US 11,115,290 B2Granted

Network monitoring of time synchronization protocols using convolutional neural networks

AssigneeThe United States of America as represented by the Secretary of the Navy

InventorsRohan Yash Ramlall, Matthew Ralph Capella

Life of this patent

Estimating the term…

Loading patent…

Abstract

A device and method monitor integrity of a communication network. A local clock maintains a local time. A network interface receives time synchronization packets and associates with each the local time of receipt at the network interface. A processing system implements a neural network for classifying whether integrity of the communication network is compromised from originate, receive, and transmit values determined from the time synchronization packets. The originate value is a difference between the local time of the receipt of the request packet and a transmission timestamp of the request packet. The receive value is a difference between a reception timestamp of the request packet or the reply packet and the local time of the receipt of the request packet or the reply packet. The transmit value is a difference between the local time of the receipt of the reply packet and a transmission timestamp of the reply packet.

Claims20

Dependent claims

A device for monitoring an integrity of a communication network comprising:

a local clock for maintaining a local time;
a network interface for receiving from the communication network a plurality of data packets including a plurality of time synchronization packets, the network interface adapted to associate each of the time synchronization packets received from the communication network with the local time of receipt at the network interface;
and
a processing system adapted to implement a neural network for classifying whether or not the integrity of the communication network is compromised in response to originate, receive, and transmit values determined from the time synchronization packets, which include a plurality of request packets and a plurality of reply packets, with a plurality of bidirectional message exchanges each including a respective one of the request packets and one of the reply packets replying to the respective one of the request packets,
wherein the originate value for each of the bidirectional message exchanges is a difference between the local time of the receipt of the request packet in the bidirectional message exchange and a transmission timestamp of the request packet as measured by a sending device,
wherein the receive value for each of the bidirectional message exchanges is a difference between a reception timestamp of the request packet or the reply packet in the bidirectional message exchange as measured by a receiving device and the local time of the receipt of the request packet or the reply packet,
wherein the transmit value for each of the bidirectional message exchanges is a difference between the local time of the receipt of the reply packet in the bidirectional message exchange and a transmission timestamp of the reply packet as measured by another sending device.

4 more elements

A method for monitoring an integrity of at least one time synchronization protocol at a device for monitoring a communication network comprising:

receiving a plurality of time synchronization packets of the at least one time synchronization protocol from the communication network, which transfers a plurality of data packets including the time synchronization packets;
associating a local time of receipt from the communication network with each of the time synchronization packets, which time synchronization packets include a plurality of request packets and a plurality of reply packets, each one of the reply packets replying to a respective one of the request packets;
determining a transmission timestamp of transmission for each of the request packets, and calculating an originate value that is a difference between the local time of the receipt of the request packet and the transmission timestamp of transmission of the request packet;
determining a reception timestamp for each of the request packets or the reply packets, and calculating a receive value that is a difference between the reception timestamp and the local time of the receipt of the request packet or the reply packet;
determining a transmission timestamp of transmission for each of the reply packets, and calculating a transmit value that is a difference between the local time of the receipt of the reply packet and the transmission timestamp of transmission of the reply packet;
implementing a neural network for generating a classification value that classifies whether or not the integrity of the time synchronization protocol is compromised in response to the originate, receive, and transmit values for the request packets and the reply packets;
and
notifying a user that the integrity of the time synchronization protocol is under the attack in response to the classification value exceeding a threshold.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/737,577Filed 8 Jan 2020
Published: US 2021/0211360 A18 Jul 2021
Granted: 7 Sep 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 41/16
Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks: using machine learning…
G06N 3/045
Architecture, e.g. interconnection topology: combinations of networks
G06N 3/0464
Architecture, e.g. interconnection topology: convolutional networks [CNN, ConvNet]
G06N 3/08
Neural networks: learning methods