# US 10,320,629 B2 · Illicit route viewing system and method of operation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,629 B2
- Document ID: US10320629B2
- Status: Granted
- Kind: B2
- Application number: 15/130,418
- Filed: 2016-04-15
- Published: 2016-10-20
- Granted: 2019-06-11
- Earliest claimed: 2015-04-17
- Assignees: Level 3 Communications, LLC
- Applicants: Level 3 Communications, LLC
- Inventors: Michael Benjamin; Skyler J. Bingham; John S. Reynolds
- Web page: https://patentgrep.com/patent/US10320629B2

## CPC

- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 41/18: Delegation of network management function, e.g. customer network management [CNM]
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/12: Network monitoring probes
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A route viewing system includes a computing system that receives information associated with one or more routes through a network, and identifies the routes that are associated with at least one illicit user computer used by an illicit user. The computing system then obtains a source location of a source address of the routes and a destination location of a destination address of the routes, and displays the routes on a geographical display at the source location of the source address and the destination location of the destination address of each of the routes.

## Claims

### Claim 1

A route viewing system comprising:
a computing system in communication with a network service computing device and comprising at least one memory for storing instructions that are executed by at least one processor to;
receive information associated with one or more routes through a network;
identify the routes that are associated with at least one illicit user computer used by an illicit user;
obtain a source location of a source address of the routes associated with at least one illicit user computer and a destination location of a destination address of the routes associated with at least one illicit user computer;
display the routes on a geographical display showing the source location of the source address and the destination location of the destination address of each of the routes;
monitor communication across the routes associated with at least one illicit user computer; and
filter the identified routes according to one or more weighting values associated with one or more characteristics of the route, wherein the characteristics of the route include at least one of a type of malicious behavior associated with the route, the illicit user associated with the route, and a geographical region associated with the route.

### Claim 2 (depends on 1)

The system of claim 1, wherein the instructions are further executed to display each of the routes with an indicium based upon a specified type of the route.

### Claim 3 (depends on 1)

The system of claim 1, wherein the instructions are further executed to obtain the source location of the source address and the destination location of the destination address by obtaining latitude and longitude information associated with the source address and the destination address stored in the at least one memory.

### Claim 4 (depends on 1)

The system of claim 1, wherein the instructions are further executed to display the routes that have existed during a time window comprising a range of time in the past.

### Claim 5 (depends on 4)

The system of claim 4, wherein the instructions are further executed to receive user input for modifying a duration of the time window and an amount of time from the present.

### Claim 6 (depends on 1)

The system of claim 1, wherein the instructions are further executed to:
identify the routes that are associated with each of a plurality of illicit user computers used by a corresponding plurality of illicit users;
authorize a user to view the routes of a subset of the illicit users; and
display the routes on one of a plurality of geographical displays according to the authorization.

### Claim 7 (depends on 1)

The system of claim 1, wherein the instructions are further executed to receive information associated with routes using network flow packets obtained from a tap, the tap comprising a netflow exporter.

### Claim 8

A route viewing method comprising:
receiving, using instructions stored in at least one memory and executed by at least one processor, information associated with one or more routes through a network;
identifying, using the instructions, the routes that are associated with at least one illicit user computer used by an illicit user;
obtaining, using the instructions, a source location of a source address of the routes associated with at least one illicit user computer and a destination location of a destination address of the routes associated with at least one illicit user computer;
displaying, using the instructions, the routes on a geographical display showing the source location of the source address and the destination location of the destination address of each of the routes;
monitoring communication across the routes associated with at least one illicit user computer; and
filtering the identified routes according to one or more weighting values associated with one or more characteristics of the route, wherein the characteristics of the route include at least one of a type of malicious behavior associated with the route, the illicit user associated with the route, and a geographical region associated with the route.

### Claim 9 (depends on 8)

The method of claim 8, further comprising displaying each of the routes with an indicium based upon a specified type of the route.

### Claim 10 (depends on 8)

The method of claim 8, further comprising obtaining the source location of the source address and the destination location of the destination address by obtaining latitude and longitude information associated with the source address and the destination address stored in the at least one memory.

### Claim 11 (depends on 8)

The method of claim 8, further comprising displaying the routes that have existed during a time window comprising a range of time in the past.

### Claim 12 (depends on 11)

The method of claim 11, further comprising receiving user input for modifying a duration of the time window and an amount of time from the present.

### Claim 13 (depends on 8)

The method of claim 8, further comprising:
identifying the routes that are associated with each of a plurality of illicit user computers used by a corresponding plurality of illicit users;
authorizing a user to view the routes of a subset of the illicit users; and
displaying the routes on one of a plurality of geographical displays according to the authorization.

### Claim 14 (depends on 8)

The method of claim 8, further comprising receiving information associated with routes using network flow packets obtained from a tap, the tap comprising a netflow exporter.

### Claim 15

Code implemented in a non-transitory, computer readable medium that when executed by at least one processor, is operable to perform at least the following:
receiving information associated with one or more routes through a network;
identifying the routes that are associated with at least one illicit user computer used by an illicit user;
obtaining a source location of a source address of the routes associated with at least one illicit user computer and a destination location of a destination address of the routes associated with at least one illicit user computer;
displaying the routes on a geographical display showing the source location of the source address and the destination location of the destination address of each of the routes;
monitoring communication across the routes associated with at least one illicit user computer; and
filtering the identified routes according to one or more weighting values associated with one or more characteristics of the route, wherein the characteristics of the route include at least one of a type of malicious behavior associated with the route, the illicit user associated with the route, and a geographical region associated with the route.

### Claim 16 (depends on 15)

The code of claim 15, further operable to perform obtaining the source location of the source address and the destination location of the destination address by obtaining latitude and longitude information associated with the source address and the destination address stored in the at least one memory.