System and Method for Embedded Mobile (EM)/Machine to Machine (M2M) Security, Pattern Detection, Mitigation

• US 20160006753A1
• Filed: 02/21/2014
• Published: 01/07/2016
• Est. Priority Date: 02/22/2013
• Status: Active Grant

• Current Assignee: Adaptive Mobile Security Ltd. (Enea AB)
• Original Assignee: Adaptive Mobile Security Ltd. (Enea AB)
• Inventors: McDaid, Cathal, Carr, Hugh, Buckley, Mark
• Granted Patent: US 9,813,433 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The invention provides a security system and method for use in a communications network, said network comprising means to allow a plurality of devices to communicate over the network wherein at least one device is a machine to machine (M2M) operated device and at least one other device is a human operated device, said security system comprising: means to capture data traffic originating from the plurality of devices on the network; means for analysing the data traffic; and means for identifying at least one of the M2M operated devices on the network wherein the system is configured to dynamically adapt to different data traffic patterns on the network.

Claims

1. A security system for use in a communications network, said network comprising means to allow a plurality of devices to communicate over the network wherein at least one device is a machine to machine (M2M) operated device and at least one other device is a human operated device, said security system comprising:

means to capture data traffic originating from the plurality of devices on the network;

means for analysing the data traffic; and

means for identifying at least one of the M2M operated devices on the network, wherein the system is configured to dynamically adapt to different data traffic patterns on the network.

2. The security system as claimed in claim 1 comprising means to extract features from the captured data traffic wherein these features describe the behavioural patterns of individual devices on the network.

3. The security system as claimed in claim 1 comprising means to extract features from the captured data traffic wherein these features describe the behavioural patterns of individual devices on the network wherein the feature extraction comprises extraction of event content features from the traffic stream, which describe the single event based on its content.

4. The security system as claimed in claim 1 comprising means to extract features from the captured data traffic wherein these features describe the behavioural patterns of individual devices on the network wherein feature extraction is adapted to extract events from the captured traffic data and collates them by sender in order to derive per-device features and adapted to calculate statistics which refer to multiple events from the same source, such that one or more characteristic profile features can be calculated for a given sender device.

7. The security system of claim 1 wherein if a particular device is identified as a M2M device, the system comprises means to store the traffic patterns to and from these devices said patterns are adapted to be used as baseline reference traffic patterns for detecting other M2M devices.

9. The security system of claim 1 comprising means to ascertain if there are traffic patterns corresponding to normal characteristic patterns associated with M2M device activity, wherein said patterns are configured to be used as control signature patterns for detecting other M2M devices behaving normally.

10. The security system of claim 1 comprising means to ascertain if there are traffic patterns corresponding to normal characteristic patterns associated with M2M device activity, wherein said patterns are configured to be used as control signature patterns for detecting other M2M devices behaving abnormally.

11. The security system of claim 1 comprising means to ascertain out-of-the-ordinary communication patterns associated with M2M device activity, wherein said patterns are configured to be used as control signature patterns for detecting other M2M devices behaving abnormally.

12. The security system of claim 1 comprising means for analysing traffic patterns to discern and analyse message content features and/or other traffic information with reference to dynamic pattern rules and means for aggregating such message content features across all messages sent by a device to detect which M2M group a device belongs to.

13. The security system of claim 1 wherein said means for analysing comprises means for computing the total word vocabulary of messages sent by a device, wherein the distribution of word frequencies acts as a signature for the text of messages originating from the device;

and means for identifying at least one of the M2M operated devices from said computed word vocabulary.

14. The security system of claim 1 comprising means for extracting vocabulary data from the captured data;

and means for differentiating comprises computing the distribution of word frequencies from the vocabulary data to determine whether a device exhibits human or machine originated traffic.

17. The security system of claim 1 comprising means for labelling M2M devices from known stored patterns of devices in the device information store which are known to be M2M devices, then their patterns can be used to predict whether other devices are M2M.

18. The security system of claim 1 comprising means for labelling M2M devices from suspected stored patterns of devices in the device information store which are suspected to be M2M devices, then their patterns can be used to predict whether other devices are M2M.

19. The security system of claim 1 comprising means for clustering similar devices, wherein each cluster comprises a model of a typical traffic pattern.

20. The security system of claim 1 comprising means for clustering similar devices, wherein each cluster comprises a model of a typical traffic pattern means for extracting, for each cluster, a general characterisation of the patterns that the devices in it share, such that the regularity measure is on average in a certain range, or that most elements of the cluster send to a similar number of peers.

21. The security system of claim 1 comprising means for clustering similar devices, wherein each cluster comprises a model of a typical traffic pattern;

means for extracting, for each cluster, a general characterisation of the patterns that the devices in it share, such that the regularity measure is on average in a certain range, or that most elements of the cluster send to a similar number of peers;

means for detecting a shift in a traffic pattern to determine a change in device behaviour, wherein a sudden change in behaviour from a device indicates suspicious behaviour.

25. The security system of claim 1 comprising at least one network probe for data traffic acquisition, wherein the network probe comprises means for generating statistics on any layer of the communication stack that has information that is of interest.

27. The security system of claim 1 wherein the means for analysing comprises examining at least one unique identifier obtained from the captured data traffic.

31. The security system as claimed in claim 1 comprising means to detect devices from which both machine-generated or algorithmically-generated and human-generated data are sent and means for differentiating between senders who are M2M devices and senders who exhibit patterns of both human and machine traffic.

32. The security system of claim 1 comprising means for detecting normal traffic characteristic patterns for an M2M device and can detect out of the ordinary communication patterns to and from an M2M device;

means to establish whether the out of the ordinary communication poses a security or other threat or signifies malicious activity; and

means for applying security defensive measures if a security threat is posed.

5-6. -6. (canceled)

8. (canceled)

15-16. -16. (canceled)

22-24. -24. (canceled)

26. (canceled)

28-30. -30. (canceled)

33-35. -35. (canceled)

36. A method of providing security in a communications network, said network comprising means to allow a plurality of devices to communicate over the network wherein at least one device is a machine to machine (M2M) operated device and at least one other device is a human operated device, said method comprising:

capturing data traffic originating from the plurality of devices on the network;

analysing the data traffic; and

identifying at least one of the M2M operated devices on the network, wherein the method dynamically adapts to different data traffic patterns on the network.

37-38. -38. (canceled)