US 2020/0396249 A1 · ECHO DETECTION OF MAN-IN-THE-MIDDLE LAN ATTACKS

Abstract

Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.

Claims10

Dependent claims

A computing system for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising at least one processor and at least one memory storage communicatively coupled to the at least one processor on which is stored computer-readable instructions that when executed by the at least one processor cause the computing system to perform steps including:

emitting a plurality of first echo requests onto the LAN and determining first network features from responses to the first echo requests, wherein the first network features include round trip time (RTT), impulse energy response, and jitter;
emitting one or more second echo requests onto the LAN;
measuring second network features from responses to the second echo requests;
determining that the second network features are anomalous with respect to the first network features;
and
responsively issuing an MITM alert.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application

16/772,985Filed 13 Dec 2018

Priority

13 Dec 2017

Published

17 Dec 2020

Term ends

Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1466
Countermeasures against malicious traffic: active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g.…
G06F 7/584
Pseudo-random number generators: using finite field arithmetic, e.g. using a linear feedback shift register
G06F 21/55
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: detecting local…

Echo detection of man-in-the-middle lan attacks

Life of this patent

Echo detection of man-in-the-middle lan attacks

Life of this patent

Abstract

Claims10