configuration 402. In transition 400, satellites #4, #5, and #6 are replaced by satellites #10, #11, and #12. The ISL connection 212 between satellite #5 and satellite #8 is replaced by an ISL connection 212 between satellite #11 and satellite #8. Further, the ISL connection 212 between satellite #6 and satellite #3 is replaced by an ISL connection 212 between satellite #12 and satellite #3. FIG. 5 shows a block diagram of transition 500 from the third network configuration 402 to the Nth network configuration 502 (where, for example, N is the largest of any integer greater than 1). In the third network configuration 402, the ISL connection 212 between the satellite 100 on GEO 204 and the satellite 100 on MEO 206 is between satellite #1 and satellite #4.

[0023] Each of network configurations 202, 302, 402, and 502 represents network 200 at different points in time. FIG. 6 shows a block diagram of the transitions of network 200 (see FIG. 2) between network configurations 202, 302, 402, and 502 (shown in FIGS. 2, 3, 4, and 5 respectively). Only four network configurations 202, 302, 402, and 502 are shown, but there are multiple different network configurations possible as network 200. Each of the different network configurations may include different ISL connections 212 between satellites 100 and may include different DL connections 214 between the satellites 100 on network 200 and user devices 210 (and also between other satellites 100 and user devices 210).

[0024] Figure 7 shows a simplified block diagram of an exemplary Communications Device Network Analyzer (CDNA) system 700 for setting the context of network 200 (see Figure 2) according to an example of the present disclosure. In this example, the CDNA system 700 or an SDN application is used to control the computation of algorithms for monitoring the configuration of network 200 and for monitoring communications of satellite 100 (see Figure 1) and other devices on network 200. The algorithms monitor communications on network 200 for malicious data flows that may indicate cybersecurity threats and attacks, enabling other systems to respond to identified and detected cybersecurity threats and attacks.

[0025] The CDNA system 700 includes multiple client devices 705 that communicate with a Communication Device Network Analyzer (CDNA) computer device 710. The CDNA computer device 710 communicates with a database server 715 to read data from the database 720 and to store the data in the database 720. The CDNA computer device 710 also communicates with multiple algorithm controllers 725.

[0026] The CDNA computer device 710 is programmed to receive contextual information about different configurations of the computer network 200. This contextual information may, but is not limited to, knowledge about satellite 100 (see Figure 1) within the network 200 at a particular point in time (including where satellite 100 is located, which devices 100 and 210 are connected to which, which devices 100 and 210 should be connected to which at each particular point in time, and the duration of each connection 118). Contextual information may include, but is not limited to, how the user device 210 (see Figure 2) is connected to the network 200 and satellite 100, the type of connection 118 between satellites 100 and between satellite 100 and the user device 210, MOD / COD (modulation / coding: where coding refers to FEC (forward error correction) overhead), data rate, and traffic profiles along each network 200 for network configurations 202, 302, 402, and 502 (shown in Figures 2, 3, 4, and 5 respectively) (what kind of traffic the user is expected to generate). In some examples, the CDNA computer device 710 receives contextual information from one or more client devices 705. In other examples, the CDNA computer device 710 receives at least a portion of the contextual information from the user device 210 itself, for example, when the user device 210 is connected to an ad-hoc network 200. In some examples, all of the connections 212 and 214 (both see Figure 2) are known in advance. In other examples, one or more user devices 210 may be connected to the network 200 on an ad-hoc basis. In such examples, the new user device 210 negotiates a connection 118 to the network 200. Information about the new user device is sent to the CDNA computer device 710, which generates a new security policy for the new user device 210 and for devices 100 and 210 that have a connection 118 with the new user device 210.

[0027] The CDNA computer device 710 uses contextual information to determine a security policy for each side of each connection 118. In this example, the CDNA computer device 710 generates a security policy for each connection 118 on the network 200, including the satellite 100. In other examples, the CDNA computer device 710 generates a security policy for all connections 118 (including connections between user devices 210 on the network 200). The CDNA computer device 710 further determines which algorithm to use to monitor each connection 118 (if the algorithm is configured to use a security policy to monitor one or more connections 118 for malicious traffic flows). When the network 200 is configured accordingly, the CDNA computer device 710 activates the appropriate algorithm and policy.

[0028] For example, the CDNA computer device 710 determines, based on network configurations 202, 302, 402, and 502, that the first network configuration 202 is enabled from time A to time B, the second network configuration 302 is enabled from time B to time C, the third network configuration 402 is enabled from time C to time D, and the fourth network configuration 502 is enabled from time D to time E. Furthermore, the CDNA computer device 710 obtains context information for each of the network configurations 202, 302, 402, and 502. This context information may be stored in the database 720 or received from one or more client devices 705.

[0029] The CDNA computer device 710 determines which algorithm to use to monitor each connection 118 for each of the network configurations 202, 302, 402, and 502, and generates a security policy for each of these connections 118. For example, in the first network configuration 202, the CDNA computer device 710 determines which algorithm to execute on satellite #1 for the ISL connection 212 with satellite #2. The CDNA computer device 710 further generates a security policy for using that algorithm to monitor the ISL connection 212 with satellite #2. The security policy may include, but is not limited to, information such as when the user's connection is supported, how long the user will be connected, the MOD / COD of connection 118, the data rate of connection 118, whether requests via connection 118 require a specified number of flows, information about such flows (such as packet size), how the application sends such packets, arrival time, and protocol (if available). All of this information is compiled on a connection 118-by-connection basis. The CDNA computer device 710 determines which algorithm to run on satellite #2 for ISL connection 212 and generates a security policy for satellite #2's algorithm to monitor ISL connection 212. The algorithms and security policies run on each satellite 100 may differ for different satellites 100, or even for different ports 116 on the same satellite 100. The CDNA computer device 710 selects the algorithms and security policies based on one or more attributes of the target satellite and / or the configuration of network 200.

[0030] The CDNA computer device 710 ensures that the appropriate algorithms and security policies are activated on the corresponding satellite 100 at the correct time. In some examples, the CDNA computer device 710 pre-uploads the security policies and algorithms to the satellite 100, along with a schedule of activation periods that instructs the satellite 100 when to activate each of the algorithms and security policies. For example, the CDNA computer device 710 may upload multiple algorithms and security policies for a first network configuration 202, a second network configuration 302, a third network configuration 402, and a fourth network configuration 502. When time A begins, each satellite 100 activates a predetermined first algorithm and security policy associated with the first network configuration 202. When time B arrives, each satellite 100 deactivates the first algorithm and security policy and activates a predetermined second algorithm and security policy associated with the second network configuration 302, and so on. In such examples, the CDNA computer device 710 may transmit algorithms and security policies to the satellite long before the corresponding network configuration is initiated. Furthermore, in some examples, the network configuration may be repeated at multiple points in time. In such examples, each satellite 100 may store multiple algorithms and security policies, and the CDNA computer device 710 may transmit signals to the satellite 100 indicating which algorithms and security policies to activate / deactivate. In other examples, the CDNA computer device 710 transmits one or more of the preferred algorithms and security policies at the initiation of a new network configuration. Although the above description relates to satellite 100, any communication device may be used in conjunction with the systems and methods described herein. In some examples, each security policy includes an activation attribute instead of a schedule, and the CDNA computer device 710 activates that security policy at a suitable time.

[0031] In this example, client device 705 is a computer and other SDN application that has contextual information about a time-varying network, and includes a web browser or software application that enables client device 705 to communicate with CDNA computer device 710 using the Internet, a local area network (LAN), or a wide area network (WAN). In some examples, client device 705 is communicably connected to the Internet through a number of interfaces, including but not limited to at least one of the following: a network (such as the Internet, LAN, WAN, or Integrated Services Digital Network (ISDN)), a dial-up connection, a digital subscriber line (DSL), a cellular connection, a satellite connection, and a cable modem. Client device 705 can be any device capable of accessing a network (such as the Internet), including but not limited to a desktop computer, a laptop computer, a personal digital assistant (PDA), a mobile phone, a smartphone, a tablet, a phablet, or other web-based connectable device. In at least one example, one or more client devices 705 include a web browser, which may be used to output information to the CDNA computer device 710, for example, to provide contextual information about one or more configurations of the network 200. In some examples, the client device 705 monitors or controls the path of satellite 100 and provides information about satellite 100. In other examples, the client device 705 facilitates communication between the CDNA computer device 710 and one or more satellites 100.

[0032] The CDNA computer device 710 includes at least one application that runs on the CDNA computer device 710 to perform network analysis. This application includes information about satellites 100 and user devices 210 within the network 200 and can determine which algorithms and security policies are used for which satellites 100 in order to monitor the data flow of the computer network 200. The application may be provided as a cloud-based web service via the internet or other network.

[0033] The database server 715 is communicatively connected to the database 720, which stores the data. In one example, the database 720 contains multiple satellite communication attributes, multiple algorithm attributes, multiple security policy information, and additional information about the user device 210. In some examples, the database 720 is stored remotely from the CDNA computer device 710. In some examples, the database 720 is distributed. In this example, a person may access the database 720 via the client device 705 by logging into the CDNA computer device 710.

[0034] In this example, the algorithm controller 725 is a system that can execute algorithms and security policies to monitor communications 118 on port 116 (both see Figure 1), such as a packet switch 114 (see Figure 1). In this example, the algorithm controller 725 communicates with the CDNA computer device 710 to receive signals on which algorithms and security policies to use and when. In this example, the algorithm controller 725 communicates with the CDNA computer device 710 via ISL connection 212 and DL connection 214. The algorithm controller 725 may also provide information about any detected potentially malicious data flows or other deviations from security policies to the CDNA computer device 710, user device 210 (see Figure 2), Security Information and Event Management (SIEM) system, or other client devices 705. In other examples, the algorithms may be executed at a central location. At this central location, a computer device at the central location monitors communications (i.e., data flows) on network 200 and scrutinizes these communications in light of appropriate security policies. The algorithm controller 725 may be part of the satellite 100 or user device 210, which is available for monitoring the connection 118 via port 116.

[0035] At a higher level, the algorithm runs on an FPGA or other processor (which is part of the algorithm controller 725). The algorithm generates data (such as statistical data in the form of logs). The algorithm may be located on satellite 100 or user device 210, and may also run on a computer device (such as client device 705). The computer device then interprets the logs. Based on the algorithm's examination of the logs, something may be detected. The algorithm controller 725, the CDNA computer device 710, or other client devices may notify the operations center or security center or take action based on the detection. Actions may include, but are not limited to, providing notifications and warnings, triggering another program, changing the network topology, or blocking traffic.

[0036] Figure 8 shows an exemplary process 800 for determining the context of network 200 (see Figure 2) using system 700 (see Figure 7). The steps of process 800 may be performed by a CDNA computer device 710 (see Figure 7). The CDNA computer device 710 runs one or more applications to perform the steps of process 800. The CDNA computer device 710 communicates with one or more devices in network 200. The devices in the network may include, but are not limited to, satellite 100 (see Figure 1), user device 210 (see Figure 2), client device 705, and algorithm controller 725 (both see Figure 7).

[0037] The CDNA computer device 710 stores multiple contextual information about a network 200 including multiple devices 100 and 210 805. This contextual information may include, but is not limited to, knowledge about satellites 100 within the network 200 at a particular point in time (including where satellites 100 are located, which devices 100 and 210 are connected to which, which devices 100 and 210 should be connected to which at each particular point in time, and the duration of each connection 118). The contextual information may further include, but is not limited to, how user devices 210 are connected to the network 200 and satellites 100, the types of connections 118 between satellites 100 and between satellites 100 and user devices 210, MOD / COD (modulation and coding), data rates, and traffic profiles along each network 200 for network configurations 202, 302, 402, and 502 (shown in Figures 2, 3, 4, and 5, respectively). In some examples, the CDNA computer device 710 receives context information from one or more client devices 705. In other examples, the CDNA computer device 710 receives at least a portion of the context information from the user device 210 itself, for example, when the user device 210 is connected to an ad-hoc network 200. In some examples, all of the connections 212 and 214 (both see Figure 2) are known in advance. In other examples, one or more user devices 210 may connect to the network 200 on an ad-hoc basis. In such examples, the new user device 210 negotiates a connection 118 to the network 200. Information about the new user device is sent to the CDNA computer device 710, and the CDNA computer device 710 generates a new security policy for the new user device 210 and for devices 100 and 210 that have a connection 118 with the new user device 210.

[0038] The CDNA computer device 710 determines the network configuration 202 of network 200 at a specific point in time 810. The network configuration 202 may be any of the network configurations 202, 302, 402, and 502, or it may be a new configuration (for example, when a new user device 210 is added to the second network configuration 302). In some examples, the CDNA computer device 710 determines the network configuration 202 prior to a specific point in time 810. In such examples, the CDNA computer device 710 may determine the network configurations at multiple points in time 810 based on stored information.

[0039] The CDNA computer device 710 generates one or more security policies for one or more of the multiple devices 100 and 210 in network 200, based on the network configuration 202 and multiple contextual information 815. The security policies may include, but are not limited to, information such as when a user connection is supported, how long the user will be connected, the MOD / COD of connection 118, the data rate of connection 118, how many flows a request over connection 118 requires, information about such flows (such as packet size), how the application sends such packets, arrival time, and protocol (if available). All of this information is compiled on a connection 118 basis. In some examples, the CDNA computer device 710 generates a security policy for each of the multiple devices 100 and 210 815. In other examples, the CDNA computer device 710 generates a security policy for each side of connection 118 with one or more satellites 100 815. In such an example, the CDNA computer device 710 generates a security policy for each port 116 (see Figure 1) of each satellite 100 that will have a connection 118 in the network configuration 202. In a further example, the CDNA computer device 710 generates a security policy for each port 116 of devices 100 and 210 that will have a connection 118 in the network configuration 202.

[0040] In a further example, the CDNA computer device 710 determines which algorithm to use to monitor each connection 188 for a network configuration 202 and generates a security policy to configure the algorithm for each of such connections 118. For example, in a first network configuration 202, the CDNA computer device 710 determines which algorithm to run on the ISL connection 212 with satellite 2 on satellite #1. The CDNA computer device 710 further generates a security policy to use this algorithm to monitor the ISL connection 212 with satellite #2.

[0041] The CDNA computer device 710 deploys one or more security policies to one or more devices 100 and 210 in network 200. One or more devices 100 and 210 are configured to run algorithms based on the corresponding security policies and monitor communications on network 200.

[0042] For each network configuration, the CDNA computer device 710 repeats steps 810-820 of process 800 based on the time that network configuration is operational. When devices 100 and 210 are added to and / or removed from network 200, the network configuration changes, and the CDNA computer device 710 performs process 800 to determine a suitable security policy and / or algorithm for each of devices 100 and 210 in the computer network at that time.

[0043] The CDNA computer device 710 receives indications from the algorithm of potentially malicious traffic flows while executing security policies 825. The algorithm controller 725 executes appropriate algorithms and security policies to monitor communications on its connection 118. If the data for such connection violates connection 118 in a manner that the algorithm determines to be a malicious data flow, the algorithm controller 725, depending on the configuration of the system 700, either notifies the CDNA computer device 710, one or more client devices 705, or other security monitoring devices, activates a program to respond to the detected malicious data flow, or blocks connection 118. In some examples, the CDNA computer device 710 routes the indications to an appropriate destination (e.g., a Security Information and Event Management (SIEM) system, but not limited to one).

[0044] The CDNA computer device 710 determines the first network configuration 202 in a first time period 810. The CDNA computer device 710 generates and deploys one or more security policies 815 for the first network configuration 202 820. The CDNA computer device 710 may also determine the second network configuration 302 of network 200 in a second time period 810. Based on the second network configuration 302 and multiple contextual information, the CDNA computer device 710 generates one or more additional security policies for one or more devices 100 and 210 in network 200 815. The CDNA computer device 710 then deploys one or more additional security policies to one or more devices 100 and 210 in network 200 820. When the topology of network 200 changes to the second network configuration 302 in a second time period, one or more additional security policies are activated.

[0045] The CDNA computer device 710 further determines the algorithms to be executed on devices 100 and 210. Since different algorithms may be more effective for different connections 118, multiple different algorithms may be executed on each of devices 100 and 210. For example, the algorithm for ISL connection 212 may be different from that for DL ​​connection 214, because the expected communication, the type of communication, and the configuration of the communication may all be different between these two types of communication. Furthermore, an ISL connection 212 between satellites 100 in the same orbit may require a different algorithm than an ISL connection between different orbits. Moreover, a different algorithm may be required for different orbits than for satellites in the same orbit. Furthermore, different algorithms may be used to monitor different types of communication.

[0046] The CDNA computer device 710 determines a first algorithm to be executed on the first device 100 among a plurality of devices 100 at a specific point in time. The CDNA computer device 710 generates a first security policy for the first algorithm and the first device 100 at this specific point in time. The CDNA computer device 710 deploys the first algorithm and the first security policy to the first device 100. The CDNA computer device 710 determines a second algorithm to be executed on the first device 100 at a subsequent point in time. The CDNA computer device 710 generates a second security policy for the second algorithm and the first device 100 at this subsequent point in time. The CDNA computer device 710 deploys the second algorithm and the second security policy to the first device 100. In some examples, the first device 100 stores the first algorithm, the first security policy, the second algorithm, and the second security policy. The CDNA computer device 710 sends a signal to the first device to execute the first algorithm and the first security policy at a specific point in time. The CDNA computer device 710 sends another signal to the first device in order to execute the second algorithm and the second security policy at a subsequent point in time.

[0047] In some examples where devices 100 and 210 store one or more security policies (and one or more algorithms), CDNA computer device 710 deploys such one or more policies by sending each of the security policies (and algorithms) to the corresponding devices 100 and 210 when the security policies (and algorithms) should be activated. In another example where devices 100 and 210 store one or more security policies (and one or more algorithms), CDNA computer device 710 deploys such one or more policies by sending signals to the corresponding devices 100 and 210 when the security policies (and algorithms) should be activated. In a further example where devices 100 and 210 store one or more security policies (and one or more algorithms), CDNA computer device 710 may also send scripts to the corresponding devices 100 and 210. These scripts include the times when each algorithm and security policy should be activated. Devices 100 and 210 activate the corresponding algorithms and security policies based on the scripts. For example, the script may include all algorithms and security policies to be used during a day, an hour, or any other period during which the CDNA computer device 710 is able to execute process 800, before network 200 is configured.

[0048] In some cases, ad-hoc networks may also be accepted, in which case the CDNA computer device 710 receives updated network configuration data for network 200 and generates at least one updated security policy based on the updated network configuration data. The CDNA computer device 710 then deploys this at least one updated security policy to suitable devices 100 and 210. For example, the CDNA computer device 710 may determine an algorithm and security policy for a certain period and upload that information to devices 100 and 210. However, new devices may be added to network 200, or the CDNA computer device 710 may learn about changes to devices 100 and 210 in configuration 202. In such cases, the CDNA computer device 710 may update the network configuration 202 and the corresponding algorithm and security policy.

[0049] Figure 9 shows an exemplary configuration of a user computer device 902, such as a client device 705 (both see Figure 7), used in a CDNA system 700, according to an example of the present disclosure. The user computer device 902 is operated by a user 901. The user computer device 902 may include, but is not limited to, a satellite 100 (see Figure 1), a user device 210 (see Figure 2), a client device 705, and an algorithm controller 725 (both see Figure 7). The user computer device 902 includes a processor 905 for executing instructions. In some examples, executable instructions are stored in a memory area 910. The processor 905 may include one or more processing units (e.g., in a multi-core configuration). The memory area 910 is any device that allows information (e.g., executable instructions and / or transaction data) to be stored and read. The memory area 910 may include one or more computer-readable media.

[0050] The user computer device 902 also includes at least one media output component 915 for presenting information to the user 901. The media output component 915 is any component capable of conveying information to the user 901. In some examples, the media output component 915 includes an output adapter (not shown), such as a video adapter and / or an audio adapter. The output adapter is operably connected to the processor 905 and is operably connected to an output device, such as a display device (e.g., a cathode ray tube (CRT), liquid crystal display (LCD), light-emitting diode (LED) display, or "electronic ink" display) or an audio output device (e.g., a speaker or headphones). In some examples, the media output component 915 is configured to present a graphical user interface (such as a web browser and / or a client application) to the user 901. The graphical user interface may include, for example, an interface for viewing contextual information about the network 200 (see Figure 2). In some examples, the user computer device 902 includes an input device 920 for receiving input from the user 901. User 901 may use the input device 920 to input context information or network configuration information (but not limited to this purpose). The input device 920 may include, for example, a keyboard, pointing device, mouse, stylus, touch-sensitive panel (e.g., touchpad or touchscreen), gyroscope, accelerometer, position detector, biometric input device, and / or audio input device. A single component (such as a touchscreen) may function as both an output device and an input device 920 of the media output component 915.

[0051] The user computer device 902 may also include a communication interface 925 that is communicatively connected to a remote device (such as the CDNA computer device 710 shown in Figure 7). The communication interface 925 may include, for example, a wired or wireless network adapter and / or a wireless data transceiver used with a mobile communication network.

[0052] The memory area 910 stores computer-readable instructions, for example, to provide a user interface to user 901 via the media output component 915 (and optionally to receive and process input from input device 920). The user interface may include (but is not limited to) a web browser and / or a client application. The web browser allows the user (such as user 901) to view and interact with information from the media and other information from the CDNA computer device 710 (typically embedded in a web page or website). The client application allows user 901 to interact with, for example, the CDNA computer device 710. For example, instructions may be stored by a cloud service, and the output of instruction execution may be sent to the media output component 915.

[0053] The processor 905 executes computer executable instructions to implement an aspect of the present disclosure.

[0054] Figure 10 shows an exemplary configuration of a server computer device 1001 used in a CDNA system 700 (see Figure 7) according to an example of the present disclosure. The server computer device 1001 may include, but is not limited to, a CDNA computer device 710 and a database server 715 (both see Figure 7). The server computer device 1001 also includes a processor 1005 for executing instructions. Instructions may be stored in a memory area 1010. The processor 1005 may include one or more processing units (e.g., in a multi-core configuration).

[0055] By operably connecting the processor 1005 to the communication interface 1015, the server computer device 1001 becomes capable of communicating with remote devices (such as another server computer device 1001, another CDNA computer device 710, or a client device 705 (see Figure 7)). For example, the communication interface 1015 may receive requests from the client device 705 via the internet, as shown in Figure 7.

[0056] The processor 1005 may be operablely coupled to a storage device 1034. The storage device 1034 is any computer-operated hardware suitable for storing and / or reading data (for example, data associated with the database 720 shown in Figure 7, but not limited to this). In some examples, the storage device 1034 is incorporated into a server computer device 1001. For example, the server computer device 1001 may include one or more hard disk drives as the storage device 1034. In other examples, the storage device 1034 is external to the server computer device 1001 and may be accessed by multiple server computer devices 1001. For example, the storage device 1034 may include a storage network (SAN), a network-attached storage (NAS) system, and / or multiple storage units (such as hard disks and / or solid-state disks in a redundant array (RAID) configuration with inexpensive disks).

[0057] In some examples, the processor 1005 is operably coupled to the storage device 1034 via a storage interface 1020. The storage interface 1020 is an arbitrary component capable of providing the processor 1005 with access to the storage device 1034. The storage interface 1020 may include, for example, an Advanced Technology Accessory (ATA) adapter, a Serial ATA (SATA) adapter, a Small Computer System Interface (SCSI) adapter, a RAID controller, a SAN adapter, a network adapter, and / or any other component that provides the processor 1005 with access to the storage device 1034.

[0058] The processor 1005 executes computer executable instructions to implement aspects of the present disclosure. In some examples, the processor 1005 is converted into a particular-purpose microprocessor by executing computer executable instructions or by being otherwise programmed. For example, the processor 1005 is programmed with instructions as shown in Figure 8.

[0059] As used in this book, a processor may include any programmable system, including microcontrollers, reduced instruction set circuits (RISC), application-specific integrated circuits (ASICs), logic circuits, and any other circuits or systems that use a processor capable of performing the functions described herein. The above examples are illustrative and are therefore not intended to limit the definition and / or meaning of the term "processor" in any way.

[0060] As used in this book, the term "cybersecurity threat" includes any unauthorized attempt to gain access to a target system. A cybersecurity threat (also known as a cyberattack or cyber threat) is an attempt to infiltrate a computer system by exploiting its vulnerabilities. Some cybersecurity threats include attempts to damage or disrupt a target system. Such cybersecurity threats may include, but are not limited to, active breaches, spyware, malware, viruses, and worms. A cybersecurity threat can enter a system through numerous pathways (also known as attack vectors). These pathways may include operating system attacks, misconfiguration attacks, application-level attacks, and reduced-wrapping-code attacks. A cybersecurity threat can be introduced remotely through a communication network or connected system, or through the associated supply chain, by a person or system directly accessing a computing device.

[0061] As used in this book, the term “database” may refer to either the data itself, a relational database management system (RDBMS), or both. As used in this book, a database may include any collection of data, including hierarchical databases, relational databases, flat-file databases, object-relational databases, object-oriented databases, and any other structured collection of records or data stored in a computer system. The above examples are illustrative and are therefore not intended to limit the definition and / or meaning of the term “database” in any way. Examples of RDBMS include, but are not limited to, Oracle® Database, MySQL, IBM® DB2, Microsoft® SQL Server, Sybase®, and PostgreSQL. Any database that enables the systems and methods described in this book may be used. (Oracle is a registered trademark of Oracle Corporation in Redwood Shores, California; IBM is a registered trademark of International Business Machines Corporation in Armonk, New York; Microsoft is a registered trademark of Microsoft Corporation in Redmond, Washington; and Sybase is a registered trademark of Sybase in Dublin, California.)

[0062] In another example, a computer program is provided, which is implemented in computer-readable media. In one example, the system runs on a single computer system without requiring a connection to a server computer. In yet another example, the system runs in a Windows® environment (Windows is a registered trademark of Microsoft Corporation in Redmond, Washington). In yet another example, the system runs in a mainframe environment and a UNIX® server environment (UNIX is a registered trademark of X / Open Company Limited in Reading, Berkshire, UK). In yet another example, the system runs in an iOS® environment (iOS is a registered trademark of Cisco Systems, Inc. in San Jose, California). In yet another example, the system runs in a Mac OS® environment (Mac OS is a registered trademark of Apple Inc. in Cupertino, California). In yet another example, the system runs on the Android® OS (Android is a registered trademark of Google, Inc. in Mountain View, California). In another example, the system runs on the Linux® operating system (Linux is a registered trademark of Linus Torvalds of Boston, Massachusetts). The application is flexible and designed to run in a variety of different environments without compromising any key functionality.

[0063] Where used herein, elements or steps described in the singular and following the phrase “a or an” should be understood as not being subject to any exclusion of the plural form of such element or step unless explicitly stated otherwise. Furthermore, references to “example” or “one example” in this disclosure are not intended to be interpreted as excluding the existence of additional examples that similarly encompass the described features. Moreover, wherever the words “includes / including,” “has,” and “contains,” and their similar terms are used herein, such words, like the word “comprises,” are intended to be inclusive as open-transition terms that do not exclude any additional or other elements.

[0064] As used in this book, the terms “software” and “firmware” are interchangeable and include any computer program stored in memory for execution by the processor (including RAM memory, ROM memory, EPROM memory, EEPROM memory, and non-volatile RAM (NVRAM) memory). The above types of memory are illustrative and therefore not limited to the types of memory that can be used to store computer programs.

[0065] The patent claims at the end of this document are not intended to be interpreted as falling under Section 112(f) of the U.S. Patent Act unless conventional means-plus-function language is explicitly stated (for example, the phrases "means for" or "step for" are explicitly stated in the claims).

[0066] Furthermore, as used in this book, the term "real-time" refers to at least one of the following: the time when the relevant event occurs, the time when the specified data is measured and collected, the time when the data is processed, and the time when the system responds to the event and environment. In the examples described in this book, such activities and events occur substantially instantaneously.

[0067] The methods and systems described herein may be implemented using computer programming or engineering techniques (including computer software, firmware, hardware, or any combination or subset thereof). As disclosed above, at least one technical problem with prior art systems is the need for a system to monitor communication networks that change over time. The systems and methods described herein address such technical problems. In addition, at least one of the technical solutions provided by this system to such technical problems may include: (i) improved accuracy in monitoring communications over the network; (ii) reduced likelihood of false positives in analysis based on inclusion context information; (iii) inclusion of all data applicable to communication performance analysis; (iv) up-to-date communication performance analysis; and (v) accurate integration of information about all devices on the network.

[0068] The methods and systems described herein may be implemented using computer programming or engineering techniques (including computer software, firmware, hardware, or any combination or subset thereof), and their technical effects may be achieved by performing at least one of the following steps: a) storing multiple contextual information about a network including multiple devices, wherein one or more of the multiple devices are satellites, and each of the multiple devices is configured to execute algorithms and security policies for each of its connection ports; b) determining the network configuration of the network at a specific point in time, wherein this specific point in time is a first specific time, and this network configuration is a first network configuration; c) generating one or more security policies for one or more of the multiple devices in the network based on the network configuration and the multiple contextual information; d) deploying one or more security policies to one or more devices in the network, wherein one or more devices The steps are: a) deploying one or more security policies configured to run an algorithm to monitor communications on the network, taking into account the corresponding security policy among one or more security policies; f) determining a second network configuration of the network at a second specific time; g) generating one or more additional security policies for one or more devices on the network based on the second network configuration and multiple contextual information; h) deploying one or more additional security policies to one or more devices on the network, wherein the network topology changes at a second specific time; i) running on the first device among multiple devices at a specific point in time.The steps include: a) determining a first algorithm; a) generating a first security policy for the first algorithm and a first device at this particular point in time; a) deploying the first algorithm and the first security policy to the first device; a) transmitting a signal to the first device to execute the first algorithm and the first security policy; a) determining a second algorithm to be executed on the first device at a subsequent point in time; a) generating a second algorithm and a second security policy for the first device at this subsequent point in time; a) deploying a second algorithm and a second security policy to the first device; a) receiving updated network configuration data for the network; a) generating at least one updated security policy based on the updated network configuration data; a) deploying at least one updated security policy; a) transmitting each security policy to the corresponding device when it should be activated; a) deploying one or more security policies, wherein at least one processor is further programmed to transmit a signal to the corresponding device when it should be activated, and each of the multiple devices stores one or more security policies; and u) A step of sending a schedule to a corresponding device, wherein the schedule includes an activation period during which each security policy should be activated, each of a plurality of devices stores one or more security policies, and the device is configured to activate the corresponding security policy based on the schedule.

[0069] In some further examples, the technical effect may be achieved by performing at least one of the following steps: a) storing a plurality of security policies, at least one algorithm, and a schedule based on at least one network configuration; b) determining, based on the schedule and a first point in time, one security policy from the plurality of security policies and one algorithm from at least one algorithm to be activated; c) activating the algorithm and security policy, wherein the security policy sets the algorithm; d) monitoring message traffic on at least one port based on the algorithm and security policy; e) determining, based on the schedule and a second point in time, a second security policy from the plurality of security policies to be activated, wherein the algorithm is a first algorithm and the security policy is a first security policy; f) activating the first algorithm and the second security policy, wherein the second security policy sets the first algorithm; and g) monitoring message traffic on at least one port based on the first algorithm and the second security policy.

[0070] The computer implementation methods described in this document may include additional, fewer, or alternative actions (including those described elsewhere in this document). The methods may be implemented via one or more local or remote processors, transceivers, servers, and / or sensors (e.g., processors, transceivers, servers, and / or sensors mounted on a vehicle or portable device, or associated with smart infrastructure or a remote server) and / or via computer-executable instructions stored in one or more non-transient computer-readable media. In addition, the computer systems described in this document may include additional, fewer, or alternative functions (including those described elsewhere in this document). The computer systems described in this document may include, or be implemented via, computer-executable instructions stored in one or more non-transient computer-readable media.

[0071] As used in this book, the term “non-transitory computer-readable media” is intended to represent any tangible computer-based device implemented in any way or technique for short-term and long-term storage of information (e.g., computer-readable instructions, data structures, program modules and submodules, or other data in any device). Therefore, the methods described herein can be encoded as executable instructions embodied in tangible non-transitory computer-readable storage media (including, but not limited to, storage devices and / or memory devices). When executed by a processor, such instructions cause the processor to implement at least a portion of the methods described herein. Furthermore, as used in this book, the term “non-transient computer-readable media” includes all tangible computer-readable media, including, but not limited to, non-transient computer storage devices, which include, but not limited to, volatile and non-volatile media, as well as removable and non-removable media (e.g., firmware, physical and virtual storage, CD-ROMs, DVDs, and any other digital sources such as networks or the internet). Additionally, “non-transient computer-readable media” may include digital means developed in the future, with the sole exception being transient propagation signals.

[0072] Furthermore, this disclosure includes embodiments as defined below.

[0073] Article 1. A system for detecting malicious traffic flows in a network (200), comprising a computer system (710) including at least one processor (905) that communicates with at least one memory device (910), wherein the at least one processor (905) Storing multiple contextual information about a network (200) that includes multiple devices (100), To determine the network configuration (202) of the network (200) at a specific point in time, Based on the network configuration (202) and multiple contextual information, generate one or more security policies for one or more devices (100) among multiple devices (100) in the network (200), A system programmed to deploy one or more security policies to one or more devices (100) on a network (200), wherein one or more devices (100) are configured to deploy one or more security policies, such that they execute algorithms based on corresponding security policies among the one or more security policies and monitor communications on the network (200).

[0074] Article 2. The system as described in Clause 1, wherein at least one processor (905) is further programmed to receive an indication of any possible malicious traffic flows from the algorithm.

[0075] Article 3. The aforementioned specific time is a first specific time, the network configuration (202) is the first network configuration (202), and at least one processor (905) is To determine the second network configuration (302) of the network (200) at a second specific time, Based on the second network configuration (302) and multiple contextual information, one or more additional security policies are generated for one or more devices (100) in the network (200), The system described in Clause 1 or 2 is further programmed to deploy one or more additional security policies to one or more devices (100) in the network (200).

[0076] Article 4. The system described in Clause 3, in which the topology of the network (200) changes at a second specific time.

[0077] Article 5. At least one processor (905) The first algorithm is to be executed on the first device (100) among multiple devices (100) at a specific point in time, To generate a first algorithm and a first security policy for the first device (100) at this specific point in time, A system described in any one of clauses 1 to 4, further programmed to deploy the first algorithm and the first security policy to the first device (100).

[0078] Article 6. The system according to Clause 5, wherein at least one processor (905) is further programmed to transmit signals to a first device (100) in order to execute a first algorithm and a first security policy.

[0079] Article 7. At least one processor (905) The second algorithm to be executed on the first device (100) at a subsequent point in time, To generate a second algorithm and a second security policy for the first device (100) at this subsequent point in time, The system described in Clause 5 is further programmed to deploy the second algorithm and the second security policy to the first device (100).

[0080] Article 8. A system according to any one of the paragraphs 1 to 7, wherein one or more of the devices (100) are satellites (100).

[0081] Article 9. A system as described in any one of clauses 1 to 8, wherein each of the multiple devices (100) is configured to execute an algorithm and a corresponding security policy for each of the device (100)'s connection ports.

[0082] Article 10. At least one processor (905) Receiving updated network configuration (202) data for network (200), Based on the updated network configuration (202) data, generate at least one updated security policy, The system described in any one of clauses 1 through 9 is further programmed to deploy at least one updated security policy.

[0083] Article 11. The system according to any one of clauses 1 to 10, wherein at least one processor (905) is further programmed to send each security policy to the corresponding device (100) when that security policy should be activated, in order to deploy one or more security policies.

[0084] Article 12. The system according to any one of the clauses 1 to 11, wherein each of the multiple devices (100) stores one or more security policies, and at least one processor (905) is further programmed to send a signal to the corresponding device (100) when a security policy should be activated in order to deploy one or more security policies.

[0085] Article 13. The system according to any one of Clauses 1 to 12, wherein each of the multiple devices (100) stores one or more security policies, and at least one processor (905) is further programmed to send a schedule to the corresponding device (100) in order to deploy one or more security policies, the schedule includes an operating period for which each security policy should be activated, and the device (100) is configured to activate the corresponding security policy based on the schedule.

[0086] Article 14. A method implemented by a computer system (710) including at least one processor (905) that communicates with at least one memory device (910) for detecting malicious traffic flows in a network (200), Storing multiple contextual information about a network (200) that includes multiple devices (100), To determine the network configuration (202) of the network (200) at a specific point in time, Based on the network configuration (202) and multiple contextual information, generate one or more security policies for one or more devices (100) among multiple devices (100) in the network (200), A method for deploying one or more security policies to one or more devices (100) in a network (200), wherein one or more devices (100) are configured to monitor communications on the network (200) by executing algorithms based on corresponding security policies among the one or more security policies.

[0087] Article 15. The method described in Clause 14, further comprising receiving an indication of any potentially malicious traffic flows from the algorithm.

[0088] Article 16. The aforementioned specific time is a first specific time, the network configuration (202) is the first network configuration (202), and the method is To determine the second network configuration (302) of the network (200) at a second specific time, Based on the second network configuration (302) and multiple contextual information, generate one or more additional security policies for one or more devices (100) in the network (200), The method of Clause 14 or 15, further comprising deploying one or more additional security policies to one or more devices (100) in the network (200).

[0089] Article 17. The first algorithm is to be executed on the first device (100) among multiple devices (100) at a specific point in time, To generate a first algorithm and a first security policy for the first device (100) at this specific point in time, The method described in any one of the clauses 14 to 16, further comprising deploying a first algorithm and a first security policy to a first device (100).

[0090] Article 18. The method according to clause 17, further comprising transmitting a signal to a first device (100) in order to execute the first algorithm and the first security policy.

[0091] Article 19. A system for detecting malicious traffic flows in a network (200), comprising a computer system (710) including at least one processor (905) that communicates with at least one memory device (910), the at least one processor (905) communicates with multiple devices (100) in the network (200), and the at least one processor (905) The system stores multiple security policies, at least one algorithm, and a schedule based on at least one configuration of the network (200). Based on the schedule and the first point in time, determine which security policy from among multiple security policies and which algorithm from among at least one algorithm to activate. Activating an algorithm and a security policy, wherein the security policy sets the algorithm, and activating the algorithm and the security policy, A system programmed to monitor message traffic on at least one port based on algorithms and security policies.

[0092] Article 20. The algorithm is the first algorithm, the security policy is the first security policy, and at least one processor (905) is Based on the schedule and the second point in time, determine the second security policy among several security policies that should be activated, Activating the first algorithm and the second security policy, wherein the second security policy sets the first algorithm, and activating the first algorithm and the second security policy. The system described in Clause 19 is further programmed to monitor message traffic on at least one port based on the first algorithm and the second security policy.

[0093] This specification discloses various forms of execution, including the best mode, and further uses examples to enable any person skilled in the art to practice various forms of execution, including creating and using any device or system, and performing any combination of multiple methods. The patentability of this disclosure is defined by the claims and may include other examples that are conceivable to a person skilled in the art. Such other examples are intended to be included in the claims if they have structural elements that are not different from the language of the claims, or if they include equivalent structural elements that are substantially different from the language of the claims.

Claims

1. A system for detecting malicious traffic flows in a network (200), comprising: a computer system (710) including at least one processor (905) in communication with at least one memory device (910), the at least one processor (905) comprising: storing a plurality of contextual information for said network (200) including a plurality of devices (100); determining a network configuration (202) of said network (200) at a particular point in time; generating one or more security policies for one or more devices (100) of the plurality of devices (100) in the network (200) based on the network configuration (202) and the plurality of contextual information; and deploying the one or more security policies to the one or more devices (100) in the network (200), the one or more devices (100) being configured to execute an algorithm to monitor communications on the network (200) in light of a corresponding one of the one or more security policies.

2. The system of claim 1 , wherein the at least one processor (905) is further programmed to receive an indication of possible malicious traffic flows from the algorithm.

3. the particular time is a first particular time, the network configuration (202) is a first network configuration (202), and the at least one processor (905) determining a second network configuration (302) of the network (200) at a second particular time; generating one or more additional security policies for the one or more devices (100) in the network (200) based on the second network configuration (302) and the plurality of contextual information; The system of claim 1 or 2, further programmed to: deploy the one or more additional security policies to the one or more devices in the network.

4. The system of claim 3, wherein the topology of the network (200) changes at the second particular time.

5. The at least one processor (905): determining a first algorithm executed on a first device (100) of the plurality of devices (100) at the particular time; generating a first security policy for the first algorithm and the first device (100) at the particular point in time; The system of claim 1 , further programmed to: deploy the first algorithm and the first security policy to the first device (100).

6. The system described in claim 5, wherein the at least one processor (905) is further programmed to send a signal to the first device (100) to execute the first algorithm and the first security policy.

7. The at least one processor (905): determining a second algorithm to be executed on the first device (100) at a subsequent time; generating a second security policy for the second algorithm and the first device (100) at this subsequent point in time; The system of claim 5 , further programmed to: deploy the second algorithm and the second security policy to the first device (100).

8. The system of claim 1 , wherein the one or more devices (100) of the plurality of devices (100) are satellites (100).

9. The system of claim 1 , wherein each device (100) of the plurality of devices (100) is configured to execute an algorithm and a corresponding security policy for each of the connection ports of the device (100).

10. The at least one processor (905): receiving updated network configuration (202) data for said network (200); generating at least one updated security policy based on the updated network configuration (202) data; The system of claim 1 , further programmed to: deploy the at least one updated security policy.

11. 11. The system of claim 1, wherein to deploy the one or more security policies, the at least one processor (905) is further programmed to transmit each security policy to a corresponding device (100) when the security policy is to be activated.

12. Each device (100) of the plurality of devices (100) stores the one or more security policies, and to deploy the one or more security policies, the at least one processor (905) Sending a signal to the corresponding device (100) when the security policy should be activated; or 12. The system of claim 1, further programmed to at least one of: transmit a schedule to the corresponding device (100), the schedule including an activation period during which each security policy should be activated, the device (100) being configured to activate the corresponding security policy based on the schedule.

13. 1. A method for detecting malicious traffic flows in a network, the method comprising: storing a plurality of contextual information for said network (200) including a plurality of devices (100); determining a network configuration (202) of said network (200) at a particular point in time; generating one or more security policies for one or more devices (100) of the plurality of devices (100) in the network (200) based on the network configuration (202) and the plurality of contextual information; and deploying the one or more security policies to the one or more devices (100) in the network (200), the one or more devices (100) being configured to execute an algorithm to monitor communications on the network (200) in light of a corresponding one of the one or more security policies.

14. The method of claim 13 further comprising receiving an indication of possible malicious traffic flows from the algorithm.

15. the particular time is a first particular time, the network configuration (202) is a first network configuration (202), and the method comprises: determining a second network configuration (302) of the network (200) at a second particular time; generating one or more additional security policies for the one or more devices (100) in the network (200) based on the second network configuration (302) and the plurality of contextual information; 15. The method of claim 13 or 14, further comprising: deploying the one or more additional security policies to the one or more devices (100) in the network (200).

16. determining a first algorithm executed on a first device (100) of the plurality of devices (100) at the particular time; generating a first security policy for the first algorithm and the first device (100) at the particular point in time; The method of any one of claims 13 to 15, further comprising: deploying the first algorithm and the first security policy to the first device (100).

17. The method of any one of claims 13 to 16, further comprising sending a signal to the first device (100) to execute the first algorithm and the first security policy.

18. A computer program comprising computer program instructions which, when executed by a computer processor, cause the computer processor to perform a method according to any one of claims 13 to 17.

Images