Cross-layer correlation in secure cognitive network

• US 9,729,562 B2
• Filed: 03/02/2015
• Issued: 08/08/2017
• Est. Priority Date: 03/02/2015
• Status: Active Grant

• Current Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Carvalho, Marco, Ford, Richard, Sonnenberg, Jerome
• Primary Examiner(s): GOODCHILD, WILLIAM J
• Application Number:
  US14/635,064
• Publication Number:
  US 20160261615A1
• Time in Patent Office: 890 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 2111/06 Multi-objective optimisation, e.g. Pareto optimisation using simulated annealing [SA], ant colony algorithms or genetic algorithms [GA]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 61/5053 Lease time; Renewal aspects
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers

Abstract

A communication network is defended using a distributed infrastructure that leverages coordination across disparate abstraction levels. At each node computing device comprising a communication network, a stored event list is used to detect at least one node event which occurs at a machine code level and is known to have the potential to interfere directly with the internal operation of the node computing device. The at least one node event is one which is exclusive of an event within a network communication domain. In response to detecting the at least one node event at one of the plurality of network nodes, an optimal network-level defensive action is automatically selectively determined by the network. The network level defensive action will involve a plurality of network nodes comprising the communication network.

Claims

1. A method for defending a communication network from an adversarial attack using a distributed infrastructure that leverages coordination across disparate abstraction levels, comprising:

at each node computing device of a plurality of node computing devices comprising a communication network, using a stored event list to detect at least one node event occurring at a machine code level which is known to have the potential to interfere directly with the internal operation of the node computing device;

responsive to detecting the at least one node event at a first node computing device of the plurality of node computing devices,

automatically selectively determining an optimal network-level defensive action involving a plurality of network nodes comprising the communication network, the network-level defensive action based on the at least one node event which was detected and upon a set of known communication requirements established for said communication network; and

causing an increase in at least one second node computing device'"'"'s sensitivity to unexpected variations in network performance, the at least one second node computing device being (a) different from the first node computing device and (b) part of a potential threat path within the communication network; and

wherein the at least one node event comprises an instruction-set level event exclusive of an event within a network communication domain.

2. The method according to claim 1, wherein the network communication domain includes the network communication stack, hardware elements that are exclusively associated with the network communication stack, and a plurality of machine code elements that handle events exclusively pertaining to the communication stack.

3. The method according to claim 1, further comprising automatically selectively implementing a node-level defensive action which affects only the node where the at least one node event has been detected if the at least one node event does not require a network-level defensive action to ensure continued satisfaction of the known communication requirements.

4. The method according to claim 1, further comprising:

maintaining at the plurality of node computing devices a dynamic model which is representative of a pattern of network operation for said communication network;

using said dynamic model to compare actual network-level events to a range of expected network-level events; and

selectively modifying a node-level defensive action which is performed in response to said at least one node event when said actual network-level events do not correspond to a range of expected network-level events.

5. The method according to claim 4, further comprising selectively reducing said range of expected network-level events in response to the node event which has been detected, whereby the network is made more sensitive to unexpected variations in network performance when said at least one node event is detected.

6. The method according to claim 1, wherein the network-level defensive action is selected from the group consisting of network address hopping, multi-link coordination to contextually utilize redundant communication links between node computing devices, and real-time dynamic network topology management.

7. The method according to claim 1, wherein processing activities at the node computing device are performed exclusively using a computer hardware implementation that is resistant to a code injection attack.

8. The method according to claim 7, wherein the computer hardware implementation is comprised of non-real-time alterable circuit logic device capable of being created with or loaded with logical sequences of operation.

9. The method according to claim 1, wherein the at least one node event occurring at a machine code level comprises is an event that is indicative of a code injection attack.

10. The method according to claim 1, wherein the network-level defensive action comprises a modification of communication protocols used for communicating among node computing devices at a network level.

11. The method according to claim 1, responsive to detecting the at least one node event at the node computing device, automatically selectively modifying a predetermined defensive response of one or more of the node computing devices to subsequently detected node events.

12. A communication network which defends itself from adversarial attack using a distributed infrastructure that leverages coordination across disparate abstraction levels, comprising:

a plurality of node computing devices comprising a communication network, each said node computing device using a stored event list to detect at least one node event occurring at a machine code level which is known to have the potential to interfere directly with the internal operation of the node computing device;

at least one processing device which is responsive to detecting the at least one node event at a first node computing device of the plurality of node computing devices, and which

automatically selectively determines an optimal network-level defensive action involving a plurality of network nodes comprising the communication network, the network-level defensive action based on the at least one node event which was detected and upon a set of known communication requirements established for said communication network, and

causes an increase in at least one second node computing device'"'"'s sensitivity to unexpected variations in network performance, the at least one second node computing device being (a) different from the first node computing device and (b) part of a potential threat path within the communication network; and

wherein the at least one node event comprises an instruction-set level event exclusive of an event within a network communication domain.

13. The communication network according to claim 12, wherein the at least one processing device automatically selectively implements a node-level defensive action which affects only the node where the at least one node event has been detected if the at least one node event does not require a network-level defensive action to ensure continued satisfaction of the known communication requirements.

14. The communication network according to claim 12, wherein the at least one processing device

maintains at the plurality of node computing devices a dynamic model which is representative of a pattern of network operation for said communication network;

uses said dynamic model to compare actual network-level events to a range of expected network-level events; and

selectively modifies a node-level defensive action which is performed in response to said at least one node event when said actual network-level events do not correspond to a range of expected network-level events.

15. The communication network according to claim 14, wherein the at least one processing device selectively reduces said range of expected network-level events in response to the node event which has been detected, whereby the network is made more sensitive to unexpected variations in network performance when said at least one node event is detected.

16. The communication network according to claim 12, wherein the network-level defensive action is selected from the group consisting of network address hopping, multi-link coordination to contextually utilize redundant communication links between node computing devices, and real-time dynamic network topology management.

17. The communication network according to claim 12, wherein processing activities at the node computing device are performed exclusively using a computer hardware implementation that is resistant to a code injection attack.

18. The communication network according to claim 17, wherein the computer hardware implementation is comprised of non-real-time alterable circuit logic device capable of being created with or loaded with logical sequences of operation.

19. The communication network according to claim 12, wherein the at least one node event is an event that is indicative of a code injection attack.

20. The communication network according to claim 12, wherein the network-level defensive action comprises a modification of communication protocols used for communicating among node computing devices at a network level.

21. The communication network according to claim 12, wherein the at least one processing device is responsive to detecting the at least one node event at the node computing device to automatically selectively modify a predetermined defensive response of one or more of the node computing devices to subsequently detected node events.