Systems and methods for detecting cache-poisoning attacks in networks using service discovery protocols

A system for detecting cache-poisoning attacks in networks using SDPs, the system comprising:

• a maintenance module, stored in memory, that maintains a cache of service information that identifies one or more services provided by one or more client devices connected to a network using an SDP that facilitates automatic detection of services provided by client devices connected to the network;
• a distribution module, stored in memory, that distributes a plurality of service requests to a client device connected to the network;
• a detection module, stored in memory, that detects at least one cache-poisoning attack directed at the cache of service information by:
• receiving, from the client device, an SDP message in response to each service request that indicates the client device allegedly provides at least one service requested in the plurality of service requests;
• and
• identifying, within the SDP message, at least one attribute of the service allegedly provided via the network;
• determining that the client device is attempting to corrupt the cache of service information by determining that the identified attribute of the service suggests that the service is illegitimate, wherein determining that the identified attribute of the service suggests that the service is illegitimate comprises determining that the service is illegitimate due at least in part to the client device responding to each service request distributed to the client device;
• and
• a security module, stored in memory, that performs at least one security action to mitigate the cache-poisoning attack, in response to detecting the cache-poisoning attack;
• and
• at least one processor that executes the maintenance module, the distribution module, the detection module, and the security module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• maintain a cache of service information that identifies one or more services provided by one or more client devices connected to a network using an SDP that facilitates automatic detection of services provided by client devices connected to the network;
• detect at least one cache-poisoning attack directed at the cache of service information by:
• distributing a plurality of service requests to a client device connected to the network;
• receiving, from the client device, an SDP message in response to each service request that indicates the client device allegedly provides at least one service requested in the plurality of service requests;
• and
• identifying, within the SDP message, at least one attribute of the service allegedly provided via the network;
• determining that the client device is attempting to corrupt the cache of service information by determining that the identified attribute of the service suggests that the service is illegitimate, wherein determining that the identified attribute of the service suggests that the service is illegitimate comprises determining that the service is illegitimate due at least in part to the client device responding to each service request distributed to the client device;
• perform at least one security action to mitigate the cache-poisoning attack in response to detecting the cache-poisoning attack.