Aircraft Network Sandbox for Suspicious Activity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity protections and intrusion detection systems for aircraft networks are inadequate as they lack granularity and real-time monitoring capabilities, failing to detect and track attack chains effectively due to their static nature and inability to handle time-sensitive communications.
Innovation Solution
Implementing a sandbox network that simulates the aircraft network, allowing for the generation and analysis of network traffic to identify and route suspicious activity, enabling real-time monitoring and adaptive threat detection across zones, and providing a controlled environment for forensic analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If static tables with specific dataflows are used for security protection, then security measures can be predefined, but the system lacks granularity and cannot dynamically detect or track exploits
Solution Approach 1:
The patent creates a sandbox network that is a copy of the aircraft network, including sandbox nodes that correspond to aircraft nodes and sandbox links that correspond to aircraft links. This copy allows dynamic analysis of suspicious activity without affecting the real network, enabling granular detection while maintaining manageable complexity through isolation.
Solution Approach 2:
The sandbox network acts as an intermediary between the aircraft network and analysis systems. Suspicious activity is routed through this intermediary environment, allowing dynamic tracking and analysis of attack chains without direct intervention in the production network, thus balancing adaptability with operational simplicity.
2Reliability
If heuristic and signature based detection methods are used, then security detection can be performed, but attack chains that start off valid are not caught and time-sensitive communications are not handled properly
Solution Approach 1:
The system pre-establishes the sandbox network with all necessary nodes, links, and simulation configurations before suspicious activity occurs. This preliminary preparation allows the system to immediately route and analyze time-sensitive suspicious activity without setup delays, improving both detection reliability and response time.
Solution Approach 2:
The sandbox network continuously monitors and analyzes suspicious activity as it traverses through the simulated environment. This continuous analysis ensures that attack chains are tracked from initiation through completion, maintaining high detection reliability while processing time-sensitive communications without interruption or delay.
3Measurement precision
If a sandbox network with complete simulation is created, then detailed forensic analysis is possible, but the system complexity and resource requirements increase
Solution Approach 1:
The sandbox network implements local quality by creating sandbox nodes that correspond to specific aircraft nodes and sandbox links that correspond to specific aircraft links. This localized simulation approach provides sufficient forensic precision for analyzing suspicious activity while avoiding the complexity of simulating every single network element, allowing selective detailed analysis where needed.
Data Source
AI summary
An aircraft includes an aircraft network having nodes and links and a sandbox network in communication with the aircraft network. The sandbox network simulates the aircraft network and includes sandbox nodes corresponding to the nodes of the aircraft network, a first set of sandbox links corresponding to the links of the aircraft network, and a second set of sandbox links providing communication between sandbox nodes not in communication via the first set of sandbox links. Computer executable instructions, when executed, perform the steps of: generating network traffic over the sandbox network such that the sandbox network models a behavior of the aircraft network; identifying a suspicious activity on the aircraft network; routing the suspicious activity from the aircraft network to the sandbox network; and analyzing the suspicious activity as the suspicious activity traverses through the sandbox network.