System for intrusion detection

• US 7,409,716 B2
• Filed: 02/03/2004
• Issued: 08/05/2008
• Est. Priority Date: 02/07/2003
• Status: Expired due to Fees

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Evans, Scott, Barnett, Bruce
• Primary Examiner(s): Jung; David Y
• Application Number:
  US10/770,665
• Publication Number:
  US 20040157556A1
• Time in Patent Office: 1,645 Days
• Field of Search: 726/26, 726/27, 726/30, 726/23, 726/22, 726/4
• US Class Current: 726/23
• CPC Class Codes: H04W 36/00835 Determination of neighbour cell lists
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A system a wireless ad hoc network. The system includes a plurality of nodes and a plurality of protocols for governing transmission of data between the plurality of nodes. The operation of the protocols is quantified by a complexity metric for determining whether an external source has altered the operation of the system.

Claims

1. A system for operating a wireless ad hoc network, said system comprising:

a plurality of nodes for transmitting data therebetween as governed by at least one of a plurality of protocols; and

a complexity probe that quantifies a complexity of the transmissions of data with a complexity metric and determines from the quantified complexity whether an external source has altered the operation of the system, wherein a first complexity metric of a first protocol is compared to a first benchmarked complexity metric indicating normal operation of said first protocol, and wherein the first complexity metric of said first protocol is a Kolmogorov complexity metric.

2. The system as set forth in claim 1, wherein the first complexity metric deviates from the first benchmarked complexity metric by a first amount.

3. The system as set forth in claim 2 wherein the first amount is greater than a first predetermined amount, the operation of said first protocol thereby being altered by a first external source.

4. The system as set forth in claim 3 wherein a second complexity metric of a second protocol is compared to a second benchmarked complexity metric indicating normal operation of said second protocol, the second complexity metric deviating from the second benchmarked complexity metric by a second amount.

5. The system as set forth in claim 4 wherein the second amount is greater than a second predetermined amount, the operation of said second protocol thereby being altered by a second external source.

6. A computer readable medium comprising:

a computer-usable data carrier storing instructions, the instructions when executed by a computer system causing the computer system to determine whether an external system has altered the operation of the computer system by executing the instructions to;

quantify a complexity of at least one of a plurality of transmissions between nodes of the computer system with a complexity metric;

determine from the quantified complexity whether an external source has altered the operation of the network; and

compare a first complexity metric of a first protocol to a first benchmarked complexity metric indicating normal operation of the first protocol, wherein the first complexity metric of the first protocol is a Kolmogorov complexity metric.

7. The computer readable medium as set forth in claim 6 wherein the first complexity metric deviates from the first benchmarked complexity metric by a first amount.

8. The computer readable medium as set forth in claim 7 wherein the first amount is greater than a first predetermined amount, the operation of the first protocol thereby being altered by a first external source.

9. The computer readable medium as set forth in claim 6 further including a sixth instruction for comparing a second complexity metric of a second protocol to a second benchmarked complexity metric indicating normal operation of the second protocol, the second complexity metric deviating from the second benchmarked complexity metric by a second amount.

10. The computer readable medium as set forth in claim 9 wherein the second amount is greater than a second predetermined amount, the operation of the second protocol thereby being altered by a second external source.

11. A method for operating a network having a plurality of nodes, data transmission between the nodes being governed by at least one of a plurality of protocols, said method comprising:

quantifying a complexity of the data transmissions between the nodes by a complexity metric; and

determining whether an external source has altered the operation of the network based on the quantified complexity; and

comparing a complexity metric of the data transmissions to a benchmarked complexity metric indicating normal operation of the protocol, wherein the complexity metric is a Kolmogorov complexity metric.

12. The method as set forth in claim 11, wherein the complexity metric deviates from the benchmarked complexity metric by a specified amount.

13. The method as set forth in claim 12 further comprising determining that the external source has altered operation of the network if the specified amount is greater than a predetermined amount.