# US 8,474,008 B2 · Methods and devices for managing events linked to the security of the computer systems of aircraft

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,474,008 B2
- Document ID: US8474008B2
- Status: Granted
- Kind: B2
- Application number: 12/731,364
- Filed: 2010-03-25
- Published: 2010-10-07
- Granted: 2013-06-25
- Earliest claimed: 2009-04-06
- Assignees: Airbus Operations GmbH
- Applicants: Bertrand Leconte; Raphael Migliasso
- Inventors: Bertrand Leconte; Raphael Migliasso
- Web page: https://patentgrep.com/patent/US8474008B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/554: {involving event detection and direct action}
- H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The invention in particular has as an object methods and devices for management of events linked to the security of aircraft computer systems. After having received at least one information item relating to the detection (110) of at least one event, the latter is characterized (125) according to at least one rule of a plurality of predetermined rules, that can be updated, to allow the establishment of a security report according to the said characterization of the said at least one detected event. The said at least one event advantageously is detected according to a set of predetermined events, the said set of predetermined events being updated according to a previously detected event.

## Claims

### Claim 1

A computer implemented method for management of events linked to security of at least one computer system of an aircraft, comprising:
receiving information items relating to detection of a plurality of events;
characterizing the plurality of detected events according to a set of rules of a plurality of predetermined rules, the set comprising several rules of different nature, making it possible to identify events requiring a further analysis, the detected events characterized based on a flight phase during which each event was detected; and,
drawing up a security report according to the characterization of the plurality of detected events, the security report comprising at least two parts, one of the at least two parts being specific to the information items linked to the events requiring a special analysis, the security report grouping events based on the flight phase during which each event was detected.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising:
updating the plurality of rules according to a previously detected event.

### Claim 3 (depends on 1, 2)

The method according to claim 1 or claim 2, further comprising:
detecting the plurality of events, the plurality of events being detected according to a set of predetermined events, the set of predetermined events being updated according to a previously detected event.

### Claim 4 (depends on 1)

The method according to claim 1, further comprising:
analyzing the security report.

### Claim 5 (depends on 4)

The method according to claim 4, further comprising:
determining at least one new rule in response to the analysis of the security report, the plurality of predetermined rules being updated according to the at least one new rule determined.

### Claim 6 (depends on 4)

The method according to claim 4, further comprising:
verifying and validating at least one information item of the security report.

### Claim 7 (depends on 1)

The method according to claim 1, further comprising:
inserting in the security report at least one indication relating to a context associated with at least one detected event.

### Claim 8 (depends on 1)

The method according to claim 1, further comprising:
updating the definition of the aircraft.

### Claim 9 (depends on 1)

A device comprising:
means for the implementation of each of the steps of the method according to claim 1.

### Claim 10 (depends on 1)

A non-transitory computer readable medium encoded with a program comprising instructions adapted for the implementation of the method according to claim 1 when the program is run on a computer.