Anomalous Behavior Detection Based on Behavioral Signatures

• US 20150350233A1
• Filed: 03/13/2015
• Published: 12/03/2015
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay, Engle, Michael Thomas
• Granted Patent: US 9,736,175 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G07C 2209/61 Signal comprising different frequencies, e.g. frequency hopping
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Claims

1. A system, comprising:

a transceiver;

at least one memory that stores computer-executable instructions; and

at least one processor operationally coupled to the transceiver and the at least one memory, wherein the at least one processor is configured to access the at least one memory and execute the computer-executable instructions to;

receive a radio frequency (RF) fingerprint of an RF signal detected by the transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determine, based at least in part on the RF fingerprint, that a security protocol has been violated; and

generate an alert message indicating that the security protocol has been violated.

2. The system of claim 1, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the electronic device is a first electronic device, and the transceiver is a first transceiver, wherein the system further comprises a second transceiver within the AUS and operationally coupled to the at least one processor, and wherein the at least one processor is configured to determine that the security protocol has been violated by executing the computer-executable instructions to:

determine that the first RF fingerprint matches a first stored RF fingerprint associated with a first stored persona;

receive a second radio frequency (RF) fingerprint of a second RF signal detected by the second transceiver, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determine that the second RF fingerprint matches a second stored RF fingerprint associated with a second stored persona;

determine that a first user associated with the first stored persona is not authorized to be simultaneously present in the AUS within a threshold distance of a second user associated with the second stored persona;

determine that the first transceiver is located within the threshold distance from the second transceiver;

determine a first timestamp corresponding to a time of receipt of the first RF signal by the first transceiver and a second timestamp corresponding to a time of receipt of the second RF signal by the second transceiver; and

determine that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

3. The system of claim 2, wherein the at least one processor is further configured to determine that the security protocol has been violated by executing the computer-executable instructions to:

determine a first datestamp indicating a first date on which the first RF signal was received by the first transceiver and a second datestamp indicating a second date on which the second RF signal was received by the second transceiver; and

determine that the first date and the second date are a same date.

4. The system of claim 1, wherein the RF fingerprint is a first RF fingerprint and the RF signal is a first RF signal, and wherein the at least one processor is configured to determine that the security protocol has been violated by executing the computer-executable instructions to:

determine a first timestamp corresponding to a time of receipt of the first RF signal by the transceiver; and

receive a second radio frequency (RF) fingerprint of a second RF signal detected by the transceiver;

determine that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determine a second timestamp corresponding to a time of receipt of the second RF signal by the transceiver;

determine that a difference between the second timestamp and the first timestamp exceeds a threshold amount of time.

5. The system of claim 1, wherein the RF fingerprint is a first RF fingerprint and the RF signal is a first RF signal, and wherein the at least one processor is configured to determine that the security protocol has been violated by executing the computer-executable instructions to:

determine a first timestamp corresponding to a time of receipt of the first RF signal by the transceiver; and

receive a second radio frequency (RF) fingerprint of a second RF signal detected by the transceiver;

determine that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determine a second timestamp corresponding to a time of receipt of the second RF signal by the transceiver;

determine a first datestamp indicating a first date on which the first RF signal was received by the first transceiver and a second datestamp indicating a second date on which the second RF signal was received by the second transceiver;

determine that the first date is different from the second date; and

determine that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

6. The system of claim 1, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the transceiver is a first transceiver, wherein the system further comprises a second transceiver operationally coupled to the at least one processor, wherein the first transceiver and the second transceiver are located more than a threshold distance apart within the AUS, and wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine a first timestamp corresponding to a time of receipt of the first RF signal by the first transceiver;

receive a second radio frequency (RF) fingerprint of a second RF signal detected by the second transceiver;

determine that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determine a second timestamp corresponding to a time of receipt of the second RF signal by the second transceiver; and

determine that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

7. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

send a control message to surveillance equipment located in the AUS to cause the surveillance equipment to capture at least one of audio data or video data associated with a location within the AUS that includes the transceiver.

8. A method, comprising:

receiving, by a security system comprising one or more computer processors, a radio frequency (RF) fingerprint of an RF signal detected by a transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determining, by the security system and based at least in part on the RF fingerprint, that a security protocol has been violated; and

generating, by the security system, an alert message indicating that the security protocol has been violated.

9. The method of claim 8, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the electronic device is a first electronic device, and the transceiver is a first transceiver, and wherein determining that the security protocol has been violated comprises:

determining, by the security system, that the first RF fingerprint matches a first stored RF fingerprint associated with a first stored persona;

receiving, by the security system, a second radio frequency (RF) fingerprint of a second RF signal detected by a second transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determining, by the security system, that the second RF fingerprint matches a second stored RF fingerprint associated with a second stored persona;

determining, by the security system, that a first user associated with the first stored persona is not authorized to be simultaneously present in the AUS within a threshold distance of a second user associated with the second stored persona;

determining, by the security system, that the first transceiver is located within the threshold distance from the second transceiver;

determining, by the security system, a first timestamp corresponding to a time of receipt of the first RF signal by the first transceiver and a second timestamp corresponding to a time of receipt of the second RF signal by the second transceiver; and

determining, by the security system, that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

10. The method of claim 9, wherein determining that the security protocol has been violated further comprises:

determining, by the security system, a first datestamp indicating a first date on which the first RF signal was received by the first transceiver and a second datestamp indicating a second date on which the second RF signal was received by the second transceiver; and

determining, by the security system, that the first date and the second date are a same date.

11. The method of claim 8, wherein the RF fingerprint is a first RF fingerprint and the RF signal is a first RF signal, and wherein determining that the security protocol has been violated comprises:

determining, by the security system, a first timestamp corresponding to a time of receipt of the first RF signal by the transceiver; and

receiving, by the security system, a second radio frequency (RF) fingerprint of a second RF signal detected by the transceiver;

determining, by the security system, that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determining, by the security system, a second timestamp corresponding to a time of receipt of the second RF signal by the transceiver;

determining, by the security system, that a difference between the second timestamp and the first timestamp exceeds a threshold amount of time.

12. The method of claim 8, wherein the RF fingerprint is a first RF fingerprint and the RF signal is a first RF signal, and wherein determining that the security protocol has been violated comprises:

determining, by the security system, a first timestamp corresponding to a time of receipt of the first RF signal by the transceiver; and

receiving, by the security system, a second radio frequency (RF) fingerprint of a second RF signal detected by the transceiver;

determining, by the security system, that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determining, by the security system, a second timestamp corresponding to a time of receipt of the second RF signal by the transceiver;

determining, by the security system, a first datestamp indicating a first date on which the first RF signal was received by the first transceiver and a second datestamp indicating a second date on which the second RF signal was received by the second transceiver;

determining, by the security system, that the first date is different from the second date; and

determining, by the security system, that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

13. The method of claim 8, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the transceiver is a first transceiver, the method further comprising:

determining, by the security system, a first timestamp corresponding to a time of receipt of the first RF signal by the first transceiver;

receiving, by the security system, a second radio frequency (RF) fingerprint of a second RF signal detected by a transceiver, wherein the first transceiver and the second transceiver are located more than a threshold distance apart within the AUS;

determining, by the security system, that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determining, by the security system, a second timestamp corresponding to a time of receipt of the second RF signal by the second transceiver; and

determining, by the security system, that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

14. The method of claim 8, further comprising:

sending, by the security system, a control message to surveillance equipment located in the AUS to cause the surveillance equipment to capture at least one of audio data or video data associated with a location within the AUS that includes the transceiver.

15. One or more non-transitory computer-readable media storing computer-executable instructions that responsive to execution by at least one computer processor cause operations to be performed comprising:

receiving a radio frequency (RF) fingerprint of an RF signal detected by a transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determining, based at least in part on the RF fingerprint, that a security protocol has been violated; and

generating an alert message indicating that the security protocol has been violated.

16. The one or more non-transitory computer-readable media of claim 15, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the electronic device is a first electronic device, and the transceiver is a first transceiver, and wherein determining that the security protocol has been violated comprises:

determining that the first RF fingerprint matches a first stored RF fingerprint associated with a first stored persona;

receiving a second radio frequency (RF) fingerprint of a second RF signal detected by a second transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determining that the second RF fingerprint matches a second stored RF fingerprint associated with a second stored persona;

determining that a first user associated with the first stored persona is not authorized to be simultaneously present in the AUS within a threshold distance of a second user associated with the second stored persona;

determining that the first transceiver is located within the threshold distance from the second transceiver;

determining a first timestamp corresponding to a time of receipt of the first RF signal by the first transceiver and a second timestamp corresponding to a time of receipt of the second RF signal by the second transceiver; and

determining that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

17. The one or more non-transitory computer-readable media of claim 16, wherein determining that the security protocol has been violated further comprises:

determining a first datestamp indicating a first date on which the first RF signal was received by the first transceiver and a second datestamp indicating a second date on which the second RF signal was received by the second transceiver; and

determining that the first date and the second date are a same date.

18. The one or more non-transitory computer-readable media of claim 15, wherein the RF fingerprint is a first RF fingerprint and the RF signal is a first RF signal, and wherein determining that the security protocol has been violated comprises:

determining a first timestamp corresponding to a time of receipt of the first RF signal by the transceiver;

receiving a second radio frequency (RF) fingerprint of a second RF signal detected by the transceiver;

determining that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determining a second timestamp corresponding to a time of receipt of the second RF signal by the transceiver; and

determining that a difference between the second timestamp and the first timestamp exceeds a threshold amount of time.

19. The one or more non-transitory computer-readable media of claim 15, wherein the RF fingerprint is a first RF fingerprint and the RF signal is a first RF signal, and wherein determining that the security protocol has been violated comprises:

determining a first timestamp corresponding to a time of receipt of the first RF signal by the transceiver;

receiving a second radio frequency (RF) fingerprint of a second RF signal detected by the transceiver;

determining that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determining a second timestamp corresponding to a time of receipt of the second RF signal by the transceiver;

determining a first datestamp indicating a first date on which the first RF signal was received by the first transceiver and a second datestamp indicating a second date on which the second RF signal was received by the second transceiver;

determining that the first date is different from the second date; and

determining that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.

20. The one or more non-transitory computer-readable media of claim 15, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the transceiver is a first transceiver, the operations further comprising:

determining a first timestamp corresponding to a time of receipt of the first RF signal by the first transceiver;

receiving a second radio frequency (RF) fingerprint of a second RF signal detected by a transceiver, wherein the first transceiver and the second transceiver are located more than a threshold distance apart within the AUS;

determining that the second RF signal was emitted by the electronic device based at least in part on the second RF fingerprint including at least one of;

i) the hardware address of the electronic device or ii) the radio type identifier of the radio of the electronic device;

determining a second timestamp corresponding to a time of receipt of the second RF signal by the second transceiver; and

determining that a difference between the second timestamp and the first timestamp is less than a threshold amount of time.