Systems and methods for detecting illegitimate devices on wireless networks

• US 10,148,688 B1
• Filed: 02/09/2015
• Issued: 12/04/2018
• Est. Priority Date: 02/09/2015
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Shavell, Michael, Boucher, Matt, Robichaud, Christopher
• Primary Examiner(s): Alata, Ayoub
• Application Number:
  US14/616,763
• Time in Patent Office: 1,394 Days
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

The disclosed computer-implemented method for detecting illegitimate devices on wireless networks may include (1) identifying an initial set of hops that represent devices on a wireless network that relay network traffic between the computing device and a destination, (2) identifying, after identifying the initial set of hops, a new set of hops that relay the network traffic between the computing device and the destination, (3) comparing the initial set of hops to the new set of hops, and (4) determining, based on the comparison, that the new set of hops comprises an abnormality that indicates an illegitimate device is intercepting the network traffic on the wireless network between the computing device and the destination. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for detecting illegitimate devices on wireless networks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

recording, by a security system on the computing device and based on a connection of the computing device to a wireless network, an initial set of hops that;

represent devices on the wireless network that relay network traffic between the computing device and a destination;

are recorded from information about replies from the devices to messages sent by the computing device to each device in the initial set of hops; and

comprise a subset of the devices that are a predetermined number of hops counting outward from the computing device;

identifying, by the security system and after identifying the initial set of hops, a new set of hops that relay the network traffic between the computing device and the destination based on a subsequent connection of the computing device to the wireless network;

comparing the initial set of hops to the new set of hops;

determining, based on the comparison and based on identifying a change between the initial set of hops and the new set of hops, that the new set of hops comprises an abnormality that indicates an illegitimate device is intercepting the network traffic on the wireless network between the computing device and the destination; and

preventing, by the security system, a user from sending sensitive information over the wireless network.

2. The computer-implemented method of claim 1, wherein the abnormality comprises an additional hop found in the new set of hops and not found in the initial set of hops.

3. The computer-implemented method of claim 1, wherein the abnormality comprises a change between a round trip time for a packet sent to an initial device in the initial set of hops and a new round trip time of a new packet sent to a new device in the new set of hops, wherein the new device is a same number of hops from the computing device as the initial device.

4. The computer-implemented method of claim 1, wherein the abnormality comprises a new network address of a device found in the new set of hops and not in the initial set of hops.

5. The computer-implemented method of claim 1, wherein:

recording the initial set of hops comprises identifying a gateway device that is a connection point between the wireless network and an external network and that relays the network traffic from the wireless network to the external network; and

identifying the new set of hops comprises examining a set of hops in between the computing device and the gateway device.

6. The computer-implemented method of claim 1, wherein identifying the new set of hops comprises periodically reexamining, at a predetermined interval, the devices on the wireless network that relay the network traffic between the computing device and the destination.

7. The computer-implemented method of claim 1, wherein:

recording the initial set of hops comprises identifying a cached set of hops from a previous connection of the computing device to the wireless network;

identifying the new set of hops comprises identifying devices that are relaying the network traffic for a current connection of the computing device to the wireless network; and

comparing the initial set of hops to the new set of hops comprises comparing the cached set of hops from the previous connection to the new set of hops from the current connection.

8. The computer-implemented method of claim 1, wherein preventing the user from sending sensitive information over the wireless network comprises at least one of:

disconnecting the computing device from the wireless network;

filtering outgoing traffic from the computing device;

storing a warning about the wireless network that the wireless network may be subject to snooping from illegitimate devices; and

informing a user of the computing device about the illegitimate device on the wireless network.

9. The computer-implemented method of claim 1, wherein:

the initial set of hops comprises a subset of the devices, wherein the subset of the devices comprises a predetermined number of hops counting outward from the computing device;

the new set of hops comprises the same predetermined number of hops counting outward from the computing device; and

determining that the new set of hops comprises the abnormality comprises detecting the abnormality within the predetermined number of hops.

10. The computer-implemented method of claim 1, wherein:

the wireless network comprises a public wireless network;

identifying the initial set of hops comprises executing a traceroute command;

identifying the new set of hops comprises repeating the traceroute command at a predetermined interval;

the abnormality comprises a change in output of the traceroute command; and

the illegitimate device comprises a malicious device that intercepts the network traffic while relaying the network traffic as if it were a legitimate network device.

11. A system for detecting illegitimate devices on wireless networks, the system comprising:

an identification module, stored in memory, that;

records, by a security system on a computing device and based on a connection of the computing device to a wireless network, an initial set of hops that;

represent devices on the wireless network that relay network traffic between a computing device and a destination;

are recorded from information about replies from the devices to sequential messages sent by the computing device to each device in the initial set of hops; and

comprise a subset of the devices that are a predetermined number of hops counting outward from the computing device; and

identifies, by the security system and after identifying the initial set of hops, a new set of hops that relay the network traffic between the computing device and the destination based on a subsequent connection of the computing device to the wireless network;

a comparison module, stored in memory, that compares the initial set of hops to the new set of hops;

a determination module, stored in memory, that;

determines, based on the comparison and based on identifying a change between the initial set of hops and the new set of hops, that the new set of hops comprises an abnormality that indicates an illegitimate device is intercepting the network traffic on the wireless network between the computing device and the destination; and

prevents, by the security system, a user from sending sensitive information over the wireless network; and

at least one physical processor configured to execute the identification module, the comparison module, and the determination module.

12. The system of claim 11, wherein the abnormality comprises an additional hop found in the new set of hops and not found in the initial set of hops.

13. The system of claim 11, wherein the abnormality comprises a change between a round trip time for a packet sent to an initial device in the initial set of hops and a new round trip time of a new packet sent to a new device in the new set of hops, wherein the new device is a same number of hops from the computing device as the initial device.

14. The system of claim 11, wherein the abnormality comprises a new network address of a device found in the new set of hops and not in the initial set of hops.

15. The system of claim 11, wherein:

the identification module records the initial set of hops by identifying a gateway device that is a connection point between the wireless network and an external network and that relays the network traffic from the wireless network to the external network; and

the identification module identifies the new set of hops by examining a set of hops in between the computing device and the gateway device.

16. The system of claim 11, wherein the identification module identifies the new set of hops by periodically reexamining, at a predetermined interval, the devices on the wireless network that relay the network traffic between the computing device and the destination.

17. The system of claim 11, wherein:

the identification module records the initial set of hops by identifying a cached set of hops from a previous connection of the computing device to the wireless network;

the identification module identifies the new set of hops by identifying devices that are relaying the network traffic for a current connection of the computing device to the wireless network; and

the comparison module compares the initial set of hops to the new set of hops by comparing the cached set of hops from the previous connection to the new set of hops from the current connection.

18. The system of claim 11, wherein the determination module informs a user of the computing device about the illegitimate device on the wireless network.

19. The system of claim 11, wherein:

the initial set of hops comprises a subset of the devices, wherein the subset of the devices comprises a predetermined number of hops counting outward from the computing device;

the new set of hops comprises the same predetermined number of hops counting outward from the computing device; and

the determination module determines that the new set of hops comprises the abnormality by detecting the abnormality within the predetermined number of hops.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

record, by a security system on the computing device and based on a connection of the computing device to a wireless network, an initial set of hops that;

represent devices on the wireless network that relay network traffic between the computing device and a destination;

are recorded from information about replies from the devices to messages sent by the computing device to each device in the initial set of hops; and

comprise a subset of the devices that are a predetermined number of hops counting outward from the computing device;

identify, by the security system and after identifying the initial set of hops, a new set of hops that relay the network traffic between the computing device and the destination;

compare the initial set of hops to the new set of hops;

determine, based on the comparison and based on identifying a change between the initial set of hops and the new set of hops, that the new set of hops comprises an abnormality that indicates an illegitimate device is intercepting the network traffic on the wireless network between the computing device and the destination; and

prevent, by the security system, a user from sending sensitive information over the wireless network.