Detecting timing anomalies between GPS and independent clocks
AssigneeThe MITRE Corporation
InventorsDarrow Paine Leibner, Alessandro Paolo Cerruti
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for adapting to malware activity on a compromised computer system by detecting timing anomalies between timing signals. An embodiment operates by analyzing first timing data accessed from a validated source and second timing data accessed from an unvalidated receiver source in order to compute a threat detection value, which is utilized to determine if there is a discrepancy or anomaly in the timing or frequency of either the validated and unvalidated sources.
Claims19
A timing analysis detection system, comprising:
- an independent clock source;
- a global navigation satellite system (GNSS) receiver, wherein the independent clock source and the GNSS receiver are independent of each other;
- and
- a timing error measuring unit configured to:
- process first timing data provided by the independent clock source;
- process second timing data provided by the GNSS receiver, wherein the second timing data includes a pulse per second timing signal;
- determine, based on the first timing data, a number of cycles received from the independent clock source for an adjustable interval of time, wherein the number of cycles is based on the pulse per second timing signal;
- and
- determine a threat detection value based on the number of cycles and the second timing data, wherein the threat detection value is configured to indicate an anomaly in a timing of the GNSS receiver, and wherein the threat detection value is determined based on an absolute value of a difference between the number of cycles and a predetermined expected clock cycle value.
A method comprising:
- processing first timing data provided by an independent clock source;
- processing second timing data provided by a global navigation satellite system (GNSS) receiver, wherein the independent clock source and the GNSS receiver are independent of each other, and wherein the second timing data includes a pulse per second timing signal;
- determining, based on the first timing data, a number of cycles received from the independent clock source for an adjustable interval of time, wherein the number of cycles is based on the pulse per second timing signal;
- and
- determining a threat detection value based on the number of cycles and the second timing data, wherein the threat detection value is configured to indicate an anomaly in a timing of the GNSS receiver, and wherein the threat detection value is determined based on an absolute value of a difference between the number of cycles and a predetermined expected clock cycle value.
A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
- processing first timing data provided by an independent clock source;
- processing second timing data provided by a global navigation satellite system (GNSS) receiver, wherein the independent clock source and the GNSS receiver are independent of each other, and wherein the second timing data includes a pulse per second timing signal;
- determining, based on the first timing data, a number of cycles received from the independent clock source for an adjustable interval of time, wherein the number of cycles is based on the pulse per second timing signal;
- and
- determining a threat detection value based on the number of cycles and the second timing data, wherein the threat detection value is configured to indicate an anomaly in a timing of the GNSS receiver, and wherein the threat detection value is determined based on an absolute value of a difference between the number of cycles and a predetermined expected clock cycle value.
Dependencies are inferred from the claim text.