# US 2020/0396249 A1 · Echo detection of man-in-the-middle lan attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0396249 A1
- Document ID: US20200396249A1
- Status: Published application
- Kind: A1
- Application number: 16/772,985
- Filed: 2018-12-13
- Published: 2020-12-17
- Earliest claimed: 2017-12-13
- Assignees: B. G. Negev Technologies and Applications Ltd.
- Applicants: B. G. Negev Technologies and Applications Ltd.
- Inventors: Asaf SHABTAI; Yisroel Avraham MIRSKY; Naor KALBO; Yuval ELOVICI
- Web page: https://patentgrep.com/patent/US20200396249A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- G06F 7/584: {using finite field arithmetic, e.g. using a linear feedback shift register}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/82: Protecting input, output or interconnection devices
- H04L 43/50: Testing arrangements
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.

## Claims

### Claim 1

A computing system for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising at least one processor and at least one memory storage communicatively coupled to the at least one processor on which is stored computer-readable instructions that when executed by the at least one processor cause the computing system to perform steps including:
emitting a plurality of first echo requests onto the LAN and determining first network features from responses to the first echo requests, wherein the first network features include round trip time (RTT), impulse energy response, and jitter;
emitting one or more second echo requests onto the LAN;
measuring second network features from responses to the second echo requests;
determining that the second network features are anomalous with respect to the first network features; and
responsively issuing an MITM alert.

### Claim 2 (depends on 1)

The system of claim 1, wherein each of the first echo requests includes packetized data and wherein the packetized data include randomly selected elements.

### Claim 3 (depends on 2)

The system of claim 2, wherein the randomly selected elements are selected by a pseudorandom binary sequence generator incorporating maximal linear feedback shift registers to provide a maximal length sequence signal.

### Claim 4 (depends on 1)

The system of claim 1, wherein determining the first and the second network features includes determining mean values of the network features.

### Claim 5 (depends on 1)

The system of claim 1, wherein determining that the second network features are anomalous includes determining a root mean square error (RMSE) score for a difference between the first and second network features.

### Claim 6

A computer-based method for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising:
emitting a plurality of first echo requests onto the LAN and determining first network features from responses to the first echo requests, wherein the first network features include round trip time (RTT), impulse energy response, and jitter;
emitting one or more second echo requests onto the LAN;
measuring second network features from responses to the second echo requests;
determining that the second network features are anomalous with respect to the first network features; and
responsively issuing an MITM alert.

### Claim 7 (depends on 6)

The method of claim 6, wherein each of the first echo requests includes packetized data and wherein the packetized data include randomly selected elements.

### Claim 8 (depends on 7)

The method of claim 7, wherein the randomly selected elements are selected by a pseudorandom binary sequence generator incorporating maximal linear feedback shift registers to provide a maximal length sequence signal.

### Claim 9 (depends on 6)

The method of claim 6, wherein determining the first and the second network features includes determining mean values of the network features.

### Claim 10 (depends on 6)

The method of claim 6, wherein determining that the second network features are anomalous includes determining a root mean square error (RMSE) score for a difference between the first and second network features.