Electromagnetic threat detection and mitigation in the Internet of Things

• US 10,104,098 B2
• Filed: 06/02/2015
• Issued: 10/16/2018
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay
• Primary Examiner(s): Rahman, Mahfuzur
• Assistant Examiner(s): Victoria, Narciso
• Application Number:
  US14/728,825
• Publication Number:
  US 20150350228A1
• Time in Patent Office: 1,232 Days
• CPC Class Codes: G06K 7/0095 Testing the sensing arrangement, e.g. testing if a magnetic card reader, bar code reader, RFID interrogator or smart card reader functions properly testing of electrical circuits G01R31/28
• CPC Class Codes: H04B 1/0028 wherein the AD/DA conversion occurs at baseband stage
• CPC Class Codes: H04B 1/0064 with separate antennas for the more than one band H04B1/0053 takes precedence
• CPC Class Codes: H04B 7/01 Reducing phase shift
• CPC Class Codes: H04K 2203/34 involving multiple cooperating jammers
• CPC Class Codes: H04K 3/22 including jamming detection and monitoring
• CPC Class Codes: H04K 3/42 characterized by the control of the jamming frequency or wavelength
• CPC Class Codes: H04K 3/44 characterized by the control of the jamming waveform or modulation type
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/825 by jamming
• CPC Class Codes: H04K 3/84 related to preventing electromagnetic interference in petrol station, hospital, plane or cinema
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04K 3/88 related to allowing or preventing alarm transmission
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 72/20 : Control channels or signalling for resource management
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Systems and methods can support threat detection using electromagnetic signatures. One or more sensors comprising radio receivers may receive radio frequency signals within an electromagnetic environment. Radio frequency signatures may be identified from one or more of the radio frequency signals. A baseline electromagnetic environment may be established from the radio frequency signatures. The radio frequency signatures may be monitored over time to detect variations from the baseline electromagnetic environment. Variations in the electromagnetic environment may be evaluated against stored threat signatures. Operator interfaces may present indications of threats determined from evaluating the variations in the electromagnetic environment.

Claims

1. A method for threat detection from electromagnetic signatures, comprising:

receiving radio frequency signals using a plurality of sensors, wherein the plurality of sensors comprise radio receivers;

generating, within the radio receivers, data samples representing at least a portion of the radio frequency signals;

generating feature vectors comprising at least a portion of the data samples;

combining the feature vectors from two or more of the radio receivers to form aggregate feature vectors;

incorporating attribute information into the aggregate feature vectors, wherein the attribute information describes one or more features of a communicated signal within the radio frequency signals;

identifying radio frequency signatures, comprising behaviors and characteristics, from one or more of the aggregate feature vectors;

establishing a baseline electromagnetic environment from the radio frequency signatures;

monitoring the radio frequency signatures over time to detect variations from the baseline electromagnetic environment;

identifying potential threat characteristics and potential threat behaviors within the variations from the baseline electromagnetic environment;

evaluating the potential threat characteristics and the potential threat behaviors against characteristics and behaviors associated with stored threat signatures;

classifying a wireless attack in response to evaluating the potential threat characteristics and the potential threat behaviors;

determining a risk level associated with the wireless attack; and

presenting, via one or more operator interfaces, an indication of the determined risk level.

2. The method of claim 1, wherein evaluating the potential threat characteristics and the potential threat behaviors comprises generating an electromagnetic persona comprising one or more of the radio frequency signatures and matching the generated electromagnetic persona against stored personas associated with the stored threat signatures.

3. The method of claim 1, further comprising estimating positions of radio transmitters associated with the detected variations from the baseline electromagnetic environment.

4. The method of claim 1, wherein the stored threat signatures comprise signatures associated with unauthorized wireless network access points.

5. The method of claim 1, wherein the stored threat signatures comprise signatures associated with unauthorized cellular base stations.

6. The method of claim 1, wherein the stored threat signatures comprise behaviors associated with spoofing sensors associated with security or controls.

7. The method of claim 1, wherein the stored threat signatures comprise behaviors associated with skimming payment credentials.

8. The method of claim 1, wherein the stored threat signatures comprise behaviors associated with access control exploits.

9. The method of claim 1, wherein the stored threat signatures comprise one or more attack templates.

10. The method of claim 1, wherein the stored threat signatures are retrieved from an updatable analysis database.

11. A system for threat detection from electromagnetic signatures, comprising:

a plurality of sensor antennas;

a plurality of sensors configured to couple radio frequency signals from the sensor antennas and generate data samples representing at least a portion of the radio frequency signals; and

a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive the data samples,

generate feature vectors comprising at least a portion of the data samples;

combine the feature vectors from two or more of the plurality of sensors to form aggregate feature vectors;

incorporate attribute information into the aggregate feature vectors, wherein the attribute information describes one or more features of a communicated signal within the radio frequency signals;

identify radio frequency signatures, comprising behaviors and characteristics, from the aggregate feature vectors,

establish a baseline electromagnetic environment from the radio frequency signatures,

monitor the radio frequency signatures over time to detect variations from the baseline electromagnetic environment,

identify potential threat characteristics and potential threat behaviors within the variations from the baseline electromagnetic environment,

evaluate the potential threat characteristics and the potential threat behaviors against characteristics and behaviors associated with stored threat signatures,

classify a wireless attack in response to evaluating the potential threat characteristics and the potential threat behaviors;

determine a risk level associated with the wireless attack, and

present, via one or more operator interfaces, an indication of the determined risk level.

12. The system of claim 11, wherein evaluating the potential threat characteristics and the potential threat behaviors comprises generating an electromagnetic persona comprising one or more of the radio frequency signatures and matching the generated electromagnetic persona against stored personas associated with the stored threat signatures.

13. The system of claim 11, wherein the one or more processing units are further configured to estimate positions of radio transmitters associated with the detected variations from the baseline electromagnetic environment.

14. The system of claim 11, wherein the stored threat signatures comprise signatures associated with unauthorized wireless network access points.

15. The system of claim 11, wherein the stored threat signatures comprise signatures associated with unauthorized cellular base stations.

16. The system of claim 11, wherein the stored threat signatures comprise behaviors associated with spoofing sensors associated with security or controls.

17. The system of claim 11, wherein the stored threat signatures comprise behaviors associated with skimming payment credentials.

18. The system of claim 11, wherein the stored threat signatures comprise behaviors associated with access control exploits.

19. The system of claim 11, wherein the stored threat signatures comprise one or more templates associated with wireless attacks.

20. A system for threat detection from electromagnetic signatures, comprising:

a plurality of sensor antennas;

one or more updatable analysis databases configured to provide stored threat signatures;

one or more operator interfaces for communicating information associated with wireless devices;

a plurality of software radio receivers configured to couple radio frequency signals from the plurality of sensor antennas and generate data samples representing a portion of the radio frequency signals; and

a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive the data samples,

generate feature vectors comprising at least a portion of the data samples;

combine the feature vectors from two or more of the software radio receivers to form aggregate feature vectors;

incorporate attribute information into the aggregate feature vectors, wherein the attribute information describes one or more features of a communicated signal within the radio frequency signals;

identify radio frequency signatures, comprising behaviors, from the data samples,

generate electromagnetic persona associated with the radio frequency signatures,

establish a baseline of electromagnetic persona behavior within an electromagnetic environment,

monitor electromagnetic persona behavior over time to detect variations from the baseline of electromagnetic persona behavior,

identify potential threat behaviors within the variations from the baseline electromagnetic environment,

evaluate the potential threat behaviors against behaviors associated with the stored threat signatures to classify a wireless attack risk and identify attack risk levels, and

present, via the one or more operator interfaces, an indication of identified attack risk levels.