# US 2019/0377906 A1 · Aeronautical cybersecurity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0377906 A1 - Document ID: US20190377906A1 - Status: Published application - Kind: A1 - Application number: 16/434,585 - Filed: 2019-06-07 - Published: 2019-12-12 - Earliest claimed: 2018-06-07 - Applicants: Thales - Inventors: Dominique RIVIERE; Philippe BERTHE; Nathalie FEYT - Web page: https://patentgrep.com/patent/US20190377906A1 ## CPC - G06F 21/71: to assure secure computing or processing of information - H04L 63/14: {for detecting or protecting against malicious traffic} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04W 12/12: Detection or prevention of fraud - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for managing the security of an aircraft with a view to ensuring the aeronautical safety thereof are provided. A method can include identifying one or more security anomalies as a function of one or more processes applied to records collected and/or received. Different objects are handled, notably security anomalies, qualified alerts, cyberattacks, etc. Reference data can be accumulated, consolidated and learned over time. The flight of an aircraft is compared to the knowledge base thus constituted and enriched. Developments describe the scope of avionics security, the use of flight phases, the triggering of comparisons, the granularity of the request system, data processing including heuristics, statistical analyses on an aircraft or a fleet of aircraft. Software and architectural aspects are described (centralized, decentralized or distributed processors). ## Claims ### Claim 1 A method for managing the security of an aircraft, including the following steps: actively collecting and/or passively receiving records associated with the aircraft, identifying one or more security anomalies as a function of one or more processes applied to said records. ### Claim 2 (depends on 1) The method according to claim 1, also including a step wherein one or more cyberattacks are identified as a function of one or more security anomalies. ### Claim 3 (depends on 1) The method according to claim 1, also including a step wherein one or more alerts are issued. ### Claim 4 (depends on 1) The method according to claim 1, wherein the processing step includes one or more of the following steps: constitute and maintain reference data, compare each record collected with said reference data. ### Claim 5 (depends on 4) The method according to claim 4, wherein the reference data includes descriptions or metadata or tags or labels associated with flight records to enable non-ambiguous imputation of a security anomaly to an on-board device. ### Claim 6 (depends on 5) The method according to claim 5, wherein said non-ambiguous imputation is effected during a predefined operating phase or a predefined flight phase. ### Claim 7 (depends on 4) The method according to claim 4, wherein one or more reference data are modified by machine learning. ### Claim 8 (depends on 4) The method according to claim 4, wherein the reference data include data associated with one or more information points including the registration of an aircraft, an aircraft type, a flight number, the identification of a flight, a time date expressed as year, month, day, hour, minute or second, a time interval, a flight time, an aeronautical service, a flight segment, an IATA code of the departure and/or arrival airport and/or the presence of at least one specific hardware device on board. ### Claim 9 (depends on 1) The method according to claim 1, wherein a process is carried out on a record to compare said flight record with the reference data. ### Claim 10 (depends on 9) The method according to claim 9, wherein the comparison step is triggered on demand from the ground and/or as a function of a flight context. ### Claim 11 (depends on 1) The method according to claim 1, wherein a process involves carrying out a comparative statistical analysis of the data collected with the reference data. ### Claim 12 (depends on 11) The method according to claim 11, wherein said comparative statistical analysis is carried out for a given aircraft. ### Claim 13 (depends on 11) The method according to claim 11, wherein said comparative statistical analysis is carried out for several aircraft. ### Claim 14 (depends on 1) The method according to claim 1, wherein one or more of the records collected and/or received are associated with one or more aircraft. ### Claim 15 (depends on 1) The method according to claim 1, also including a step in which feedback regarding any one of the steps in the preceding claims is received. ### Claim 16 (depends on 1) A computer program product, said computer program including code instructions enabling the steps of the method according to claim 1 to be carried out when said program is run on a computer. ### Claim 17 A system for managing the security of an aircraft, wherein the system comprises one or more processors configured to actively collect and/or passively receive records associated with the aircraft, identifying one or more security anomalies as a function of one or more processes applied to said records. ### Claim 18 (depends on 17) The system according to claim 17, wherein the plurality of processors is arranged using a centralized or decentralized or distributed architecture.