Back to results
US 2023/0156032 A1Published application
Non-Disruptive Diagnostic and Attack Testing Methods and Systems
AssigneeMazebolt Technologies Ltd.
InventorMatthew Andriani
Life of this patent
Estimating the term…
Abstract
Testing methods and systems provide a Diagnostic Testing Service as well as an attack simulation service, for a perimeter security system, in a non-disruptive manner, so that the production targets can be tested while normally functioning, and do not have to be brought down for testing. The testing methods can be implemented, such that they are vendor and device type neutral, considering the overall strategy utilized to prevent perimeter security system attacks.
Claims76
A method for testing comprising:
- (a) configuring a coordination device in communication with a production network, the production network including at least one production service, the production network interfacing with an external network at a perimeter of the production network, the at least one production service downstream from the external network, and a perimeter security system (PSS) for mitigating multiple threats upstream from the at least one production service;
- (b) receiving, by the coordination device, pre-attack notification information, the pre-attack notification information including:
- one or more types of attacks to be launched against the at least one production service;
- and
- (c) collecting, by the coordination device, operation data corresponding to the traffic sent to the at least one production service, the traffic which has at least partially traversed the perimeter security system (PSS) during an attack, where the attack is based on the one or more types of attacks of the received pre-attack notification information, and the collecting during the attack based on the one or more types of attacks of the received pre-attack notification information.
2 more elements
A method for testing a mirror port for communication with a coordination device, the mirror port along either an external network or a production network, the method comprising:
- receiving, by the coordination device, pre-diagnostic notification information, the pre-diagnostic notification information including:
- test diagnostic traffic to be used for the testing of the coordination device and its at least one associated mirror port, the test diagnostic traffic including at least one of:
- a number of the packets and/or certain data within the packets of the test diagnostic traffic, and the time when the test diagnostic traffic will be transmitted to at least one production service along the production network;
- the at least one mirror port providing a copy of the test diagnostic traffic to the coordination device, corresponding to the time that the test diagnostic traffic was transmitted to the at least one production service, for which the test diagnostic traffic traversed at least one of the external network or the production network, towards the at least one production service;
- and
- analyzing at least one of:
- the number of packets and/or the certain data within the packets, in the copied test diagnostic traffic, as provided in the pre-diagnostic notification information received by the coordination device, to determine operational status of the mirror port.
4 more elements
A method for determining the route of an attack into a production network, the production network including at least one production service, from at least two network segments, including at least one external network segment, comprising:
- (a) configuring one or more coordination devices for communication with at least two of the network segments, each of the at least two network segments communicating with:
- 1) a production network, and 2) a perimeter security system (PSS), the perimeter security system upstream from the at least one production service;
- (b) receiving, by the one or more coordination devices, pre-attack notification information, the pre-attack notification information including:
- one or more types of attacks for launching along any one or more of the at least two network segments, and targeting the at least one production service;
- and
- (c) collecting, by the one or more coordination devices, operation data corresponding to traffic sent along at least one of the network segments towards the at least one production service and the operation data having at least partially traversed the perimeter security system (PSS) during an attack based on the one or more types of attacks of the received pre-attack notification information, and the collecting during the attack based on the one or more types of attacks based on the received pre-attack notification information.
3 more elements
A method for testing depth of penetration for perimeter security of a network, comprising:
- (a) configuring at least one coordination device for communication with at least two points of-at least one network, the at least one network including at least one production service, and a perimeter security system (PSS) for mitigating multiple threats upstream from the at least one production service;
- (b) receiving, by the at least one coordination device, pre-attack notification information, the pre-attack notification information including:
- one or more types of attacks to be launched against the at least one production service;
- (c) collecting, by the at least one coordination device, operation data which has at least partially traversed the perimeter security system (PSS) during an attack of the one or more attack types in the received pre-attack notification information, and the collecting from the at least two points, based on the attack of the one or more attack types from the pre-attack notification information;
- and
- (d) analyzing the operation data collected by the at least one coordination device from the at least two points of the at least one network, for one or more of:
- packet leakage and/or the certain data within the packets, to determine one or more of:
- the downstream depth of penetration through the PSS towards the at least one production service by the attack, or, the effectiveness of one or more of the components of the perimeter security system (PSS).
5 more elements
A system for testing comprising:
- a coordination device configured for communicating with a network, the coordination device including:
- a receiver for receiving pre-attack notification information via the network, the pre-attack notification information including:
- one or more types of attacks to be launched;
- and
- a collector for collecting operation data corresponding to traffic of an attack on the network which has at least partially traversed a Perimeter Security System (PSS), which was sent to a downstream target on the network, the traffic sent to the network based on the pre-attack notification information, and the collecting is during the attack on the network based on the pre-attack notification information.
2 more elements
Dependencies are inferred from the claim text.