WO2016204838A9 - System and method to detect attacks on mobile wireless networks based on motif analysis - Google Patents
System and method to detect attacks on mobile wireless networks based on motif analysis Download PDFInfo
- Publication number
- WO2016204838A9 WO2016204838A9 PCT/US2016/023307 US2016023307W WO2016204838A9 WO 2016204838 A9 WO2016204838 A9 WO 2016204838A9 US 2016023307 W US2016023307 W US 2016023307W WO 2016204838 A9 WO2016204838 A9 WO 2016204838A9
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- misinformation
- attack
- set forth
- communication network
- motifs
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W12/122—Counter-measures against attacks; Protection against rogue devices
Definitions
- Patent Application No. 62/135,142 filed March 18, 2015, entitled, “System and Method to Detect Attacks on Mobile Wireless Networks Based on Network Controllability Analysis,” the entirety of which is incorporated herein by reference.
- the present invention relates to a system for detecting sources of
- misinformation in mobile wireless networks and, more particularly, to a system for detecting sources of misinformation in mobile wireless networks based on motif analysis.
- Reference Nos. 1-4 and 5 are capable of detecting small changes in
- misinformation such as those in "shrew” attacks, but they require detailed knowledge of the network configuration, such as the type and state of protocol instances, applications, and the underlying physical wireless channel.
- Such protocol-specific, or specification-based, approaches are difficult to implement and maintain, and are only practical for network elements that have simple and easily observable state machines (e.g., media access control (MAC) protocols or routing protocols).
- MAC media access control
- these approaches fail if the specification and implementation of the element deviate in a manner that can be exploited with misinformation, or if the specification itself has flaws that can be exploited.
- the published literature such as Literature Reference Nos. 1 and 4 have shown that both of these flaws (i.e., implementation flaws and specification flaws) are common.
- the present invention relates to a system for detecting sources of
- the system comprises one or more processors and a memory having instructions such that when the instructions are executed, the one or more processors perform multiple operations.
- a hierarchical representation of activity of a communication network is used to detect and predict sources of misinformation in the communication network.
- the hierarchical representation comprises a plurality of nodes and temporal patterns of communication between at least one pair of nodes, each temporal pattern representing a motif, having a size, in the hierarchical representation. Changes in motifs provide a signal for a misinformation attack.
- a visual representation on a display relating to motifs of interest is generated to identify a misinformation attack.
- a misinformation attack is characterized by an over- representation of motifs having a predetermined size.
- a size threshold for detection of a misinformation attack is set by learning a maximum frequency of motifs of each size in a normal baseline operation of the communication network.
- the system introduces a motif attribution measure at each node / of the communication ⁇ network.
- w z - is defined as a frequency of sub-graphs to which it contributes.
- a TW; greater than double the maximum frequency indicates a likelihood that node i is an attacker.
- the hierarchical representation comprises a plurality of data tables that describe applications and services running on the communication network and a set of inter-dependencies between the applications and services.
- the system upon detection of an attack of misinformation on the communication network, performs a mitigation action.
- the mitigation action comprises isolating an attacking node from the rest of the communication network.
- the present invention also comprises a method for causing a processor to perform the operations described herein.
- the present invention also comprises a computer program product comprising computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having a processor for causing the processor to perform the operations described herein.
- FIG. 1 is a block diagram depicting the components of a system for detecting sources of misinformation in mobile wireless networks according to various embodiments of the present disclosure
- FIG. 2 is an illustration of a computer program product according to various embodiments of the present disclosure
- FIG. 3 is an illustration of network motif size frequencies according to
- FIG. 4 is an illustration of a barcode of sub-graphs for regular and attacking patterns in FIG. 3 according to various embodiments of the present disclosure
- FIG. 5A is an illustration of a sample graph according to various embodiments of the present disclosure
- FIG. 5B is an illustration of finding all sub-graphs with the sample graph in FIG. 5A according to various embodiments of the present disclosure
- FIG. 6 is a table illustrating pseudo-code of the Enumerate Subgraph (ESU) algorithm for finding sub-graphs according to various embodiments of the present disclosure
- FIG. 7A is a plot illustrating motif size frequency during reset attacks according to various embodiments of the present disclosure.
- FIG. 7B is a plot illustrating motif size frequency during flood attacks according to various embodiments of the present disclosure.
- FIG. 8 is a plot illustrating attribution in a 6 node example using motifs of size 3 according to various embodiments of the present disclosure.
- FIG. 9 is a flow diagram illustrating a method to detect attacks on mobile wireless networks according to various embodiments of the present disclosure.
- the present invention relates to a system for detecting sources of
- misinformation in mobile wireless networks and, more particularly, to a system for detecting sources of misinformation in mobile wireless networks based on motif analysis.
- the following description is presented to enable one of ordinary skill in the art to make and use the invention and to incorporate it in the context of particular applications. Various modifications, as well as a variety of uses in different applications will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to a wide range of aspects. Thus, the present invention is not intended to be limited to the aspects presented, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
- the labels left, right, front, back, top, bottom, forward, reverse, clockwise and counter-clockwise have been used for convenience purposes only and are not intended to imply any particular fixed direction. Instead, they are used to reflect relative locations and/or directions between various portions of an object. As such, as the present invention is changed, the above labels may change their orientation.
- the present invention has three "principal" aspects.
- the first is a system for detecting sources of misinformation in mobile wireless networks.
- the system is typically in the form of a computer system operating software or in the form of a "hard-coded" instruction set. This system may be incorporated into a wide variety of devices that provide different functionalities.
- the second principal aspect is a method, typically in the form of software, operated using a data processing system (computer).
- the third principal aspect is a computer program product.
- the computer program product generally represents computer-readable instructions stored on a non-transitory computer-readable medium such as an optical storage device, e.g., a compact disc (CD) or digital versatile disc (DVD), or a magnetic storage device such as a floppy disk or magnetic tape.
- Other, non- limiting examples of computer-readable media include hard disks, read-only memory (ROM), and flash-type memories.
- FIG. 1 A block diagram depicting an example of a system (i.e., computer system
- the computer system 100 is configured to perform calculations, processes, operations, and/or functions associated with a program or algorithm.
- certain processes and steps discussed herein are realized as a series of instructions (e.g., software program) that reside within computer readable memory units and are executed by one or more processors of the computer system 100. When executed, the instructions cause the computer system 100 to perform specific actions and exhibit specific behavior, such as described herein.
- the computer system 100 may include an address/data bus 102 that is
- processor 104 configured to communicate information. Additionally, one or more data processing units, such as a processor 104 (or processors), are coupled with the address/data bus 102.
- the processor 104 is configured to process information and instructions.
- the processor 104 is a microprocessor.
- the processor 104 may be a different type of processor such as a parallel processor, or a field programmable gate array.
- the computer system 100 is configured to utilize one or more data storage units.
- the computer system 100 may include a volatile memory unit 106 (e.g., random access memory ("RAM”), static RAM, dynamic RAM, etc.) coupled with the address/data bus 102, wherein a volatile memory unit 106 is configured to store information and instructions for the processor 104.
- RAM random access memory
- static RAM static RAM
- dynamic RAM dynamic RAM
- the computer system 100 further may include a non-volatile memory unit 108 (e.g., read-only memory (“ROM”), programmable ROM (“PROM”), erasable programmable ROM (“EPROM”), electrically erasable programmable ROM “EEPROM”), flash memory, etc.) coupled with the address/data bus 102, wherein the nonvolatile memory unit 108 is configured to store static information and instructions for the processor 104.
- the computer system 100 may execute instructions retrieved from an online, data storage unit such as -in "Cloud” computing.
- the computer system 100 also may include one or more interfaces, such as an interface 110, coupled with the address/data bus 102.
- the one or more interfaces are configured to enable the computer system 100 to interface with other electronic devices and computer systems.
- the communication interfaces implemented by the one or more interfaces may include wireline (e.g., serial cables, modems, network adaptors, etc.) and/or wireless (e.g., wireless modems, wireless network adaptors, etc.) communication technology.
- the computer system 100 may include an input device 112 coupled with the address/data bus 102, wherein the input device 112 is configured to communicate information and command selections to the processor 100.
- the input device 112 is an alphanumeric input device, such as a keyboard, that may include alphanumeric and/or function keys.
- the input device 112 may be an input device other than an alphanumeric input device.
- the input device 112 may include one or more sensors, such as a camera for video or still images, a microphone, or a neural sensor.
- Other example input devices 112 may include an accelerometer, a GPS sensor, or a gyroscope.
- the computer system 100 may include a cursor control device 114 coupled with the address/data bus 102, wherein the cursor control device 114 is configured to communicate user input information and/or command selections to the processor 100.
- the cursor control device 114 is implemented using a device such as a mouse, a track-ball, a track-pad, an optical tracking device, or a touch screen.
- the cursor control device 114 is directed and/or activated via input from the input device 1 12, such as in response to the use of special keys and key sequence commands L associated with the input device 112.
- the cursor control device 114 is configured to be directed or guided by voice commands.
- the computer system 100 further may include one or more
- a storage device 1 16 coupled with the address/data bus 102.
- the storage device 1 16 is configured to store information and/or computer executable instructions.
- the storage device 116 is a storage device such as a magnetic or optical disk drive (e.g., hard disk drive (“HDD”), floppy diskette, compact disk read only memory (“CD-ROM”), digital versatile disk (“DVD”)).
- a display device 1 18 is coupled with the address/data bus 102, wherein the display device 1 18 is configured to display video and/or graphics.
- the display device 1 18 may include a cathode ray tube ("CRT"), liquid crystal display (“LCD”), field emission display (“FED”), plasma display, or any other display device suitable for displaying video and/or graphic images and alphanumeric characters recognizable to a user.
- CTR cathode ray tube
- LCD liquid crystal display
- FED field emission display
- plasma display or any other display device suitable for displaying video and/or graphic images and alphanumeric characters recognizable to a user.
- the computer system 100 presented herein is an example computing environment in accordance with an aspect. However, the non-limiting example of the computer system 100 is not strictly limited to being a computer system. For example, an aspect provides that the computer system 100 represents a type of data processing analysis that may be used in accordance with various aspects described herein. Moreover, other computing systems may also be
- one or more operations of various aspects of the present technology are controlled or implemented using computer-executable instructions, such as program modules, being executed by a computer.
- program modules include routines, programs, objects, components and/or data structures that are configured to perform particular tasks or implement particular abstract data types.
- an aspect provides that one or more aspects of the present technology are implemented by utilizing one or more distributed computing environments, such as where tasks are performed by remote processing devices that are linked through a communications network, or such as where various program modules are located in both local and remote computer-storage media including memory-storage devices.
- FIG. 2 An illustrative diagram of a computer program product (i.e., storage device) embodying the present invention is depicted in FIG. 2.
- the computer program product is depicted as floppy disk 200 or an optical disk 202 such as a CD or DVD.
- the computer program product generally represents computer-readable instructions stored on any compatible non-transitory computer-readable medium.
- the term "instructions” as used with respect to this invention generally indicates a set of operations to be performed on a computer, and may represent pieces of a whole program or individual, separable, software modules.
- Non-limiting examples of "instruction” include computer program code (source or object code) and "hard-coded" electronics (i.e. computer operations coded into a computer chip).
- the "instruction" is stored on any non-transitory computer-readable medium, such as in the memory of a computer or on a floppy disk, a CD-ROM, and a flash drive. In either event, the instructions are encoded on a non-transitory computer-readable medium.
- the exploitation network is a hierarchical model of a network (a network of networks) that provides three different views of the network, linked together by directional links. Xnet is described in detail in U.S. Patent
- the model includes an application dependency— layer and a network dependency layer in addition to the network topology itself.
- Xnet moves the problem out of the realm of conventional wireless networking techniques, which are focused on throughput between pairs of nodes, into a representation that enables a more holistic behavioral treatment. This transfer to the representation is the foundation that enables the social networking and information dynamics approach of the present invention.
- the system according to embodiments of the invention relies on the Xnet hierarchical model of network activity.
- the Xnet model includes at least four unique modules, including the Xnet Dynamics (XD) module, the Xnet Controllability/Observability (XCO) module, the Xnet Evolvability (XE) module, and (4) the Reliability Estimation (RE) module.
- the XD module identifies unreliable nodes based on the dynamics of social networks (with no dependency on protocol) to indicate the presence of malicious or damaged nodes altering control and data plane information in the network.
- the XCO module identifies the optimal set of nodes required to passively monitor (observability) or actively probe (controllability) a suspected source of misinformation.
- the XE module simulates a progression of failures to predict which nodes are most likely to be attacked next or should have trust reassessed.
- the RE module fuses cross-layer and cross-plane (control and data plane) information to identify suspicious nodes and improve reputation-based trust management.
- the unified trust metric is computed in a hybrid approach in which nodes combine normalized confidence and trust values based on direct experience and recommendations of other nodes. Such a hybrid approach -avoids a centralized point of failure, ensures scalability, and renders the computation resilient to attacks targeting such computations.
- the RE module gets a minimal set of driver and observer nodes from the XCO module for the suspect nodes.
- the RE module uses the driver nodes to do active probing on the suspect nodes, and the observer nodes update a trust metric with the results.
- the XE module simulates a spread of compromised nodes
- the RE module formalizes and quantifies trust using a model that relies on local computations based on direct interactions with neighbors and also by incorporating recommendations (and experiences) of other nodes.
- a formal subjective logic and trust model is leveraged for principled combination of evidence about how trustworthy a node is. Resilience to attacks is gained by adopting a hybrid distributed approach to compute trust, avoiding a single point of failure, and the approach is agnostic to control and/or data plane statistics being used.
- the RE module's trust in a node falls below a certain level, it performs active probing on the node. To do that most efficiently the XCO module computes a minimal set of driver nodes to issue the challenges and observer nodes to observe the results.
- the system also employs a two-pronged approach to discover sources of misinformation in the network, employing information dynamics identification of suspicious changes in Xnet dependencies, as well as trends in the appearance of such compromised nodes.
- the XD module uses a unique information dynamic spectrum framework to predict system instability at critical transitions in complex systems, by analyzing Xnet time series data. This marks nodes for further inspection by the RE module.
- the XE module tracks trends in misbehaving nodes, and matches against simulations of contagion and cascading failures. The XE module will emit a confidence measure as to whether there is a pattern, and if so, the RE module can focus monitoring and testing resources on predicted next nodes to be attacked. System Administrators can use this information to focus preventative measures.
- network administrators configure each node of a network (e.g., mobile wireless network) with compatible networking stacks, host and network services, applications, and other software necessary for the mission, including suite of modules with supporting configuration data.
- a network e.g., mobile wireless network
- the hierarchical representation of the network i.e., Xnet
- Xnet the hierarchical representation of the network
- the Xnet Motifs (XM) module receives the Application Dependency (AppDep) and Network Dependency (NetDep) graph from Xnet— For further details regarding Xnet, refer to U.S. Patent Application No. 14/625,988, which is hereby incorporated by reference in its entirety.
- the XM module monitors the dynamics of the AppDep and NetDep graphs by collecting time-series data on statistics identified in its baseline configuration. It will develop baseline frequencies for each size of motif that occurs during a set quantum of time (e.g., time quantum of 10 seconds). This will include keeping track of typical temporal sequences of motifs.
- a compromised node will attract the attention of the XM module, which will observe a sudden change in the frequency of motif sizes. For example, malicious dropping of packets at a node will result in a step-change in the load between applications and services that depend on that node. For example, the attacking node's dropping of packets can be observed directly at the media access control (MAC) layer by monitoring the channel and observing whether the node is forwarding packets to the next hop.
- MAC media access control
- the compromised nodes may be revealed.
- the abstract network refers to the abstract mathematical representation of the relationship between communicating entities in a physical network (i.e., a real network comprising physical nodes (e.g., radios)).
- the Xnet is a hierarchical-network of network graphs whose nodes include the physical radios communicating on the network as well as conceptual nodes that represent communicating network entities, such as applications and network services. Edges between nodes are created whenever one of these nodes sends data to another node (just the start and end node, not the intermediate nodes that forward the message datagrams). An edge exists until the message reaches its destination.
- Network motifs are temporal patterns of communication between nodes. Network activity is divided into windows of time. During each window, if an edge appears between two nodes, it can be counted in motifs for that window. Network motifs are recurrent and statistically significant sub-graphs or patterns of communication between the subsets of nodes that work together.
- Each of these sub-graphs may reflect a framework in which particular communication protocols are achieved efficiently. Indeed, motifs are of notable importance largely because they capture the underlying communication structure of a wireless network. Changes in the histogram of motif sizes provide a characteristic signal for certain types of attacks. When attacks happen, different recurrent sub-graphs would reflect changes in the network communication pattern and, consequently, result in the detection.
- V denotes vertices (also referred to as “nodes” when discussed in the context of the abstract network).
- E denotes edges (also referred to as "links”).
- Graph G' is a sub-graph of graph G (written as G' c G) if V ⁇ V and E' £ E ⁇ (V ⁇ V). If
- G' £ G and G' contains all of the edges ⁇ u, v> £ E with u, v £ V, then G' is an induced sub-graph of G.
- G" c G and there exist an isomorphism between the sub-graph G" and a graph G' this mapping represents an appearance of G' in G.
- the number of appearances of graph G' in G is called the frequency of G' in G.
- FIG. 3 is a graph illustrating network motif size frequencies during attack vs. normative, demonstrating FG(G') for both regular and attack patterns.
- Regular patterns are represented by unfilled bars, while attack patterns are represented by filled bars.
- FIG. 3 indicates that it is unlikely to find large motifs (size > 5) in a regular communication network (as indicated by the absence of regular patterns) compared to the one under flooding attacks (as indicated by the presence of attack patterns), suggesting a potential attack detector.
- barcodes of notable motifs for different communications were defined that allow one to identify attacks.
- FIG. 4 is an illustration of a barcode 400 of sub-graphs for regular and attacking patterns in FIG.
- Motifs are those sub-graphs with the frequency FG(G') greater than a predefined threshold or cut-off value.
- the threshold is determined by comparing to a null model, such as the recurrent frequency of the same subgraph in a randomized graph.
- this definition is not appropriate for mobile networking problems. Indeed, one goal here is to distinguish frequent sub-graphs in regular and attack patterns. Yet, even in the communication network running under normal conditions, FG(G') may be very different from a completely random graph model. Therefore, the approach according to embodiments of the present invention takes FG(G') of the regular pattern as the null model. An abnormal pattern will be detected if its FG(G') significantly deviates from the null model defined above.
- FIG. 5A depicts a sample graph
- FIG. 5B depicts the ESU (Enumerate Subgraph) algorithmic process of finding all sub-graphs with three nodes (where nodes are represented by numbered circles) in FIG. 5A.
- SUB is the name for the left-most set shown in each box
- EXT is the name for the right-most set in each box.
- SUB represents the current subgraph for the box.
- EXT represents the possible set of nodes that can be used to extend the subgraph.
- EXT (4) and (5) are the nodes that can be used to extend this subgraph, as follows:
- ESU first finds the set of all induced sub-graphs of size k; let Sk be this set.
- ESU can be implemented as a recursive function.
- the running of this function can be displayed as a tree-like structure of depth k, called the ESU-Tree, as depicted in FIG. 5B.
- Each of the ESU-Tree nodes (represented by boxes) indicate the status of the recursive function that entails two consecutive sets, SUB and EXT.
- SUB refers to nodes in the target network that are adjacent and establish a partial sub-graph of size
- each of the nodes in EXT must be adjacent to at least one of the nodes in SUB; second, their numerical labels must be larger than the labels of SUB nodes.
- the first condition makes sure that the expansion of SUB nodes yields a connected graph and the second condition causes ESU-Tree leaves (the bottom row of graphs (element 506)) to be distinct. As a result, overcounting is prevented.
- the EXT set is-not a static set, so in each step it may expand by some new nodes that do not breach the two conditions.
- the next step of ESU involves classification of sub-graphs placed in the
- G-Tries is another motif discovery algorithm that may be utilized.
- G-Tries constructs a multiway tree (referred to as a g-trie) that can store a collection of graphs.
- Each tree node contains information about a single graph vertex and its corresponding edges to ancestor nodes.
- a path from the root to a leaf corresponds to one single graph.
- Descendants of a g-trie node share a common sub-graph.
- the counting part takes place. This is conceptually akin to a prefix tree, which stores sub-graphs according to their structures and finds occurrences of each of these sub-graphs in a larger graph.
- the main idea in the counting process is to backtrack by all possible sub-graphs, but at the same time do the isomorphism tests.
- the process takes advantage of common substructures in the sense that at a given time there is a partial isomorphic match for several different candidate sub-graphs.
- G-Tries does not need to find those sub-graphs that are not in the main
- N the computational complexity in terms of the graph size N is theoretically unknown, judging from numerical results from previous work, it might be concluded that it scales as 0(N*M) (with a fixed motif size n), where N is the number of nodes and M is the total numbers of motifs of the underlying network.
- N the number of nodes
- M the total numbers of motifs of the underlying network.
- the graph is sparse and M linearly scales with N, leading to an overall time complexity 0(N 2 ) in terms of the whole network size (i.e., the number of devices).
- FIGs. 7A and 7B plot the frequency of motifs of each size during a reset (web) (FIG. 7A) and flooding (TTCP) (FIG. 7B) attack.
- the "reset” attack sends a special type of TCP packet that essentially forces a TCP connection to "reset", or close unnecessarily.
- the "flooding” attack creates a large volume of unnecessary network traffic that causes a "denial-of-service" of the network.
- the distinct curve colors represent distinct motif sizes, as indicated in FIGs. 7A and 7B.
- Motif frequency measures the number of motifs occurring in a unit time. In a reset (web) attack, smaller motifs increase in frequency. In a flood attack (FIG.
- FIG. 8 plots the motif attribution rrij at the
- a "blackhole" attack has the ultimate goals of 1) forcing all routes to go through the attacking physical node (i.e., the node "captures” all of the routes between all other pairs of nodes in the network), and 2) dropping all of the subsequent data traffic that comes across those routes.
- this is similar in concept to how the extreme gravity of a blackhole pulls all matter into it and (seemingly) destroys it.
- Distinct curve colors represent the 5 non-attacking nodes and the one attacking node 800.
- the plot shows a clear signal (i.e., spike) only for the attacking node 800 when the attack happens.
- the attacking node 800 clearly stands out because the frequency of motifs of size 3 at that node increases nearly 4 times as much as any other node.
- FIG. 9 is a flow diagram of the method to detect attack on networks
- a hierarchical representation of network activity is generated.
- changes in the size of temporal motifs in the hierarchical representation are detected.
- sources of misinformation in the communication network are detected and predicted.
- Mobile wireless networks experience widespread use in applications, non- limiting examples of which include mobile military and law enforcement networks (soldier-to-soldier, sensor-to-sensor, ground and aerial vehicle-to- vehicle); commercial vehicle- to- vehicle and vehicle-to-infrastructure networks; commercial mesh networks; wireless infrastructure ISPs, and cellular companies (extended data capacity).
- the invention described herein will significantly improve the security of these and other related networks, which currently rely predominantly on packet-level encryption to reduce the probability of external intrusion but do not detect or prevent "network insider" attacks.
- the system after identifying the presence of misinformation in the network, the system performs an operation to attribute who is responsible for the attack. After attributing the attack to an entity, the system can take actions to mitigate the attack.
- a non-limiting example of a mitigation action would be to isolate the attacking node (i.e., physical radio).
- the action can include informing every other node in the network to simply ignore anything that the attacking node transmits, and not to send anything to, or through, the attacking node.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Mobile Radio Communication Systems (AREA)
- Computer And Data Communications (AREA)
Abstract
Described is a system for detecting attacks on networks. A hierarchical representation of activity of a communication network is used to detect and predict sources of misinformation in the communication network. The hierarchical representation includes temporal patterns of communication between at least one pair of nodes, each temporal pattern representing a motif having a size, in the hierarchical representation. Changes in motifs provide a signal for a misinformation attack.
Description
[0001] SYSTEM AND METHOD TO DETECT ATTACKS ON MOBILE WIRELESS NETWORKS BASED ON MOTIF ANALYSIS
[0002] GOVERNMENT LICENSE RIGHTS
[0003] This invention was made with government support under U.S. Government Contract Number AFRL FA8750-14-C-0017. The government has certain rights in the invention.
[0004] CROSS-REFERENCE TO RELATED APPLICATIONS [0005] This is a Non-Provisional Patent Application of U.S. Provisional Patent
Application No. 62/135,136 filed March 18, 2015, entitled, "System and Method to-Detect-Attacks on Mobile- Wireless Networks Based on MotifAnalysis," the entirety of which is incorporated herein by reference.
[0006] This is ALSO a Non- Provisional Patent Application of U.S. Provisional
Patent Application No. 62/135,142 filed March 18, 2015, entitled, "System and Method to Detect Attacks on Mobile Wireless Networks Based on Network Controllability Analysis," the entirety of which is incorporated herein by reference.
[0007] BACKGROUND OF INVENTION
(1) Field of Invention
The present invention relates to a system for detecting sources of
misinformation in mobile wireless networks and, more particularly, to a system for detecting sources of misinformation in mobile wireless networks based on motif analysis.
[00010] (2) Description of Related Art
1 ] Due to the dynamic nature of mobile wireless networks, the network applications, protocols, and services from which they are built employ implicit trust and sharing of control information. This makes the detection of misinformation particularly difficult. Although current network protocol stacks secure the wireless transmissions between pairs of nodes from outside observers, their reliance on shared information to enable the collection of nodes to operate as a network makes it very difficult to defend from an "insider" node that issues misinformation.
[00012] Existing security solutions (such as those described in Literature Reference Nos. 1-4 in the List of Incorporated Literature References) for mobile wireless networks typically characterize the network by monitoring performance metrics, such as throughput, latency, and jitter at separate layers within the networking stack, looking for anomalies in behavior from a baseline that, at this level of abstraction, is very noisy and very difficult to accurately characterize for a broad range of conditions. Even under ideal circumstances, significant disruptions in the overall network utility can be caused by small amounts of misinformation that target only a few critical network elements (i.e., a "shrew" attack) that are below the threshold of detection using such performance metrics based anomaly detection. .
[00013] Other existing security solutions (such as those described in Literature
Reference Nos. 1-4 and 5) are capable of detecting small changes in
misinformation, such as those in "shrew" attacks, but they require detailed knowledge of the network configuration, such as the type and state of protocol instances, applications, and the underlying physical wireless channel. Such protocol-specific, or specification-based, approaches are difficult to implement and maintain, and are only practical for network elements that have simple and easily observable state machines (e.g., media access control (MAC) protocols or
routing protocols). However, these approaches fail if the specification and implementation of the element deviate in a manner that can be exploited with misinformation, or if the specification itself has flaws that can be exploited. The published literature (such as Literature Reference Nos. 1 and 4) have shown that both of these flaws (i.e., implementation flaws and specification flaws) are common.
[00014] Thus, a continuing need exists for a system that enables protocol agnostic detection of misinformation at the control plane, including targeted
misinformation.
[00015] SUMMARY OF THE INVENTION
[00016] The present invention relates to a system for detecting sources of
misinformation in mobile wireless networks and, more particularly, to a system for detecting sources of misinformation in mobile wireless networks based on motif analysis. The system comprises one or more processors and a memory having instructions such that when the instructions are executed, the one or more processors perform multiple operations. A hierarchical representation of activity of a communication network is used to detect and predict sources of misinformation in the communication network. The hierarchical representation comprises a plurality of nodes and temporal patterns of communication between at least one pair of nodes, each temporal pattern representing a motif, having a size, in the hierarchical representation. Changes in motifs provide a signal for a misinformation attack.
[00017] In another aspect, a visual representation on a display relating to motifs of interest is generated to identify a misinformation attack.
[00018] In another aspect, a misinformation attack is characterized by an over- representation of motifs having a predetermined size.
[00019] In another aspect, a size threshold for detection of a misinformation attack is set by learning a maximum frequency of motifs of each size in a normal baseline operation of the communication network.
[00020] In another aspect, if a frequency of any motif size surpasses double the maximum frequency, a misinformation attack signal is detected.
[00021] In another aspect, the system introduces a motif attribution measure at each node / of the communication~network. For each node z, wz- is defined as a frequency of sub-graphs to which it contributes. A TW; greater than double the maximum frequency indicates a likelihood that node i is an attacker.
[00022] In another aspect, the hierarchical representation comprises a plurality of data tables that describe applications and services running on the communication network and a set of inter-dependencies between the applications and services. [00023] In another aspect, upon detection of an attack of misinformation on the communication network, the system performs a mitigation action.
[00024] In another aspect, the mitigation action comprises isolating an attacking node from the rest of the communication network.
[00025] In another aspect, the present invention also comprises a method for causing a processor to perform the operations described herein.
[00026] Finally, in yet another aspect, the present invention also comprises a computer program product comprising computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having a processor for causing the processor to perform the operations described herein.
[00027] BRIEF DESCRIPTION OF THE DRAWINGS
[00028] The file of this patent or patent application publication contains at least one drawing executed in color. Copies of this patent or patent application publication with color drawing(s) will be provided by the Office upon request and payment of the necessary fee.
[00029] The objects, features and advantages of the present invention will be
apparent from the following detailed descriptions of the various aspects of the invention in conjunction with reference to the following drawings, where:
[00030] FIG. 1 is a block diagram depicting the components of a system for detecting sources of misinformation in mobile wireless networks according to various embodiments of the present disclosure;
[00031 ] FIG. 2 is an illustration of a computer program product according to various embodiments of the present disclosure;
[00032] FIG. 3 is an illustration of network motif size frequencies according to
various embodiments of the present disclosure;
[00033] FIG. 4 is an illustration of a barcode of sub-graphs for regular and attacking patterns in FIG. 3 according to various embodiments of the present disclosure;
[00034] FIG. 5A is an illustration of a sample graph according to various embodiments of the present disclosure;
[00035] FIG. 5B is an illustration of finding all sub-graphs with the sample graph in FIG. 5A according to various embodiments of the present disclosure;
[00036] FIG. 6 is a table illustrating pseudo-code of the Enumerate Subgraph (ESU) algorithm for finding sub-graphs according to various embodiments of the present disclosure;
[00037] FIG. 7A is a plot illustrating motif size frequency during reset attacks according to various embodiments of the present disclosure;
[00038] FIG. 7B is a plot illustrating motif size frequency during flood attacks according to various embodiments of the present disclosure;
[00039] FIG. 8 is a plot illustrating attribution in a 6 node example using motifs of size 3 according to various embodiments of the present disclosure; and [00040] FIG. 9 is a flow diagram illustrating a method to detect attacks on mobile wireless networks according to various embodiments of the present disclosure.
[00041 ] DETAILED DESCRIPTION
[00042] The present invention relates to a system for detecting sources of
misinformation in mobile wireless networks and, more particularly, to a system for detecting sources of misinformation in mobile wireless networks based on motif analysis. The following description is presented to enable one of ordinary skill in the art to make and use the invention and to incorporate it in the context
of particular applications. Various modifications, as well as a variety of uses in different applications will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to a wide range of aspects. Thus, the present invention is not intended to be limited to the aspects presented, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
[00043] In the following detailed description, numerous specific details are set forth in order to provide a more thorough understanding of the present invention. However, it will be apparent to one skilled in the art that the present invention may be practiced without necessarily being limited to these specific details. In other instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present invention. [00044] The reader's attention is directed to all papers and documents which are filed concurrently with this specification and which are open to public inspection with this specification, and the contents of all such papers and documents are incorporated herein by reference. All the features disclosed in this specification, (including any accompanying claims, abstract, and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise. Thus, unless expressly stated otherwise, each feature disclosed is one example only of a generic series of equivalent or similar features. [00045] Furthermore, any element in a claim that does not explicitly state "means for" performing a specified function, or "step for" performing a specific function, is not to be interpreted as a "means" or "step" clause as specified in 35 U.S.C. Section 1 12, Paragraph 6. In particular, the use of "step of or "act of in
the claims herein is not intended to invoke the provisions of 35 U.S.C. 112, Paragraph 6.
[00046] Please note, if used, the labels left, right, front, back, top, bottom, forward, reverse, clockwise and counter-clockwise have been used for convenience purposes only and are not intended to imply any particular fixed direction. Instead, they are used to reflect relative locations and/or directions between various portions of an object. As such, as the present invention is changed, the above labels may change their orientation.
[00047] Before describing the invention in detail, first a list of incorporated literature references as used in the description is provided. Next, a description of various principal aspects of the present invention is provided. Finally, specific details of the present invention are provided to give an understanding of the specific aspects.
[00048] ( 1 ) List of Incorporated Literature References
[00049] The following references are incorporated and cited throughout this
application. For clarity and convenience, the references are listed herein as a central resource for the reader. The following references are hereby
incorporated by reference as though fully included herein. The references are cited in the application by referring to the corresponding literature reference number, as follows:
J.-P. Hubaux, L. Buttyan, and S. Capkun, "The quest for security in mobile ad hoc networks," in Proceedings of the 2nd ACM international symposium on Mobile ad hoc networking & computing. ACM, 2001, pp. 146-155.
2. S. Marti, T. J. Giuli, K. Lai, M. Baker et al., "Mitigating routing misbehavior in mobile ad hoc networks," in International Conference on Mobile Computing and Networking: Proceedings of the 6th annual international conference on Mobile computing and networking, vol. 6, no. 11, 2000, pp. 255-265.
3. H. Yang, J. Shu, X. Meng, and S. Lu, "Scan: self-organized network- layer security in mobile ad hoc networks," Selected Areas in Communications, IEEE Journal on, vol. 24, no. 2, pp. 261-273, 2006.
4. Y. Zhang and W. Lee, "Security in mobile ad-hoc networks," in Ad Hoc Networks. Springer, 2005, pp. 249-268.
5. K. E. Defrawy and G. Tsudik, "Anonymous location aided routing in suspicious MANETs,"-IEEE Transactions on Mobile -Computing (IEEE TMC), vol. 10, no. 9, September 201 1.
6. Wernicke, Sebastian. "Efficient Detection of Network Motifs."
IEEE/ ACM Trans. Computational Biol. Bioinformatics 3, no. 4 (October 2006): 347-59. doi:10.1109/TCBB.2006.51.
7. Ribeiro, Pedro, and Fernando Silva. "G-Tries: An Efficient Data Structure for Discovering Network Motifs." In Proceedings of the 2010 ACM Symposium on Applied Computing, 1559-66. SAC '10. New York, NY, US A: ACM, 2010. doi: 10.1145/1774088.1774422.
8. McKay, Brendan D. "Isomorph-Free Exhaustive Generation." Journal of Algorithms 26, no. 2 (February 1998): 306-24.
doi: 10.1006/jagm.1997.0898.
[00050] (2) Principal Aspects
[00051 ] The present invention has three "principal" aspects. The first is a system for detecting sources of misinformation in mobile wireless networks. The system is typically in the form of a computer system operating software or in the form of a "hard-coded" instruction set. This system may be incorporated into a wide
variety of devices that provide different functionalities. The second principal aspect is a method, typically in the form of software, operated using a data processing system (computer). The third principal aspect is a computer program product. The computer program product generally represents computer-readable instructions stored on a non-transitory computer-readable medium such as an optical storage device, e.g., a compact disc (CD) or digital versatile disc (DVD), or a magnetic storage device such as a floppy disk or magnetic tape. Other, non- limiting examples of computer-readable media include hard disks, read-only memory (ROM), and flash-type memories. These aspects will be described in more detail below.
[00052] A block diagram depicting an example of a system (i.e., computer system
100) of the present invention is provided in FIG. 1. The computer system 100 is configured to perform calculations, processes, operations, and/or functions associated with a program or algorithm. In one aspect, certain processes and steps discussed herein are realized as a series of instructions (e.g., software program) that reside within computer readable memory units and are executed by one or more processors of the computer system 100. When executed, the instructions cause the computer system 100 to perform specific actions and exhibit specific behavior, such as described herein.
[00053] The computer system 100 may include an address/data bus 102 that is
configured to communicate information. Additionally, one or more data processing units, such as a processor 104 (or processors), are coupled with the address/data bus 102. The processor 104 is configured to process information and instructions. In an aspect, the processor 104 is a microprocessor.
Alternatively, the processor 104 may be a different type of processor such as a parallel processor, or a field programmable gate array.
[00054] The computer system 100 is configured to utilize one or more data storage units. The computer system 100 may include a volatile memory unit 106 (e.g., random access memory ("RAM"), static RAM, dynamic RAM, etc.) coupled with the address/data bus 102, wherein a volatile memory unit 106 is configured to store information and instructions for the processor 104. The computer system 100 further may include a non-volatile memory unit 108 (e.g., read-only memory ("ROM"), programmable ROM ("PROM"), erasable programmable ROM ("EPROM"), electrically erasable programmable ROM "EEPROM"), flash memory, etc.) coupled with the address/data bus 102, wherein the nonvolatile memory unit 108 is configured to store static information and instructions for the processor 104. Alternatively, the computer system 100 may execute instructions retrieved from an online, data storage unit such as -in "Cloud" computing. In an aspect, the computer system 100 also may include one or more interfaces, such as an interface 110, coupled with the address/data bus 102. The one or more interfaces are configured to enable the computer system 100 to interface with other electronic devices and computer systems. The communication interfaces implemented by the one or more interfaces may include wireline (e.g., serial cables, modems, network adaptors, etc.) and/or wireless (e.g., wireless modems, wireless network adaptors, etc.) communication technology.
[00055] In one aspect, the computer system 100 may include an input device 112 coupled with the address/data bus 102, wherein the input device 112 is configured to communicate information and command selections to the processor 100. In accordance with one aspect, the input device 112 is an alphanumeric input device, such as a keyboard, that may include alphanumeric and/or function keys. Alternatively, the input device 112 may be an input device other than an alphanumeric input device. For example, the input device 112 may include one or more sensors, such as a camera for video or still images,
a microphone, or a neural sensor. Other example input devices 112 may include an accelerometer, a GPS sensor, or a gyroscope.
[00056] In an aspect, the computer system 100 may include a cursor control device 114 coupled with the address/data bus 102, wherein the cursor control device 114 is configured to communicate user input information and/or command selections to the processor 100. In an aspect, the cursor control device 114 is implemented using a device such as a mouse, a track-ball, a track-pad, an optical tracking device, or a touch screen. The foregoing notwithstanding, in an aspect, the cursor control device 114 is directed and/or activated via input from the input device 1 12, such as in response to the use of special keys and key sequence commands L associated with the input device 112. In an alternative aspect, the cursor control device 114 is configured to be directed or guided by voice commands.
[00057] In an aspect, the computer system 100 further may include one or more
optional computer usable data storage devices, such as a storage device 1 16, coupled with the address/data bus 102. The storage device 1 16 is configured to store information and/or computer executable instructions. In one aspect, the storage device 116 is a storage device such as a magnetic or optical disk drive (e.g., hard disk drive ("HDD"), floppy diskette, compact disk read only memory ("CD-ROM"), digital versatile disk ("DVD")). Pursuant to one aspect, a display device 1 18 is coupled with the address/data bus 102, wherein the display device 1 18 is configured to display video and/or graphics. In an aspect, the display device 1 18 may include a cathode ray tube ("CRT"), liquid crystal display ("LCD"), field emission display ("FED"), plasma display, or any other display device suitable for displaying video and/or graphic images and alphanumeric characters recognizable to a user.
[00058] The computer system 100 presented herein is an example computing environment in accordance with an aspect. However, the non-limiting example of the computer system 100 is not strictly limited to being a computer system. For example, an aspect provides that the computer system 100 represents a type of data processing analysis that may be used in accordance with various aspects described herein. Moreover, other computing systems may also be
implemented. Indeed, the spirit and scope of the present technology is not limited to any single data processing environment. Thus, in an aspect, one or more operations of various aspects of the present technology are controlled or implemented using computer-executable instructions, such as program modules, being executed by a computer. In one implementation, such program modules include routines, programs, objects, components and/or data structures that are configured to perform particular tasks or implement particular abstract data types. In addition, an aspect provides that one or more aspects of the present technology are implemented by utilizing one or more distributed computing environments, such as where tasks are performed by remote processing devices that are linked through a communications network, or such as where various program modules are located in both local and remote computer-storage media including memory-storage devices.
[00059] An illustrative diagram of a computer program product (i.e., storage device) embodying the present invention is depicted in FIG. 2. The computer program product is depicted as floppy disk 200 or an optical disk 202 such as a CD or DVD. However, as mentioned previously, the computer program product generally represents computer-readable instructions stored on any compatible non-transitory computer-readable medium. The term "instructions" as used with respect to this invention generally indicates a set of operations to be performed on a computer, and may represent pieces of a whole program or individual, separable, software modules. Non-limiting examples of "instruction" include
computer program code (source or object code) and "hard-coded" electronics (i.e. computer operations coded into a computer chip). The "instruction" is stored on any non-transitory computer-readable medium, such as in the memory of a computer or on a floppy disk, a CD-ROM, and a flash drive. In either event, the instructions are encoded on a non-transitory computer-readable medium.
[00060] (3) Specific Details of the Invention
[00061] The exploitation network (Xnet) is a hierarchical model of a network (a network of networks) that provides three different views of the network, linked together by directional links. Xnet is described in detail in U.S. Patent
Application No. 14/625,988, which is hereby incorporated by reference as though fully set forth herein. The model includes an application dependency— layer and a network dependency layer in addition to the network topology itself. Xnet moves the problem out of the realm of conventional wireless networking techniques, which are focused on throughput between pairs of nodes, into a representation that enables a more holistic behavioral treatment. This transfer to the representation is the foundation that enables the social networking and information dynamics approach of the present invention. The system according to embodiments of the invention relies on the Xnet hierarchical model of network activity.
[00062] The Xnet model includes at least four unique modules, including the Xnet Dynamics (XD) module, the Xnet Controllability/Observability (XCO) module, the Xnet Evolvability (XE) module, and (4) the Reliability Estimation (RE) module. The XD module identifies unreliable nodes based on the dynamics of social networks (with no dependency on protocol) to indicate the presence of malicious or damaged nodes altering control and data plane information in the network. The XCO module identifies the optimal set of nodes required to passively monitor (observability) or actively probe (controllability) a suspected
source of misinformation. These techniques require significantly fewer nodes (i.e., lower overhead than the prior art) to form a consensus on whether a suspected source of misinformation is malicious without compromising accuracy (increased probability of detection, lowered probability of false alarms). The XE module simulates a progression of failures to predict which nodes are most likely to be attacked next or should have trust reassessed.
Finally, the RE module fuses cross-layer and cross-plane (control and data plane) information to identify suspicious nodes and improve reputation-based trust management. The unified trust metric is computed in a hybrid approach in which nodes combine normalized confidence and trust values based on direct experience and recommendations of other nodes. Such a hybrid approach -avoids a centralized point of failure, ensures scalability, and renders the computation resilient to attacks targeting such computations. These modules are described in further detail below.
[00063] All modules communicate by annotations on Xnet. The XD module
identifies nodes that appear to be misbehaving. The RE module gets a minimal set of driver and observer nodes from the XCO module for the suspect nodes. The RE module uses the driver nodes to do active probing on the suspect nodes, and the observer nodes update a trust metric with the results. The XE module simulates a spread of compromised nodes
[00064] The RE module formalizes and quantifies trust using a model that relies on local computations based on direct interactions with neighbors and also by incorporating recommendations (and experiences) of other nodes. A formal subjective logic and trust model is leveraged for principled combination of evidence about how trustworthy a node is. Resilience to attacks is gained by adopting a hybrid distributed approach to compute trust, avoiding a single point of failure, and the approach is agnostic to control and/or data plane statistics
being used. When the RE module's trust in a node falls below a certain level, it performs active probing on the node. To do that most efficiently the XCO module computes a minimal set of driver nodes to issue the challenges and observer nodes to observe the results.
[00065] The system also employs a two-pronged approach to discover sources of misinformation in the network, employing information dynamics identification of suspicious changes in Xnet dependencies, as well as trends in the appearance of such compromised nodes. First the XD module uses a unique information dynamic spectrum framework to predict system instability at critical transitions in complex systems, by analyzing Xnet time series data. This marks nodes for further inspection by the RE module. Second, the XE module tracks trends in misbehaving nodes, and matches against simulations of contagion and cascading failures. The XE module will emit a confidence measure as to whether there is a pattern, and if so, the RE module can focus monitoring and testing resources on predicted next nodes to be attacked. System Administrators can use this information to focus preventative measures.
[00066] (3.1) Concept of Operation
[00067] Below is a description of operation of the Xnet tool described in U.S. Patent Application No. 14/625,988, with a non-limiting example of a notional mission that progresses in distinct stages from initialization to deployment, fielded operation, and cyber attack. In particular, cyber attacks on the "control plane" of the network, which are the software systems and protocols that are responsible for managing how information in the "data plane" is communicated across the network. For example, one software system that is critical to the operation of a mobile wireless network is the routing daemon, which is responsible for maintaining the routing tables that each node in the physical network uses to determine how to relay data from one node to another.
[00068] In some embodiments, during an initialization stage, network administrators configure each node of a network (e.g., mobile wireless network) with compatible networking stacks, host and network services, applications, and other software necessary for the mission, including suite of modules with supporting configuration data. Then, the hierarchical representation of the network (i.e., Xnet), is created in the form of data tables that describe the applications and services that are running on the network, their inter-dependencies, and observable characteristics of their behavioral dynamics under normal operation (e.g., node degree, traffic flow characteristics, topology). The Xnet Motifs (XM) module receives the Application Dependency (AppDep) and Network Dependency (NetDep) graph from Xnet— For further details regarding Xnet, refer to U.S. Patent Application No. 14/625,988, which is hereby incorporated by reference in its entirety.
[00069] In a nominal (fielded) stage, the XM module monitors the dynamics of the AppDep and NetDep graphs by collecting time-series data on statistics identified in its baseline configuration. It will develop baseline frequencies for each size of motif that occurs during a set quantum of time (e.g., time quantum of 10 seconds). This will include keeping track of typical temporal sequences of motifs.
[00070] In a detection phase of an attack stage, a compromised node will attract the attention of the XM module, which will observe a sudden change in the frequency of motif sizes. For example, malicious dropping of packets at a node will result in a step-change in the load between applications and services that depend on that node. For example, the attacking node's dropping of packets can be observed directly at the media access control (MAC) layer by monitoring the channel and observing whether the node is forwarding packets to the next hop.
[00071] In an attribution phase of an attack stage, by comparing the patterns of detections at different points within the abstract and real network, the compromised nodes may be revealed. For example, nodes that are common in motifs labeled as anomalous and/or that share an edge that has been detected as having anomalous dynamics are classified as suspects. The abstract network (or graph) refers to the abstract mathematical representation of the relationship between communicating entities in a physical network (i.e., a real network comprising physical nodes (e.g., radios)).
[00072] (3.2) Network Motifs
[00073] As described above, the Xnet is a hierarchical-network of network graphs whose nodes include the physical radios communicating on the network as well as conceptual nodes that represent communicating network entities, such as applications and network services. Edges between nodes are created whenever one of these nodes sends data to another node (just the start and end node, not the intermediate nodes that forward the message datagrams). An edge exists until the message reaches its destination. Network motifs are temporal patterns of communication between nodes. Network activity is divided into windows of time. During each window, if an edge appears between two nodes, it can be counted in motifs for that window. Network motifs are recurrent and statistically significant sub-graphs or patterns of communication between the subsets of nodes that work together. Each of these sub-graphs, defined by a particular pattern of interactions between vertices, may reflect a framework in which particular communication protocols are achieved efficiently. Indeed, motifs are of notable importance largely because they capture the underlying communication structure of a wireless network. Changes in the histogram of motif sizes provide a characteristic signal for certain types of attacks. When
attacks happen, different recurrent sub-graphs would reflect changes in the network communication pattern and, consequently, result in the detection.
[00074] (3.2.1 ) Problem Definition
[00075] Let G = (V, E) and G' = (Ε', V) be two graphs. V denotes vertices (also referred to as "nodes" when discussed in the context of the abstract network). E denotes edges (also referred to as "links"). Graph G' is a sub-graph of graph G (written as G' c G) if V <≡ V and E' £ E Π (V χ V). If
G' £ G and G' contains all of the edges <u, v> £ E with u, v £ V, then G' is an induced sub-graph of G. Call G' and G isomorphic (written as G' <→ G), if there exists a bijection (one-to-one) f: V'→V with <u, v> £ E' <=> <f(u), f(v)> £ E for all u, v€ VV he mapping f is called an isomorphism between G and G'. When G" c G and there exist an isomorphism between the sub-graph G" and a graph G', this mapping represents an appearance of G' in G. The number of appearances of graph G' in G is called the frequency of G' in G.
[00076] FIG. 3 is a graph illustrating network motif size frequencies during attack vs. normative, demonstrating FG(G') for both regular and attack patterns. Regular patterns are represented by unfilled bars, while attack patterns are represented by filled bars. FIG. 3 indicates that it is unlikely to find large motifs (size > 5) in a regular communication network (as indicated by the absence of regular patterns) compared to the one under flooding attacks (as indicated by the presence of attack patterns), suggesting a potential attack detector. To be precise, barcodes of notable motifs for different communications were defined that allow one to identify attacks. FIG. 4 is an illustration of a barcode 400 of sub-graphs for regular and attacking patterns in FIG. 3, where the top sub-graph 402 represents regular patterns, and the bottoms sub-graph 404 represents attack patterns.
[00077] Motifs are those sub-graphs with the frequency FG(G') greater than a predefined threshold or cut-off value. Traditionally, the threshold is determined by comparing to a null model, such as the recurrent frequency of the same subgraph in a randomized graph. However, this definition is not appropriate for mobile networking problems. Indeed, one goal here is to distinguish frequent sub-graphs in regular and attack patterns. Yet, even in the communication network running under normal conditions, FG(G') may be very different from a completely random graph model. Therefore, the approach according to embodiments of the present invention takes FG(G') of the regular pattern as the null model. An abnormal pattern will be detected if its FG(G') significantly deviates from the null model defined above.
[00078] (3.2.2) Motif Discovery Algorithms
[00079] The success of analysis in the present invention relies on sufficient motif discovery algorithms. In this section, two broadly adopted algorithms that can be used are introduced as non-limiting examples of motif discovery algorithms, including the algorithm ESU (described in Literature Reference No. 6) and the algorithm G-Tries (described in Literature Reference No. 7). FIG. 5A depicts a sample graph, and FIG. 5B depicts the ESU (Enumerate Subgraph) algorithmic process of finding all sub-graphs with three nodes (where nodes are represented by numbered circles) in FIG. 5A.
[00080] The tree in FIG. 5B shows the enumerated subgraphs at the leaves (the very bottom row) for the graph in FIG. 5A of size k=3 (i.e. in each subgraph there are exactly 3 vertices). The depth of the tree starts at 0 for the root 500, and increments by 1 for each row below. Since the height of the tree defines the size of the subgraphs that it enumerates, the depth is also the same as the size (i.e. depth = k).
[00081 ] In the example depicted in FIG. 5B, the root 500 is k=0, the next row of boxes (element 502) ([({ 1 }, {3 })]... ) are k=l, the next row of boxes (element 504) are k=2, and the leaves (the bottom row of graphs (element 506)) are k=3. Note that there are exactly 3 vertices in each graph of each leaf (i.e., subgraphs of size k=3, are present at depth k=3 of the tree).
[00082] The term SUB is the name for the left-most set shown in each box, and the term EXT is the name for the right-most set in each box. Thus, for example, for the left-most box 508 in the row for k=2, would be labeled:
SUB = {1,3}
EXT = {4,5}.
[00083] The term SUB represents the current subgraph for the box. The term EXT represents the possible set of nodes that can be used to extend the subgraph. Thus, for the example above,
SUB = (l)-(3) is the subgraph, and
EXT = (4) and (5) are the nodes that can be used to extend this subgraph, as follows:
(l)-(3)-(4) is the extension of SUB = (l)-(3) with EXT = (4)
(l)-(3)-(5) is the extension of SUB = (l)-(3) with EXT = (5).
[00084] The algorithm ESU first finds the set of all induced sub-graphs of size k; let Sk be this set. ESU can be implemented as a recursive function. The running of this function can be displayed as a tree-like structure of depth k, called the ESU-Tree, as depicted in FIG. 5B. Each of the ESU-Tree nodes (represented by boxes) indicate the status of the recursive function that entails two consecutive
sets, SUB and EXT. SUB refers to nodes in the target network that are adjacent and establish a partial sub-graph of size |SUB| < k. If |SUB| = k, the algorithm has found an induced complete sub-graph, so Sk = SUB U Sk. However, if I SUB I < k, the algorithm must expand SUB to achieve cardinality k. This is done by the EXT set that contains all the nodes that satisfy two conditions.
[00085] First, each of the nodes in EXT must be adjacent to at least one of the nodes in SUB; second, their numerical labels must be larger than the labels of SUB nodes. The first condition makes sure that the expansion of SUB nodes yields a connected graph and the second condition causes ESU-Tree leaves (the bottom row of graphs (element 506)) to be distinct. As a result, overcounting is prevented. Note that, the EXT set is-not a static set, so in each step it may expand by some new nodes that do not breach the two conditions. [00086] The next step of ESU involves classification of sub-graphs placed in the
ESU-Tree leafs into non-isomorphic size-k graph classes. Consequently, ESU determines sub-graphs frequencies and concentrations. This stage has been implemented simply by employing McKay's nauty algorithm (see Literature Reference No. 8 for a description of this algorithm), which classifies each sub- graph by performing a graph isomorphism test. Therefore, ESU finds the set of all induced k-size sub-graphs in a target graph by a recursive algorithm and then determines their frequency using an efficient tool.
[00087] The algorithm G-Tries is another motif discovery algorithm that may be utilized. G-Tries constructs a multiway tree (referred to as a g-trie) that can store a collection of graphs. Each tree node contains information about a single graph vertex and its corresponding edges to ancestor nodes. A path from the root to a leaf corresponds to one single graph. Descendants of a g-trie node share a common sub-graph. After constructing a g-trie, the counting part takes
place. This is conceptually akin to a prefix tree, which stores sub-graphs according to their structures and finds occurrences of each of these sub-graphs in a larger graph. The main idea in the counting process is to backtrack by all possible sub-graphs, but at the same time do the isomorphism tests. The process takes advantage of common substructures in the sense that at a given time there is a partial isomorphic match for several different candidate sub-graphs.
[00088] G-Tries does not need to find those sub-graphs that are not in the main
network, which can be one of the time-consuming parts in algorithms in which all sub-graphs in networks are derived. However, the tradeoff is the excessive use of memory, which might limit the size of discoverable motifs by a personal computer with average memory.
[00089] (3.2.3) Implementation and Time Complexity
[00090] To integrate the motif discovery algorithm with the attack detection package (i.e., the detection portion of the Xnet tool described in U.S. Patent Application No. 14/625,988) according to embodiments of the present disclosure, an open source package gtrieScanner (described in Literature Reference No. 7), that has implemented both ESU and G-Tries algorithms, was used. The G-Tries algorithm requires lower central processing unit (CPU) time. Yet, the two algorithms have similar computational complexity and, therefore, one embodiment of the detection package is based on the simpler ESU algorithm (see FIG. 6 for a table containing its pseudo-code implemented by gtrieScanner).
[00091 ] The practical usefulness of the approach described herein strongly relies on the scalability of motif discovery algorithms, such as ESU and G-Tries algorithms. The time complexity of the algorithm depends mainly on two parameters, graph size N, and sub-graph size n. It is well known that all motif discovery algorithms scale superpolynomially with the sub-graph size n.
Therefore, the motif size cannot be increased to very large values. However, the approach according to embodiments of the present disclosure works very well analyzing sub-graph sizes n < 9, which is tractable. While the computational complexity in terms of the graph size N is theoretically unknown, judging from numerical results from previous work, it might be concluded that it scales as 0(N*M) (with a fixed motif size n), where N is the number of nodes and M is the total numbers of motifs of the underlying network. For most communication networks explored, the graph is sparse and M linearly scales with N, leading to an overall time complexity 0(N2) in terms of the whole network size (i.e., the number of devices).
[00092] (3.3) Attack detection and. Attribution with Motif Analysis
[00093] FIGs. 7A and 7B plot the frequency of motifs of each size during a reset (web) (FIG. 7A) and flooding (TTCP) (FIG. 7B) attack. The "reset" attack sends a special type of TCP packet that essentially forces a TCP connection to "reset", or close unnecessarily. The "flooding" attack creates a large volume of unnecessary network traffic that causes a "denial-of-service" of the network. The distinct curve colors represent distinct motif sizes, as indicated in FIGs. 7A and 7B. Motif frequency measures the number of motifs occurring in a unit time. In a reset (web) attack, smaller motifs increase in frequency. In a flood attack (FIG. 7B), it is motifs greater than size 5 that predominate. In general, attacks (represented by peaks) are characterized by an over-representation of larger motifs (size > 5). The threshold for detection of an attack is set by learning the maximum frequency of motifs of each size in normal baseline operation of the network. If the frequency of any motif size surpasses double the maximum frequency seen in baseline conditions, an attack condition is detected.
[00094] To locate the actual attacker within the network (called "attribution"), a motif attribution measure at each node is further introduced. For each node , /»,· is defined as the frequency of sub-graphs it contributes to. Again, a large w;
(greater than double the maximum seen in baseline conditions) indicates a high likelihood that node is an attacker. FIG. 8 plots the motif attribution rrij at the
TTCP layer in a 6 node example using motifs of size 3 for five non-attackers and one attacking node that performed a blackhole attack after 500 milliseconds (ms). A "blackhole" attack has the ultimate goals of 1) forcing all routes to go through the attacking physical node (i.e., the node "captures" all of the routes between all other pairs of nodes in the network), and 2) dropping all of the subsequent data traffic that comes across those routes. Thus, this is similar in concept to how the extreme gravity of a blackhole pulls all matter into it and (seemingly) destroys it. Distinct curve colors represent the 5 non-attacking nodes and the one attacking node 800. The plot shows a clear signal (i.e., spike) only for the attacking node 800 when the attack happens. Here the attacking node 800 clearly stands out because the frequency of motifs of size 3 at that node increases nearly 4 times as much as any other node.
[00095] FIG. 9 is a flow diagram of the method to detect attack on networks
according to some embodiments of the present disclosure. As described above, in a first step 900, a hierarchical representation of network activity is generated. In a second step 902, changes in the size of temporal motifs in the hierarchical representation are detected. In a third step 904, sources of misinformation in the communication network are detected and predicted.
[00096] Mobile wireless networks experience widespread use in applications, non- limiting examples of which include mobile military and law enforcement
networks (soldier-to-soldier, sensor-to-sensor, ground and aerial vehicle-to- vehicle); commercial vehicle- to- vehicle and vehicle-to-infrastructure networks; commercial mesh networks; wireless infrastructure ISPs, and cellular companies (extended data capacity). The invention described herein will significantly improve the security of these and other related networks, which currently rely predominantly on packet-level encryption to reduce the probability of external intrusion but do not detect or prevent "network insider" attacks.
[00097] In an embodiment, after identifying the presence of misinformation in the network, the system performs an operation to attribute who is responsible for the attack. After attributing the attack to an entity, the system can take actions to mitigate the attack. A non-limiting example of a mitigation action would be to isolate the attacking node (i.e., physical radio). For example, the action can include informing every other node in the network to simply ignore anything that the attacking node transmits, and not to send anything to, or through, the attacking node.
[00098] Implementation of the system described herein takes the form of a set of algorithms that provides rapid and accurate detection and prediction of sources of misinformation in the control plane of a wireless network. The
algorithms/modules are protocol agnostic characteristics of the tool that will enable its transition into a wide variety of network security systems, including both wireless and wired networks. Furthermore, the inherent scalability of the approach makes it well-suited to operate effortlessly in much larger networks.
[00099] Finally, while this invention has been described in terms of several
embodiments, one of ordinary skill in the art will readily recognize that the invention may have other applications in other environments. It should be noted that many embodiments and implementations are possible. Further, the
following claims are in no way intended to limit the scope of the present invention to the specific embodiments described above. In addition, any recitation of "means for" is intended to evoke a means-plus-function reading of an element and a claim, whereas, any elements that do not specifically use the recitation "means for", are not intended to be read as means-plus-function elements, even if the claim otherwise includes the word "means". Further, while particular method steps have been recited in a particular order, the method steps may occur in any desired order and fall within the scope of the present invention.
Claims
1. A system for detecting attacks on networks, the system comprising:
one or more processors and a non-transitory memory having instructions encoded thereon such that when the instructions are executed, the one or more processors perform operations of:
detecting and predicting sources of misinformation in a communication network using a hierarchical representation of activity of the communication network; wherein the hierarchical representation comprises a plurality of nodes and temporal patterns of communication between at least one pair of nodes, each temporal pattern representing a motif, having a size, in the hierarchical representation, and
wherein changes in motifs provide a signal for a misinformation attack.
2. The system as set forth in Claim 1, wherein the one or more processors further perform an operation of generating a visual representation on a display relating to motifs of interest to identify a misinformation attack.
3. The system as set forth in Claim 2, wherein a misinformation attack is characterized by an over-representation of motifs having a predetermined size.
4. The system as set forth in Claim 3, wherein a size threshold for detection of a misinformation attack is set by learning a maximum frequency of motifs of each size in a normal baseline operation of the communication network,
5. The system as set forth in claim 4, wherein if a frequency of any motif size surpasses double the maximum frequency, a misinformation attack signal is detected.
6. The system as set forth in Claim 5, wherein the one more processors further perform operations of:
introducing a motif attribution measure at each node of the communication network; and
for each node , defining as a frequency of sub-graphs to which it contributes; wherein a wz- greater than double the maximum frequency indicates a likelihood that node i is an attacker.
7. The system as set forth in Claim 1, wherein the hierarchical representation
comprises a plurality of data tables that describe applications and services running on the communication network and a set of inter-dependencies between the applications and services.
8. A computer-implemented method for detecting attacks on networks, comprising:
an act of causing one or more processors to execute instructions stored on a non-transitory memory such that upon execution, the one or more processors perform operations of:
detecting and predicting sources of misinformation in a communication network using a hierarchical representation of activity of the communication network;
wherein the hierarchical representation comprises a plurality of nodes and temporal patterns of communication between at least one pair of nodes, each temporal pattern representing a motif, having a size, in the hierarchical representation, and
wherein changes in motifs provide a signal for a misinformation attack.
9. The method as set forth in Claim 8, wherein the one or more processors further perform an operation of generating a visual representation on a display relating to motifs of interest to identify a misinformation attack.
10. The method as set forth in Claim 9, wherein a misinformation attack is
characterized by an over-representation of motifs having a predetermined size.
1 1. The method as set forth in Claim 10, wherein a size threshold for detection of a misinformation attack is set by learning a maximum frequency of motifs of each size in a normal baseline operation of the communication network.
12. The method as set forth in Claim 11 , wherein if a frequency of any motif size surpasses double the maximum frequency, a misinformation attack signal is detected.
13. The method as set forth in Claim 12, wherein the one or more processors further perform operations of:
introducing a motif attribution measure at each node i of the communication network; and
for each node /', defining w,- as a frequency of sub-graphs to which it contributes; wherein a WJ greater than double the maximum frequency indicates a likelihood that node is an attacker.
14. The method as set forth in Claim 8, wherein the hierarchical representation
comprises a plurality of data tables that describe applications and services running on the communication network and a set of inter-dependencies between the applications and services.
15. A computer program product for detecting attacks on networks, the computer
program product comprising:
computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having one or more processors for causing the processor to perform operations of:
detecting and predicting sources of misinformation in a communication network using a hierarchical representation of activity of the communication network;
wherein the hierarchical representation comprises a plurality of nodes and temporal patterns of communication between at least one pair of nodes, each temporal pattern representing a motif, having a size, in the hierarchical representation, and
wherein changes in motifs provide a signal for a misinformation attack.
16. The computer program product as set forth in Claim 15, further comprising instructions for causing the one or more processors to perform an operation of generating a visual representation on a display relating to motifs of interest to identify a misinformation attack.
17. The computer program product as set forth in Claim 16, wherein a misinformation attack is characterized by an over-representation of motifs having a predetermined size.
18. The computer program product as set forth in Claim 17, wherein a size threshold for detection of a misinformation attack is set by learning a maximum frequency of motifs of each size in a normal baseline operation of the communication network.
19. The computer program product as set forth in Claim 18, wherein if a frequency of any motif size surpasses double the maximum frequency, a misinformation attack signal is detected.
20. The computer program product as set forth in Claim 19, further comprising instructions for causing the one or more processors to perform operations of:
introducing a motif attribution measure at each node of the communication network; and
for each node i, defining m\ as a frequency of sub-graphs to which it contributes; wherein a w greater than double the maximum frequency indicates a likelihood that node /' is an attacker.
The computer program product as set forth in Claim 15, wherein the hierarchical representation comprises a plurality of data tables that describe applications and services running on the communication network and a set of inter-dependencies between the applications and services.
22. The system as set forth in Claim 1, wherein upon detection of an attack of
misinformation on the communication network, the one or more processors further perform an operation of performing a mitigation action.
23. The system as set forth in Claim 22, wherein the mitigation action comprises
isolating an attacking node from the rest of the communication network.
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP16812077.2A EP3272102A4 (en) | 2015-03-18 | 2016-03-18 | System and method to detect attacks on mobile wireless networks based on motif analysis |
CN201680010942.5A CN107409124B (en) | 2015-03-18 | 2016-03-18 | System, method, and computer-readable storage medium for detecting attacks on a network |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201562135142P | 2015-03-18 | 2015-03-18 | |
US201562135136P | 2015-03-18 | 2015-03-18 | |
US62/135,136 | 2015-03-18 | ||
US62/135,142 | 2015-03-18 |
Publications (3)
Publication Number | Publication Date |
---|---|
WO2016204838A2 WO2016204838A2 (en) | 2016-12-22 |
WO2016204838A3 WO2016204838A3 (en) | 2017-01-26 |
WO2016204838A9 true WO2016204838A9 (en) | 2017-06-15 |
Family
ID=57546242
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2016/023308 WO2016204839A2 (en) | 2015-03-18 | 2016-03-18 | System and method to detect attacks on mobile wireless networks based on network controllability analysis |
PCT/US2016/023307 WO2016204838A2 (en) | 2015-03-18 | 2016-03-18 | System and method to detect attacks on mobile wireless networks based on motif analysis |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2016/023308 WO2016204839A2 (en) | 2015-03-18 | 2016-03-18 | System and method to detect attacks on mobile wireless networks based on network controllability analysis |
Country Status (3)
Country | Link |
---|---|
EP (2) | EP3272075A4 (en) |
CN (2) | CN107251519B (en) |
WO (2) | WO2016204839A2 (en) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10897471B2 (en) | 2018-01-30 | 2021-01-19 | Hewlett Packard Enterprise Development Lp | Indicating malicious entities based on multicast communication patterns |
CN110706743A (en) * | 2019-10-14 | 2020-01-17 | 福建师范大学 | Protein interaction network motif detection method for balanced sampling and graph retrieval |
Family Cites Families (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8327442B2 (en) * | 2002-12-24 | 2012-12-04 | Herz Frederick S M | System and method for a distributed application and network security system (SDI-SCAM) |
US7281270B2 (en) * | 2003-04-01 | 2007-10-09 | Lockheed Martin Corporation | Attack impact prediction system |
US7529187B1 (en) * | 2004-05-04 | 2009-05-05 | Symantec Corporation | Detecting network evasion and misinformation |
US20060230450A1 (en) * | 2005-03-31 | 2006-10-12 | Tian Bu | Methods and devices for defending a 3G wireless network against a signaling attack |
US7609625B2 (en) * | 2005-07-06 | 2009-10-27 | Fortinet, Inc. | Systems and methods for detecting and preventing flooding attacks in a network environment |
US20070180521A1 (en) * | 2006-01-31 | 2007-08-02 | International Business Machines Corporation | System and method for usage-based misinformation detection and response |
KR100767589B1 (en) * | 2006-07-20 | 2007-10-17 | 성균관대학교산학협력단 | Fuzzy logic anomaly detection scheme for directed diffusion based sensor networks |
US8655939B2 (en) * | 2007-01-05 | 2014-02-18 | Digital Doors, Inc. | Electromagnetic pulse (EMP) hardened information infrastructure with extractor, cloud dispersal, secure storage, content analysis and classification and method therefor |
CN101309180B (en) * | 2008-06-21 | 2010-12-08 | 华中科技大学 | Security network invasion detection system suitable for virtual machine environment |
US8850578B2 (en) * | 2008-08-06 | 2014-09-30 | International Business Machines Corporation | Network intrusion detection |
US8312542B2 (en) * | 2008-10-29 | 2012-11-13 | Lockheed Martin Corporation | Network intrusion detection using MDL compress for deep packet inspection |
US8245301B2 (en) * | 2009-09-15 | 2012-08-14 | Lockheed Martin Corporation | Network intrusion detection visualization |
US8245302B2 (en) * | 2009-09-15 | 2012-08-14 | Lockheed Martin Corporation | Network attack visualization and response through intelligent icons |
CN101800989B (en) * | 2010-01-19 | 2013-07-10 | 重庆邮电大学 | Anti-replay-attack system for industrial wireless network |
US8683591B2 (en) * | 2010-11-18 | 2014-03-25 | Nant Holdings Ip, Llc | Vector-based anomaly detection |
WO2012142287A2 (en) * | 2011-04-14 | 2012-10-18 | Lockheed Martin Corporation | Dynamically reconfigurable 2d topology communication and verification scheme |
US8560681B2 (en) * | 2011-05-10 | 2013-10-15 | Telefonica, S.A. | Method of characterizing a social network communication using motifs |
CN102869006B (en) * | 2012-09-13 | 2016-02-17 | 柳州职业技术学院 | Wireless sensor network hierarchical invasion Fault Diagnostic Expert System and method thereof |
WO2014118362A1 (en) * | 2013-02-01 | 2014-08-07 | Siemens Aktiengesellschaft | Method and apparatus for monitoring security intrusion of a distributed computer system |
CN104144063B (en) * | 2013-05-08 | 2018-08-10 | 朱烨 | Web portal security monitoring and alarming system based on log analysis and firewall security matrix |
CN104348811B (en) * | 2013-08-05 | 2018-01-26 | 深圳市腾讯计算机***有限公司 | Detecting method of distributed denial of service attacking and device |
CN103957525B (en) * | 2014-05-12 | 2018-02-27 | 江苏大学 | Malicious node detection method based on sub-clustering trust evaluation in car networking |
-
2016
- 2016-03-18 EP EP16812078.0A patent/EP3272075A4/en active Pending
- 2016-03-18 EP EP16812077.2A patent/EP3272102A4/en active Pending
- 2016-03-18 CN CN201680010741.5A patent/CN107251519B/en active Active
- 2016-03-18 CN CN201680010942.5A patent/CN107409124B/en active Active
- 2016-03-18 WO PCT/US2016/023308 patent/WO2016204839A2/en active Application Filing
- 2016-03-18 WO PCT/US2016/023307 patent/WO2016204838A2/en active Application Filing
Also Published As
Publication number | Publication date |
---|---|
CN107409124B (en) | 2020-09-15 |
WO2016204838A3 (en) | 2017-01-26 |
EP3272102A2 (en) | 2018-01-24 |
WO2016204838A2 (en) | 2016-12-22 |
CN107409124A (en) | 2017-11-28 |
WO2016204839A3 (en) | 2017-01-26 |
EP3272102A4 (en) | 2018-11-14 |
WO2016204839A2 (en) | 2016-12-22 |
CN107251519B (en) | 2020-06-12 |
CN107251519A (en) | 2017-10-13 |
EP3272075A4 (en) | 2018-12-05 |
EP3272075A2 (en) | 2018-01-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9979738B2 (en) | System and method to detect attacks on mobile wireless networks based on motif analysis | |
US10091218B2 (en) | System and method to detect attacks on mobile wireless networks based on network controllability analysis | |
Moore et al. | IoT reliability: a review leading to 5 key research directions | |
JP6378395B2 (en) | Use of DNS requests and host agents for path exploration and anomaly / change detection and network status recognition for anomaly subgraph detection | |
Jing et al. | Network traffic fusion and analysis against DDoS flooding attacks with a novel reversible sketch | |
US11558269B2 (en) | Method, device, and system for network traffic analysis | |
Illiano et al. | Detecting malicious data injections in wireless sensor networks: A survey | |
Shin et al. | Advanced probabilistic approach for network intrusion forecasting and detection | |
US10003985B1 (en) | System and method for determining reliability of nodes in mobile wireless network | |
El Mourabit et al. | Intrusion detection techniques in wireless sensor network using data mining algorithms: comparative evaluation based on attacks detection | |
Karapistoli et al. | Wireless sensor network security visualization | |
Otrok et al. | A cooperative approach for analyzing intrusions in mobile ad hoc networks | |
Harrison et al. | Interactive detection of network anomalies via coordinated multiple views | |
Kadri et al. | Survey and classification of Dos and DDos attack detection and validation approaches for IoT environments | |
WO2016204838A9 (en) | System and method to detect attacks on mobile wireless networks based on motif analysis | |
US10187404B2 (en) | System and method for detecting attacks on mobile ad hoc networks based on network flux | |
KRARI et al. | Detecting the RPL version number attack in IoT Networks using Deep Learning Models | |
Shaikh et al. | Effective network security monitoring: from attribution to target-centric monitoring | |
Chivers et al. | Accumulating evidence of insider attacks | |
Derhab et al. | Lightweight Anomaly-based Intrusion Detection System for Multi-feature Traffic in Wireless Sensor Networks. | |
Zakrzewski et al. | Topology Change Localisation in WSNs | |
Azer et al. | Using Attack Graphs in Ad Hoc Networks-For Intrusion Prediction Correlation and Detection | |
Latha et al. | An efficient security system in wireless local area network (WLAN) against network intrusion | |
Kishoreraja et al. | Identifying Sensor Node Behavior Using Temporal Correlation for Data Modifier Attack | |
Ouyang et al. | Entropy-based distributed fault-tolerant event boundary detection algorithm for wireless sensor networks |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16812077 Country of ref document: EP Kind code of ref document: A2 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
REEP | Request for entry into the european phase |
Ref document number: 2016812077 Country of ref document: EP |