Echo detection of Man-in-the-Middle LAN attacks
AssigneeB. G. Negev Technologies and Applications Ltd.
InventorsAsaf Shabtai, Yisroel Avraham Mirsky, Naor Kalbo, Yuval Elovici
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.
Claims10
A computing system for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising at least one processor and at least one memory storage communicatively coupled to the at least one processor on which is stored computer-readable instructions that when executed by the at least one processor cause the computing system to perform steps including:
- during a first period of network operation, emitting a plurality of first echo excitation signals onto the LAN, each first excitation signal x being a sequence of echo requests;
- determining, for each first excitation signal, a respective output sequence y of round-trip times (RTTs) and responsively determining, for each first excitation signal, a vector of first network features, wherein the first network features include a mean RTT, a measure of impulse response energy, and a measure of jitter distribution, wherein a value of impulse response energy is calculated as an inverse discrete Fourier transform (DFT) of a ratio of discrete Fourier transforms of the excitation signal x and the output sequence y;
- generating from the plurality of vectors of the first network features corresponding to the first excitation signals, a behavior model characterizing a first period operation;
- subsequently emitting one or more second excitation signals of sequences of echo requests onto the LAN;
- measuring respective vectors of second network features from responses to the second echo excitation signals;
- determining, according to the behavior model characterizing the first period operation, that the vectors of the second network features are anomalous with respect to the vectors of the first network features;
- and
- responsively issuing an MITM alert.
A computer-based method for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising:
- during a first period of network operation, emitting a plurality of first excitation signals onto the LAN, each first excitation signal x being a sequence of echo requests;
- determining, for each first excitation signal, a respective output sequence y of round-trip times (RTTs) and responsively determining, for each first excitation signal, a vector of first network features, wherein the first network features include a mean RTT, a measure of impulse response energy, and a measure of jitter distribution, wherein a value of impulse response energy is calculated as an inverse discrete Fourier transform (DFT) of a ratio of discrete Fourier transforms of the excitation signal x and the output sequence y;
- generating from the plurality of vectors of the first network features corresponding to the first excitation signals, a behavior model characterizing a first period operation;
- subsequently emitting one or more second excitation signals of sequences of echo requests onto the LAN;
- measuring respective vectors of second network features from responses to the second excitation signals;
- determining, according to the behavior model characterizing the first period operation, that the vectors of the second network features are anomalous with respect to the vectors of the first network features;
- and
- responsively issuing an MITM alert.
Dependencies are inferred from the claim text.