Encoding of signals to facilitate traffic analysis

• US 7,574,597 B1
• Filed: 08/05/2002
• Issued: 08/11/2009
• Est. Priority Date: 10/19/2001
• Status: Active Grant

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Original Assignee: BBN Technologies Corporation (Rtx Corporation)
• Inventors: Cousins, David B., Partridge, Craig, Strayer, W. Timothy, Krishnan, Rajesh, Saxena, Tushar
• Primary Examiner(s): Sheikh, Ayaz R
• Assistant Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US10/212,324
• Time in Patent Office: 2,563 Days
• Field of Search: 726/22, 726/23
• US Class Current: 713/160
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system acquires information about communication among wired or wireless nodes [110, 210] in a network [100, 200] by intercepting chunks of data in the network by a wired or wireless tap [120, 220] located among the wired or wireless nodes [110, 210] in the network. Characteristic information [400] about the intercepted chunks of data may be obtained. The characteristic information may include times of arrival [410] of the chunks of data at the wired or wireless tap [120, 220] and identifiers of wired or wireless source nodes [420] that sent the chunks of data. At least one signal may be constructed to represent the characteristic information over time.

Claims

1. A method of acquiring information about communication among nodes in a network, comprising:

intercepting chunks of data in the network by a tap located among the nodes in the network;

directly obtaining first characteristic information about the intercepted chunks of data, the first characteristic information including times of arrival of the chunks of data at the tap and identifiers of source nodes that sent the chunks of data;

recording the first characteristic information in a record;

indirectly determining second characteristic information about the intercepted chunks of data based on at least some of the first characteristic information; and

constructing, using one of a plurality of encoding schemes based on at least one of a recorded amount of the first characteristic information or a usability of the first characteristic information in subsequent signal processing, at least one signal to represent the first and second characteristic information over time.

2. The method of claim 1, where the first characteristic information further includes at least one of durations of the chunks of data or identifiers of destination nodes to which the chunks of data are addressed, and the second characteristic data includes a type of the chunks of data.

3. The method of claim 1, where the network is a wireless network, and the tap is capable of intercepting wireless communications.

4. The method of claim 1, where the network is a wired network, and the tap is capable of intercepting communications on the wired network.

5. The method of claim 1, where the constructing includes:

encoding one signal that includes the times of arrival of the chunks of data and the identifiers of the source nodes.

6. The method of claim 5, where the encoding includes:

assigning phase information to data associated with the times of arrival of the chunks of data based on the identifiers of the source nodes.

7. The method of claim 6, where the phase information is a sign of the data associated with the times of arrival when there are two different source nodes identified by the identifiers of the source nodes.

8. The method of claim 1, where the constructing includes:

encoding a plurality of signals using the identifiers of source nodes so that each one of the plurality of signals includes the times of arrival of the chunks of data sent by a single source node.

9. The method of claim 8, where the plurality of signals each consists of the times of arrival of the chunks of data sent by a single source node.

10. The method of claim 1, further comprising:

re-sampling the at least one signal so that the first characteristic information is sampled at uniform periods of time.

11. The method of claim 1, further comprising:

processing the at least one signal to obtain periodicity information about the at least one signal.

12. The method of claim 1, where the at least one signal includes a plurality of signals, and the method further comprises:

processing the plurality of signals to obtain similarity information about pairs of the plurality of signals.

13. A method of acquiring information about communication among nodes in a network, comprising:

passively observing chunks of data in the network by a tap located among the nodes in the network;

obtaining characteristic information about the chunks of data, the characteristic information including a number of different types of information, including times of arrival of the chunks of data at the tap and durations of the chunks of data; and

constructing, using one of a plurality of encoding schemes based on at least one of the number of different types of the information or a usability of the characteristic information in subsequent signal processing, at least one signal to represent the characteristic information over time.

14. The method of claim 13, where the characteristic information further includes at least one of identifiers of source nodes that sent the chunks of data or identifiers of destination nodes to which the chunks of data are addressed.

15. The method of claim 13, where the network is a wireless network, and the tap is capable of observing wireless communications.

16. The method of claim 13, where the network is a wired network, and the tap is capable of observing communications on the wired network.

17. The method of claim 13, where the characteristic information further includes identifiers of source nodes that sent the chunks of data, and

where the constructing includes:

encoding one signal that includes the times of arrival of the chunks of data and the durations of the chunks of data for all of the source nodes corresponding to the identifiers.

18. The method of claim 13, where the characteristic information further includes identifiers of source nodes that sent the chunks of data, and

where the constructing includes:

encoding a plurality of signals using the identifiers of source nodes so that each one of the plurality of signals includes the times of arrival of the chunks of data and the durations of the chunks of data sent by a single one of the source nodes.

19. The method of claim 13, where the constructing includes:

encoding the durations of the chunks of data as amplitudes of data within the at least one signal.

20. The method of claim 13, where the constructing includes:

encoding the durations of the chunks of data as lengths of data within the at least one signal.

21. The method of claim 13, further comprising:

re-sampling the at least one signal so that the characteristic information is sampled at uniform periods of time.

22. The method of claim 13, further comprising:

processing the at least one signal to obtain periodicity information about the at least one signal.

23. A method of acquiring information about communication among nodes in a network, comprising:

intercepting chunks of data in the network by a tap located among the nodes in the network;

obtaining characteristic information about the intercepted chunks of data, the characteristic information including times of arrival of the chunks of data at the tap, durations of the chunks of data, and identifiers of source nodes that sent the chunks of data;

inferring a type of the chunks of data based on at least some of the characteristic information; and

encoding the type of the chunks of data and the characteristic information as pulses of at least one signal, where the type of the chunks of data or the characteristic information is encoded as amplitudes of data with the at least one signal.

24. The method of claim 23, where the constructing includes:

encoding the times of arrival of the chunks as impulses or pulses.

25. The method of claim 24, where the encoding includes:

assigning a sign to the impulses or pulses based on which source node sent the chunks.

26. The method of claim 23, where the characteristic information further includes identifiers of destination nodes to which the chunks of data are addressed.

27. A computer-readable storage device that stores instructions executable by one or more processors to perform a method for acquiring information about communication in a network, comprising:

instructions for detecting chunks of data in the network by a tap located among the nodes in the network;

instructions for obtaining times of arrival of the chunks of data at the tap;

instructions for obtaining identifiers of source nodes that sent the chunks of data;

instructions for determining a type of the chunks of data based on at least some of the obtained times of arrival and identifiers of source nodes; and

instructions for constructing at least one signal to represent the type of the chunks of data, the times of arrival of the chunks of data, and the identifiers of source nodes, over time.

28. The computer-readable storage device of claim 27, where the instructions for constructing include:

instructions for encoding a one dimensional signal that includes the times of arrival of the chunks of data and the identifiers of the source nodes.

29. The computer-readable storage device of claim 27, where the instructions for constructing include:

instructions for encoding a plurality of signals using the identifiers of source nodes so that each one of the plurality of signals includes the times of arrival of the chunks of data sent by a single source node.

30. A communication tap in a network, comprising:

means for detecting chunks of data in the network;

means for determining time of arrival information for the chunks of data;

means for determining sizes of the chunks of data;

means for determining types of the chunks of data based on the determined time of arrival information for the chunks of data and the determined sizes of the chunks of data; and

means for constructing at least one signal to represent the types of the chunks of data, the times of arrival of the chunks of data and the sizes of the chunks of data over time.