Detecting timing anomalies between GPS and independent clocks
AssigneeThe MITRE Corporation
InventorsDarrow Paine Leibner, Alessandro Paolo Cerruti
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for adapting to malware activity on a compromised computer system by detecting timing anomalies between timing signals. An embodiment operates by analyzing first timing data accessed from a validated source and second timing data accessed from an unvalidated receiver source in order to compute a threat detection value, which is utilized to determine if there is a discrepancy or anomaly in the timing or frequency of either the validated and unvalidated sources.
Claims17
A timing error measuring unit comprising:
- a processor configured to:
- receive first timing data from a validated data source;
- receive second timing data from a distributed coordinated data source;
- and
- generate an alert message based on a threat detection value being greater than a threat detection threshold;
- a timing comparator configured to:
- compare the first timing data with the second timing data for an adjustable interval of time;
- and
- determine the threat detection value based on the comparing, wherein the threat detection value is associated with a potential anomaly in a timing of the validated data source or the distributed coordinated data source;
- an output device configured to display the alert message;
- and
- a clock module configured to initiate a cycle counter to track a number of timing pulses in the first timing data during the adjustable interval of time, wherein the threat detection value is based on a comparison of the number of timing pulses to a predetermined expected number of cycles.
A method comprising:
- receiving first timing data from a validated data source;
- receiving second timing data from a distributed coordinated data source;
- comparing the first timing data with the second timing data for an adjustable interval of time;
- determining a threat detection value based on the comparing, wherein the threat detection value is associated with a potential anomaly in a timing of the validated data source or the distributed coordinated data source;
- generating an alert message based on the threat detection value being greater than a threat detection threshold;
- displaying the alert message;
- and
- initiating a cycle counter to track a number of timing pulses in the first timing data during the adjustable interval of time, wherein the threat detection value is based on a comparison of the number of timing pulses to a predetermined expected number of cycles.
A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
- receiving first timing data from a validated data source;
- receiving second timing data from a distributed coordinated data source;
- comparing the first timing data with the second timing data for an adjustable interval of time;
- determining a threat detection value based on the comparing, wherein the threat detection value is associated with a potential anomaly in a timing of the validated data source or the distributed coordinated data source;
- generating an alert message based on the threat detection value being greater than a threat detection threshold;
- displaying the alert message;
- and
- initiating a cycle counter to track a number of timing pulses in the first timing data during the adjustable interval of time, wherein the threat detection value is based on a comparison of the number of timing pulses to a predetermined expected number of cycles.
Dependencies are inferred from the claim text.