System and method for improved and effective generation and representation of a communication trust tree

Abstract

A system and method for generating and representing a communication trust tree of network nodes in a network are provided. The method includes receiving an address of a starting node in a communication tree; collecting, for each node of the communication tree extending from the starting node, a response from at least another node of the communication tree; grouping nodes based on their at least a response, wherein nodes having a same response are grouped into a group, wherein each node communication tree is associated with at least one group; and generating a communication trust tree that comprises a hierarchical tree of the generated groups.

What is claimed is: 
     
         1 . A method for generating and representing a communication trust tree of network nodes in a network, comprising:
 receiving an address of a starting node in a communication tree;   collecting, for each node of the communication tree extending from the starting node, a response from at least another node of the communication tree;   grouping nodes based on their at least a response, wherein nodes having a same response are grouped into a group, wherein each node communication tree is associated with at least one group; and   generating the communication trust tree that comprises a hierarchical tree of the generated groups.   
     
     
         2 . The method of  claim 1 , wherein collecting responses from the nodes further comprises:
 sending a name resolution request, for a communication node of the communication tree, to a first node of a plurality of nodes of the communication tree;   receiving, from the first node of the plurality of nodes, a first response directing to make the request to at least a second node of the plurality of nodes;   sending the request to the at least a second node of the plurality of nodes;   receiving, from each of the at least a second node of the plurality of nodes, a second response directing to make the request to at least a third node of the plurality of nodes;   sending the request to the at least a third node of the plurality of nodes; and   receiving, from each of the at least a third node of the plurality of nodes, a third response.   
     
     
         3 . The method of  claim 2 , wherein grouping the nodes further comprises:
 grouping nodes of the at least a second node into at least one group based on the third response received from each of the at least a third node.   
     
     
         4 . The method of  claim 1 , wherein the starting node is a root node. 
     
     
         5 . The method of  claim 1 , wherein the response is one of: an Internet Protocol (IP) address, an error message, and a refusal to respond message. 
     
     
         6 . The method of  claim 5 , wherein the refusal to respond message is declared when a node has not responded within a predefined period of time to the request. 
     
     
         7 . The method of  claim 5 , wherein a node is determined to be a threat when the received response is the error message. 
     
     
         8 . The method of  claim 5 , wherein a node is determined to be a threat when the retrieved response is the refusal to respond message. 
     
     
         9 . The method of  claim 1 , further comprising:
 displaying each group on a display based on the group's position in the hierarchical tree;   displaying communication links from groups sending requests for the responses; and   displaying a notification relevant to each group, depending on the response.   
     
     
         10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
 receiving an address of a starting node in a communication tree;   collecting, for each node of the communication tree extending from the starting node, a response from at least another node of the communication tree;   grouping nodes based on their at least a response, wherein nodes having a same response are grouped into a group, wherein each node communication tree is associated with at least one group; and   generating a communication trust tree including a hierarchical tree of the generated groups.   
     
     
         11 . A system generating and representing a communication trust tree of network nodes in a network, comprising:
 a processing circuitry; and   a network interface for interfacing to a network, the network interface communicatively connected to the processing circuitry; and   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:   receive an address of a starting node in a communication tree;   collect, for each node of the communication tree extending from the starting node, a response from at least another node of the communication tree;   group nodes based on their at least a response, wherein nodes having a same response are grouped into a group, wherein each node communication tree is associated with at least one group; and   generate a communication trust tree including a hierarchical tree of the generated groups.   
     
     
         12 . The system of  claim 11 , further comprising:
 an input/output (I/O) interface communicatively connected to the processing unit, wherein the I/O interface is adapted to connect to a display unit; and,   the memory further containing instructions for display of the trust tree on the display unit.   
     
     
         13 . The system of  claim 11 , wherein the system is further configured to:
 send a name resolution request, for a communication node of the communication tree, to a first node of a plurality of nodes of the communication tree;   receive, from the first node of the plurality of nodes, a first response directing to make the request to at least a second node of the plurality of nodes;   send the request to the at least a second node of the plurality of nodes;   receive, from each of the at least a second node of the plurality of nodes, a second response directing to make the request to at least a third node of the plurality of nodes;   send the request to the at least a third node of the plurality of nodes; and   receive, from each of the at least a third node of the plurality of nodes, a third response.   
     
     
         14 . The tree detection system of  claim 13 , wherein the system is further configured to:
 group nodes of the at least a second node into at least one group based on the third response received from each of the at least a third node.   
     
     
         15 . The tree detection system of  claim 11 , wherein the starting node is a root node. 
     
     
         16 . The tree detection system of  claim 11 , wherein the response is one of: an Internet Protocol (IP) address), an error message, a refusal to respond message. 
     
     
         17 . The tree detection system of  claim 16 , wherein the refusal to respond message is declared when a node has not responded within a predefined period of time to the request. 
     
     
         18 . The tree detection system of  claim 16 , wherein a node is determined to be a threat when the received response is the error message. 
     
     
         19 . The tree detection system of  claim 16 , wherein a node is determined to be a threat when the retrieved response is the refusal to respond message. 
     
     
         20 . A tree detection system (TDS) communicatively connected to a network to which a plurality of nodes are communicatively connected thereto, the TDS comprising:
 a processing circuitry;   a network interface for interfacing to the network, the network interface communicatively connected to the processing circuitry; and   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the TDS to:   send a name resolution request, for a communication node of the communication tree, to a first node of a plurality of nodes of the communication tree;   receive, from the first node of the plurality of nodes, a first response directing to make the request to at least a second node of the plurality of nodes;   send the request to the at least a second node of the plurality of nodes;   receive, from each of the at least a second node of the plurality of nodes, a second response directing to make the request to at least a third node of the plurality of nodes;   send the request to the at least a third node of the plurality of nodes; and   receive, from each of the at least a third node of the plurality of nodes, a third response.   group nodes of the at least a second node into at least one group based on the third response received from each of the at least a third node; and   store in memory the one or more groups of the at least second node.   
     
     
         21 . The tree detection system (TDS) of  claim 20 , wherein the TDS is further configured to:
 display each group on a display based on the group's position in the hierarchical tree;   display communication links from groups sending requests for the responses; and   display a notification relevant to each group, depending on the response.   
     
     
         22 . The tree detection system (TDS) of  claim 21 , wherein the TDS is further configured to:
 respond to a pointing device pointing to a group on the display by providing at least one of: Internet protocol addresses of all nodes that belong to the group, and domain names of all nodes that belong to the group.   
     
     
         23 . The tree detection system (TDS) of  claim 21 , wherein the TDS is further configured to:
 determine a unique geometrical shape for each group having similar characteristics.