Cognitive spectrum violation detection

• US 9,042,359 B1
• Filed: 09/24/2007
• Issued: 05/26/2015
• Est. Priority Date: 09/24/2007
• Status: Expired due to Fees

• Current Assignee: Rockwell Collins, Inc. (Rtx Corporation)
• Original Assignee: Rockwell Collins, Inc. (Rtx Corporation)
• Inventors: Thommana, John, Paul, Lizy
• Primary Examiner(s): Eng, George
• Assistant Examiner(s): DU, HUNG K
• Application Number:
  US11/903,627
• Time in Patent Office: 2,801 Days
• Field of Search: 455/515, 455/434, 455/435.1, 455/456.1, 370/310.1, 370/338
• US Class Current: 370/338
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A radio node in a radio network includes signal processing hardware. The radio node includes radio frequency (RF) transceiver hardware. The radio node also includes a spectrum sensor configured to detect potential spectrum policy violations. Further, the radio node includes a non-cooperation discriminator used to determine the non-cooperative character of a monitored radio node.

Claims

1. A radio node in a radio network, comprising:

signal processing hardware;

radio frequency (RF) transceiver hardware;

a spectrum sensor configured to detect at least one of a potential spectrum policy violation, an accidental violation, a malicious violation, and a jamming;

a cognitive collision detection and identification engine coupled to the spectrum sensor, the cognitive collision detection and identification engine configured to create a radio profile of radios, the radio profile including an RF fingerprint, received power level, trust level, associated behavior, associated strategy, Doppler variation, variation in received power level, directional movement and local positioning with respect to a particular radio node and store the radio profile in a database, the radio profile is correlated with media access control (MAC) addresses used, internet protocol (IP) addresses used, interference timing and collision rate to determine if a particular radio profile is at least one of a malicious violator, a non-malicious violator, a nonviolator, and trusted;

a cognitive denial of service detection and identification engine coupled to the spectrum sensor; and

a non-cooperation discriminator configured to;

exchange information with at least one of a physical layer device (PHY) layer and a MAC layer of the radio node;

adjust at least one of a first trust level of a radio profile associated with a first radio node and at least one second trust level of a radio profile associated with a second radio node in response to information received from at least one of the cognitive collision detection and identification engine, a cognitive denial of service detection and identification engine, and a sending radio node; and

when the first trust level reaches a trust threshold or the first radio node is determined to be a malicious violator, execute a countermeasure other than jamming or attacking the first radio node, the countermeasure including at least one of (1) report to the at least one second radio node at least one of the first trust level and a strategy having a third level no higher than the second trust level, and (2) block forwarding of at least one packet received from the first radio node to the at least one second radio node without notifying the first radio node.

2. The radio node of claim 1, wherein the spectrum sensor comprises an artificial neural network.

3. The radio node of claim 1, wherein the spectrum sensor comprises a genetic algorithm.

4. The radio node of claim 1, further comprising:

a policy engine.

5. The radio node of claim 1, further comprising:

a policy database.

6. The radio node of claim 1, further comprising:

an RF eavesdropper subsystem coupled to the spectrum sensor.

10. The radio node of claim 1, wherein the strategy includes at least one of a detection strategy and a tracking strategy.

11. The radio node of claim 1, wherein the information received from a sending radio node includes at least one of a trust level associated with the first radio node and a strategy having a trust level no higher than the trust level of the radio node.

7. A radio network comprising:

a plurality of radio nodes, at least some of the plurality of radio nodes including a non-cooperation discriminator, the non-cooperation discriminator exchanging information with a physical layer device (PHY) layer and a media access control (MAC) layer of the radio node, at least some of the plurality of radio nodes including a spectrum sensor configured to detect at least one of a potential spectrum policy violation, an accidental violation, a malicious violation, and a jamming; and

a plurality of reconfigurable connections between the radio nodes, whereas at least some of the radio nodes are configured with a combination of hardware and software to carry out cognitive non-cooperation in order to detect spectrum policy violations, wherein at least some of the radio nodes include a cognitive denial of service detection and identification engine, wherein at least some of the radio nodes include a cognitive collision detection and identification engine, the cognitive collision detection and identification engine configured to create a radio profile of radios, the radio profile including an RF fingerprint, received power level, trust level, associated behavior, associated strategy, Doppler variation, variation in received power level, directional movement and local positioning with respect to a particular radio node and store the radio profile in a database, the radio profile is correlated with MAC addresses used, internet protocol (IP) addresses used, interference timing and collision rate to determine if a particular radio profile is at least one of a malicious violator, a non-malicious violator, a nonviolator, and trusted;

the non-cooperation discriminator configured to;

adjust at least one of a first trust level of a radio profile associated with a first radio node and at least one second trust level of a radio profile associated with a second radio node in response to information received from at least one of the cognitive collision detection and identification engine, the cognitive denial of service detection and identification engine, and a sending radio node; and

when the first trust level reaches a trust threshold or the first radio node is determined to be a malicious violator, execute a countermeasure other than jamming or attacking the first radio node, the countermeasure including at least one of (1) report to the at least one second radio node at least one of the first trust level and a strategy having a third trust level no higher than the second trust level, and (2) block the forwarding of at least one packet received from the first radio node to the at least one second radio node without notifying the first radio node.

8. The radio network of claim 7, wherein at least some of the radio nodes include a policy engine.

9. The radio network of claim 7, wherein at least some of the radio nodes include a policy database.

12. The radio network of claim 7, wherein the strategy includes at least one of a detection strategy and a tracking strategy.

13. The radio network of claim 7, wherein the information received from a sending radio node includes at least one of a trust level associated with the first radio node and a strategy having a trust level no higher than the trust level of the radio node associated with the non-cooperation discriminator.