Methods and devices for defending a 3G wireless network against malicious attacks

• US 8,965,334 B2
• Filed: 12/19/2005
• Issued: 02/24/2015
• Est. Priority Date: 12/19/2005
• Status: Expired due to Fees

• Current Assignee: RPX Corporation
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Bu, Tian, Norden, Samphel, Woo, Thomas Y.
• Primary Examiner(s): Sabouri, Mazda
• Application Number:
  US11/303,915
• Publication Number:
  US 20070143769A1
• Time in Patent Office: 3,354 Days
• Field of Search: 455/404.1, 455/456.3, 455/414.1, 455/550.1, 455/426.2, 455/563, 455/539.1, 455/461, 455/228, 455/519, 455/412.1, 455/466, 719/313
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities
• CPC Class Codes: H04W 84/04 Large scale networks; Deep hierarchical networks

Abstract

Wireless state information collected or inferred from a 3G wireless network is used to detect and prevent malicious attacks against the network.

Claims

1. A method for detecting an attack against a wireless network comprising:

generating a profile based on non-attack, wireless traffic conditions;

obtaining wireless state information comprising wireless data channel set-up and release information, the time that a mobile device is active and application based information from at least a radio network controller, wherein the application based information is categorized based on the type of multimedia service it provides to a user of the mobile device; and

comparing the obtained information to the profile to determine whether an attack is directed at an element in the wireless network.

2. The method as in claim 1 further comprising preventing malicious traffic intended for a mobile device in the network from reaching the device when the comparison indicates an attack.

3. The method as in claim 1 wherein the state information is collected from one or more network elements in the network.

4. The method as in claim 1 wherein the state information is inferred from knowledge of the network.

9. The method as in claim 1 wherein the wireless state information further comprises time-based mobility activity information.

10. The method as in claim 1 wherein the wireless state information further comprises IP layer information.

11. The method as in claim 10 wherein the IP layer information comprises packet arrivals and information from IP/TCP application layer headers.

5. A device for detecting an attack against a wireless network operable to:

generate a profile based on non-attack, wireless traffic conditions;

obtain wireless state information comprising wireless data channel set-up and release information, the time that a mobile device is active and application based information from at least a radio network controller, wherein the application based information is categorized based on the type of multimedia service it provides to a user of the mobile device; and

compare the obtained information to the profile to determine whether an attack is directed at an element in the wireless network.

6. The device as in claim 5 further operable to prevent malicious traffic intended for a mobile device in the network from reaching the device when the comparison indicates an attack.

7. The device as in claim 5 wherein the device is further operable to collect the state information from one or more elements in the network.

8. The device as in claim 5 wherein the device is further operable to infer state information from knowledge of the network.

12. The device as in claim 5 wherein the wireless state information further comprises time-based mobility activity information.

13. The device as in claim 5 wherein the wireless state information further comprises IP layer information.

14. The device as in claim 13 wherein the IP layer information comprises packet arrivals and information from IP/TCP application layer headers.