System for intrusion detection

• US 20040157556A1
• Filed: 02/03/2004
• Published: 08/12/2004
• Est. Priority Date: 02/07/2003
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: General Electric Company, Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Evans, Scott, Barnett, Bruce
• Granted Patent: US 7,409,716 B2
• Time in Patent Office: Days
• US Class Current: 455/41.2
• CPC Class Codes: H04W 36/00835 Determination of neighbour cell lists
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A system a wireless ad hoc network. The system includes a plurality of nodes and a plurality of protocols for governing transmission of data between the plurality of nodes. The operation of the protocols is quantified by a complexity metric for determining whether an external source has altered the operation of the system.

Claims

1. A system for operating a wireless ad hoc network, said system comprising:

a plurality of nodes; and

a plurality of protocols for governing transmission of data between said plurality of nodes, the operation of said protocols being quantified by a complexity metric for determining whether an external source has altered the operation of said system.

2. The system as set forth in claim 1 wherein a first complexity metric of a first protocol is compared to a first benchmarked complexity metric indicating normal operation of said first protocol.

3. The system as set forth in claim 2 wherein the first complexity metric of said first protocol is a Kolmogorov complexity metric.

4. The system as set forth in claim 3 wherein the first complexity metric deviates from the first benchmarked complexity metric by a first amount.

5. The system as set forth in claim 4 wherein the first amount is greater than a first predetermined amount, the operation of said first protocol thereby being altered by a first external source.

6. The system as set forth in claim 5 wherein a second complexity metric of a second protocol is compared to a second benchmarked complexity metric indicating normal operation of said second protocol, the second complexity metric deviating from the second benchmarked complexity metric by a second amount.

7. The system as set forth in claim 6 wherein the second amount is greater than a second predetermined amount, the operation of said second protocol thereby being altered by a second external source.

8. A computer program product for detecting intrusions to a network, said computer program product comprising:

a first instruction for operating a plurality of nodes with a plurality of protocols;

a second instruction for governing transmission of data between the plurality of nodes;

a third instruction for quantifying the operation of the protocols by a complexity metric; and

a fourth instruction for determining whether an external source has altered the operation of the network.

9. The computer program product as set forth in claim 8 further including a fifth instruction for comparing a first complexity metric of a first protocol a first benchmarked complexity metric indicating normal operation of the first protocol.

10. The computer program product as set forth in claim 9 wherein the first complexity metric of the first protocol is a Kolmogorov complexity metric.

11. The computer program product as set forth in claim 8 wherein the first complexity metric deviates from the first benchmarked complexity metric by a first amount.

12. The computer program product as set forth in claim 11 wherein the first amount is greater than a first predetermined amount, the operation of the first protocol thereby being altered by a first external source.

13. The computer program product as set forth in claim 8 further including a sixth instruction for comparing a second complexity metric of a second protocol to a second benchmarked complexity metric indicating normal operation of the second protocol, the second complexity metric deviating from the second benchmarked complexity metric by a second amount.

14. The computer program product as set forth in claim 13 wherein the second amount is greater than a second predetermined amount, the operation of the second protocol thereby being altered by a second external source.

15. A method for operating a network, said method comprising the steps of:

operating a plurality of nodes with a plurality of protocols;

governing transmission of data between the plurality of nodes;

quantifying the operation of the protocols by a complexity metric; and

determining whether an external source has altered the operation of the network.

16. The method as set forth in claim 15 further including the step of comparing a complexity metric of a protocol to a benchmarked complexity metric indicating normal operation of the protocol.

17. The method as set forth in claim 16 wherein the complexity metric of the protocol is a Kolmogorov complexity metric.

18. The method as set forth in claim 17 wherein the complexity metric deviates from the benchmarked complexity metric by a specified amount.

19. The method as set forth in claim 18 wherein the specified amount is greater than a predetermined amount, the operation of the protocol thereby being altered by an external source.