Back to results
US 9,794,285 B1Granted
System and method for detecting hacked modems
AssigneeCSC Holdings, LLC
InventorsEric Godas, John Pomeroy, Brian Daniels
Life of this patent
Estimating the term…
Abstract
A system, method, and computer program product are provided for detecting hacked modems in a cable network system. A cable Internet service provider can provide the disclosed heuristic to determine whether a particular cable modem has likely been hacked by obtaining a score corresponding to this likelihood. This score, as well as information regarding failure and success of various tests, can be used to generate a report identifying the likelihood that various modems have been hacked.
Claims20
A method comprising:
- applying a heuristic to an online modem connected to an internet service provider (ISP) to determine a likelihood that the online modem is hacked such that the online modem is circumventing legitimacy mechanisms of the ISP to receive internet services without authorization from the ISP, wherein applying the heuristic comprises:
- performing one or more tests on the online modem, wherein results of the one or more tests are indicative of the likelihood that the online modem is hacked;
- determining a score based on the results of the one or more tests, and determining whether the score is greater than or equal to a threshold wherein the score is correlated to the likelihood that the online modem is hacked;
- searching the results of the one or more tests to identify one or more combinations of results from the one or more tests, wherein identification of the one or more combinations is indicative of an increased likelihood that the online modem is hacked;
- applying a classification to the online modem based on one or both of the determined score being greater than or equal to the threshold and the identified combinations of test results;
- and
- applying a rule to the online modem based on the applied classification.
4 more elements
A computer-readable storage device having stored thereon computer-executable instructions, execution of which, by one or more computing devices, causes the computing devices to perform operations comprising:
- applying a heuristic to an online modem connected to an internet service provider (ISP) to determine a likelihood that the online modem is hacked such that the online modem is circumventing legitimacy mechanisms of the ISP, wherein applying the heuristic comprises:
- performing one or more tests on the online modem, wherein results of the one or more tests are indicative of the likelihood that the online modem is hacked;
- determining a score based on the results of the one or more tests, and determining whether the score is greater than or equal to a threshold, wherein the score is correlated to the likelihood that the online modem is hacked;
- searching the results of the one or more tests to identify one or more combinations of results from the one or more tests, wherein identification of the one or more combinations is indicative of an increased likelihood that the online modem is hacked;
- applying a classification to the online modem based on one or both of the determined score being greater than or equal to the threshold and the identified combinations of test results;
- and
- applying a rule to the online modem based on the applied classification.
4 more elements
A method comprising:
- applying a heuristic to an online communication device to determine a likelihood that the online communication device is hacked, wherein applying the heuristic comprises:
- performing one or more tests on the online communication device, wherein the one or more tests comprise determining that a provisioning mode of the online communication device is in accordance with DOCSIS 1.1, and either that a BPI+ is enabled and the online communication device is not using a default configuration template profile, or that the BPI+ is enabled and the online communication device is using the default configuration template profile and the online communication device conforms to DOCSIS 2.0 or higher, and wherein results of the one or more tests are indicative of the likelihood that the online communication device is hacked;
- determining a score based on the results of the one or more tests, wherein the score is correlated to the likelihood that the online communication device is hacked;
- identifying one or more combinations of results from the one or more tests, wherein identification of the one or more combinations is indicative of an increased likelihood that the online communication device is hacked;
- applying a classification to the online communication device based on one or both of the determined score and the identified combinations of test results;
- and
- applying a rule to the online communication device based on the applied classification.
4 more elements
A computer-readable storage device having stored thereon computer-executable instructions, execution of which, by one or more computing devices, causes the computing devices to perform operations comprising:
- applying a heuristic to an online communication device to determine a likelihood that the online communication device is hacked, wherein applying the heuristic comprises:
- performing one or more tests on the online communication device, wherein the one or more tests comprise determining that a provisioning mode of the online communication device is in accordance with DOCSIS 1.1, and either that a BPI+ is enabled and the online communication device is not using a default configuration template profile, or that the BPI+ is enabled and the online communication device is using the default configuration template profile and the online communication device conforms to DOCSIS 2.0 or higher, and wherein results of the one or more tests are indicative of the likelihood that the online communication device is hacked;
- determining a score based on the results of the one or more tests, wherein the score is correlated to the likelihood that the online communication device is hacked;
- identifying one or more combinations of results from the one or more tests, wherein identification of the one or more combinations is indicative of an increased likelihood that the online communication device is hacked;
- applying a classification to the online communication device based on one or both of the determined score and the identified combinations of test results;
- and
- applying a rule to the online communication device based on the applied classification.
4 more elements
Dependencies are inferred from the claim text.