System and method to detect attacks on mobile wireless networks based on network controllability analysis

Patent metadata

Field	Value
Publication number	US-10091218-B2
Application number	US-201615075058-A
Country	US
Kind code	B2
Filing date	Mar 18, 2016
Priority date	Jan 23, 2012
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

Described is a system for detecting attacks of misinformation on communication networks. Network controllability metrics on a graphical representation of a communication network are computed. Changes in the network controllability metrics are detected, and attack of misinformation on the communication network are detected based on the detected changes in the network controllability metrics.

First claim

What is claimed is:

1. A system for detecting and mitigating attacks of misinformation on communication networks, the system comprising:
one or more processors and a non-transitory memory having instructions encoded thereon such that when the instructions are executed, the one or more processors perform operations of:
computing a plurality of network controllability metrics on a representation of a communication network comprising a plurality of nodes;
detecting changes in the plurality of network controllability metrics;
using the detected changes to detect an attack of misinformation on the communication network, wherein given a set of examples of network controllability metric data representing a baseline behavior and a set of examples of network controllability metric data representing an attack behavior, a machine learning classifier determines a threshold for attack detection based on differences between the baseline behavior and the attack behavior;
attributing the attack to an attacking node in the communication network; and
performing a mitigation action that isolates the attacking node from the communication network.

2. The system as set forth in claim 1 , wherein the representation includes network topology, network dependencies, and application dependencies within the communication network.

3. The system as set forth in claim 1 , wherein the plurality of network controllability metrics are computed as a function of a pattern of communication between the plurality of nodes of the communication network during a given time window.

4. The system as set forth in claim 1 , wherein each network controllability metric is represented as a diode in a diode pattern panel, wherein network controllability metrics displaying attack behavior, as determined by the threshold for attack detection, are highlighted in the diode pattern panel.

5. The system as set forth in claim 1 , wherein the mitigation action further comprises informing every other node in the communication network to ignore anything that the attacking node transmits, and not to send anything to, or through, the attacking node.

6. The system as set forth in claim 1 , wherein the one or more processors further perform operations of:
outputting features representing each of the plurality of network controllability metrics;
converting each feature into a binary indication of whether a value is anomalous or not anomalous; and
using the binary indication to detect changes in the plurality of network controllability metrics.

7. The system as set forth in claim 1 , wherein the representation is a graphical representation of network topology, network dependencies, and application dependencies within the communication network.

8. The system as set forth in claim 1 , wherein the plurality of network controllability metrics are computed on a graphical representation of a pattern of communication between the plurality of nodes of the communication network during a given time window.

9. A computer-implemented method for detecting and mitigating attacks of misinformation on communication networks, comprising:
an act of causing one or more processors to execute instructions stored on a non-transitory memory such that upon execution, the one or more processors perform operations of:
computing a plurality of network controllability metrics on a representation of a communication network comprising a plurality of nodes;
detecting changes in the plurality of network controllability metrics;
using the detected changes to detect an attack of misinformation on the communication network, wherein given a set of examples of network controllability metric data representing a baseline behavior and a set of examples of network controllability metric data representing an attack behavior, a machine learning classifier determines a threshold for attack detection based on differences between the baseline behavior and the attack behavior;
attributing the attack to an attacking node in the communication network; and
performing a mitigation action that isolates the attacking node from the communication network.

10. The method as set forth in claim 9 , wherein the representation includes network topology, network dependencies, and application dependencies within the communication network.

11. The method as set forth in claim 9 , wherein the plurality of network controllability metrics are computed as a function of a pattern of communication between the plurality of nodes of the communication network during a given time window.

12. The method as set forth in claim 9 , wherein each network controllability metric is represented as a diode in a diode pattern panel, wherein network controllability metrics displaying attack behavior, as determined by the threshold for attack detection, are highlighted in the diode pattern panel.

13. A computer program product for detecting and mitigating attacks of misinformation on communication networks, the computer program product comprising:
computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having one or more processors for causing the processor to perform operations of:
computing a plurality of network controllability metrics on a representation of a communication network comprising a plurality of nodes;
detecting changes in the plurality of network controllability metrics;
using the detected changes to detect an attack of misinformation on the communication network, wherein given a set of examples of network controllability metric data representing a baseline behavior and a set of examples of network controllability metric data representing an attack behavior, a machine learning classifier determines a threshold for attack detection based on differences between the baseline behavior and the attack behavior;
attributing the attack to an attacking node in the communication network; and
performing a mitigation action that isolates the attacking node from the communication network.

14. The computer program product as set forth in claim 13 , wherein the representation includes network topology, network dependencies, and application dependencies within the communication network.

15. The computer program product as set forth in claim 13 , wherein the plurality of network controllability metrics are computed as a function of a pattern of communication between the plurality of nodes of the communication network during a given time window.

16. The computer program product as set forth in claim 13 , wherein each network controllability metric is represented as a diode in a diode pattern panel, wherein network controllability metrics displaying attack behavior, as determined by the threshold for attack detection, are highlighted in the diode pattern panel.

Assignees

• Hrl Lab Llc

Inventors

• Holland Gavin D
• Howard Michael D
• Ding Chong

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06N20/00

  Machine learning · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title