Solana Networks Inc.

Cavesson Software LLC

Rupinder Singh Makkar

Biswajit Nandy

Nabil Seddigh

Peter Steven Pieda

Kevin Wong

Hassan Halabian

Ioannis Lambadaris

Donald William Arthur Bennett

Sabeel Ansari

Craig Dillabaugh

Systems and methods for discovery and mapping of industrial control and SCADA networks are described herein. The disclosed systems and methods help operators ensure the cyber security of their SCADA network through accurate discovery, fingerprinting and mapping the industrial control network map, including PLCs (Programmable Logic Controller) and RTUs (Remote Terminal Unit), using passive techniques.

Method and system for discovery and mapping of a network topology

Disclosed is a methodto be used on collected network data flowassociated with a network; the methodincludes: an anomaly-detection operationincluding: (A) obtaining the collected network data flow; and (B) performing an iterative principal component analysis on the collected network data flowto detect an anomaly associated with the collected network data flow. The method may be used in a server and a network, and may also be implemented as a non-transitory computer-readable media. A corresponding system for detecting the anomaly in the network flow data is also provided.

Detection of anomaly in network flow data

A real-time network-analysis system comprises a network appliance and a plurality of management devices. The network appliance continuously monitors an object network and synthesizes a current network image comprising contemporaneous indicators of connectivity, occupancy, and performance of the object network. A management-client device may gain access to the network image for timely control and for use in producing long-term network-evolution plans. To enable the creation of a real-time network image, optimized topology synthesis algorithms are devised to minimize the computational effort. The real-time network-analysis system is adapted for use with an object network employing a variety of routing protocols, such as link-state protocols, and network-management protocols, such as the Simple-Network-Management protocol.

Real-time network analyzer

Methods and apparatus for topology discovery of a network having heterogeneous network devices are disclosed. A network appliance communicates with the network devices to acquire device descriptors and characterize the network devices accordingly. Topology discovery is based on device characteristics, media-access data, and encoded connectivity patterns, where each connectivity pattern is defined by devices of specific device types and respective media-access data. A topology deduction module of the network appliance synthesizes a network image starting with unconnected devices and progressively incorporating detected connectivity patterns.

Method and system for network topology discovery

An alert system for a communications network has a plurality of client devices and a plurality of alert servers each adapted to provide alerts to a respective subset of the client devices to provide scalability. Users at the client devices subscribe to receive alerts by selecting a scope of distribution of alerts. The selection involves selecting a type of alert to receive, a level of severity of alerts to receive, and a geographic scope. In response to receiving a request to issue an alert, an alert server notifies the other alert servers of the alert. Each alert server determines which client devices of the respective subset of client devices are to receive the alert. Each alert server then sends an alert message to its client devices that are to receive the alert.

Growing community of inventors

Kanata, Canada

Rupinder Singh Makkar