SYSTEM AND METHOD TO DETECT ATTACKS ON MOBILE WIRELESS NETWORKS BASED ON NETWORK CONTROLLABILITY ANALYSIS

• US 20170318034A1
• Filed: 03/18/2016
• Published: 11/02/2017
• Est. Priority Date: 01/23/2012
• Status: Active Grant

• Current Assignee: HRL Laboratories LLC (The Boeing Co.)
• Original Assignee: HRL Laboratories LLC (The Boeing Co.)
• Inventors: Holland, Gavin D., Howard, Michael D., Ding, Chong
• Granted Patent: US 10,091,218 B2
• Time in Patent Office: Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Described is a system for detecting attacks of misinformation on communication networks. Network controllability metrics on a graphical representation of a communication network are computed. Changes in the network controllability metrics are detected, and attack of misinformation on the communication network are detected based on the detected changes in the network controllability metrics.

Claims

1. A system for detecting attacks of misinformation on communication networks, the system comprising:

one or more processors and a non-transitory memory having instructions encoded, thereon such that when the instructions are executed, the one or more processors perform operations of;

computing a plurality of network controllability metrics on a representation of a communication network comprising a plurality, of nodes;

detecting changes in the plurality of network controllability metrics; and

using the detected changes to detect attacks of misinformation on the communication network.

2. The system as set forth in claim 1, wherein the representation includes network topology, network dependencies, and application dependencies within the communication network.

3. The system as set forth in claim 1, wherein the plurality of network controllability metrics are computed as a function of a pattern of communication between a plurality of nodes of the communication network during a given time window.

4. The system as set forth in claim 1, wherein given a set of examples of network controllability metric data representing a baseline behavior and a set of examples of network controllability metric data representing an attack behavior, a machine learning classifier determines a threshold for attack detection based on differences between the baseline behavior and the attack behavior.

5. The system as set forth in claim 4, wherein each network controllability metric is represented as a diode in a diode pattern panel, wherein network controllability metrics displaying attack behavior, as determined by the threshold for attack detection, are highlighted in the diode pattern panel.

16. The system as set forth in claim 1, wherein upon detection of an attack of misinformation on the communication network, the one or more processors further perform an operation of performing a mitigation action.

17. The system as set forth in claim 16, wherein the mitigation action comprises isolating an attacking node from the rest of the communication network.

18. The system as set forth in claim 17, wherein the mitigation action comprises informing every other node in the communication network to ignore anything that the attacking node transmits, and not to send anything to, or through, the attacking node.

19. The system as set forth in claim 1, wherein the one or more processors further perform operations of:

outputting features representing each of the plurality of network controllability metrics;

converting each feature into a binary indication of whether a value is anomalous or not anomalous; and

using the binary indication to detect changes in the plurality of network controllability metrics.

20. The system as set forth in claim 1, wherein the representation is a graphical representation of network topology, network dependencies, and application dependencies within the communication network

21. The system as set forth in claim 1, wherein the plurality of network controllability metrics are computed on a graphical representation of a pattern of communication between a plurality of nodes of the communication network during a given time window.

6. A computer-implemented method for detecting attacks of misinformation on communication networks, comprising:

an act of causing one or more processors to execute instructions stored on a non-transitory memory such that upon execution, the one or more processors perform operations of;

computing a plurality of network controllability metrics on a representation of a communication network comprising a plurality of nodes;

detecting changes in the plurality of network controllability metrics; and

using the detected changes to detect attacks of misinformation on the communication network.

7. The method as set forth in claim 6, wherein the representation includes network topology, network dependencies, and application dependencies within the communication network.

8. The method as set forth in claim 6, wherein the plurality of network controllability metrics are computed as a function of a pattern of communication between a plurality of nodes of the communication network during a given time window.

9. The method as set forth in claim 6, wherein given a set of examples of network controllability metric data representing a baseline behavior and a set of examples of network controllability metric data representing an attack behavior, a machine learning classifier determines a threshold for attack detection based on differences between the baseline behavior and the attack behavior.

10. The method as set forth in claim 9, wherein each network controllability metric is represented as a diode in a diode pattern panel, wherein network controllability metrics displaying attack behavior, as determined by the threshold for attack detection, are highlighted in the diode pattern panel.

11. A computer program product for detecting attacks of misinformation on communication networks, the computer program product comprising:

computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having one or more processors for causing the processor to perform operations of;

computing a plurality of network controllability metrics on a representation of a communication network comprising a plurality of nodes;

detecting changes in the plurality of network controllability metrics; and

using the detected changes to detect attacks of misinformation on the communication network.

12. The computer program product as set forth in claim 11, wherein the representation includes network topology, network dependencies, and application dependencies within the communication network.

13. The computer program product as set forth in claim 11, wherein the plurality of network controllability metrics are computed as a function of a pattern of communication between a plurality of nodes of the communication network during a given time window.

14. The computer program product as set forth in claim 11, wherein given a set of examples of network controllability metric data representing a baseline behavior and a set of examples of network controllability metric data representing an attack behavior, a machine learning classifier determines a threshold for attack detection based on differences between the baseline behavior and the attack behavior.

15. The computer program product as set forth in claim 14, wherein each network controllability metric, is represented as a diode in a diode pattern panel, wherein network controllability metrics displaying attack behavior, as determined by the threshold for attack detection, are highlighted in the diode pattern panel.