Method and device for detecting anomalies in a computer network

Patent metadata

Field	Value
Publication number	US-11178162-B2
Application number	US-201916453370-A
Country	US
Kind code	B2
Filing date	Jun 26, 2019
Priority date	Jul 30, 2018
Publication date	Nov 16, 2021
Grant date	Nov 16, 2021

Abstract

A method for detecting anomalies in a computer network, in which a message transmitted over the computer network is received or recorded by a node of the computer network; based on at least the message, it is checked by a detection mechanism of the node whether the anomalies have occurred, and an occurrence of the anomalies is either confirmed or refuted according to a predefined detection rule of the detection mechanism.

First claim

What is claimed is:

1. A method for detecting anomalies in a computer network, comprising:
receiving or recording, by a node of the computer network, a message transmitted over the computer network;
based at least on the message, checking, by a detection mechanism of the node, whether an anomaly has occurred; and
confirming or refuting an occurrence of the anomaly according to a predefined detection rule of the detection mechanism;
wherein:
(i) the message is received by the node in response to a request by the node, the predefined detection rule defines an expected response to the request by the node, and the confirming or refuting is performed by comparing (a) the message received in the response to the request by the node to (b) the expected response;
(ii) the message is received or recorded by the node after the node had previously sent an earlier message in a predefined state, the predefined detection rule defines an expected value of the received or recorded message for the predefined state of the sending of the earlier message, and the confirming or refuting is performed based on (1) a determination of the node being in the predefined state when the earlier message was sent and (2) a comparison of (a) a value of the received or recorded message to (b) the expected value;
(iii) the message is received or recorded by the node while the node is in the predefined state, the predefined detection rule defines an expected value of the received or recorded message whenever received or recorded while the node is in the predefined state, and the confirming or refuting is performed based on (1) a determination of the node being in the predefined state when the message is received or recorded and (2) a comparison of (a) a value of the received or recorded message to (b) the expected value; or
(iv) the method includes the confirming of the occurrence of the anomaly, the predefined detection rule defines that the node does not receive or record the message whenever the node is in a predefined node state, and the occurrence is confirmed in response to determining that, in contravention to the predefined rule, the message has been received or recorded while the node was in the predefined node state.

2. The method as recited in claim 1 , wherein the computer network includes a switching device and terminals, and the node is one of the terminals.

3. The method as recited in claim 1 , wherein the message is received by the node in response to the request by the node, the predefined detection rule defines the expected response to the request by the node, and the confirming or refuting is performed by comparing (a) the message received in the response to the request by the node to (b) the expected response.

4. The method as recited in claim 1 , wherein the message is received by the node after the node had previously sent the earlier message in the predefined state of the sending of the earlier message, the predefined detection rule defines the expected value of the received message for the predefined state of the sending of the earlier message, and the confirming or refuting is performed based on (1) the determination of the node being in the predefined state when the earlier message was sent and (2) the comparison of (a) the value of the received message to (b) the expected value.

5. The method as recited in claim 1 , wherein the message is recorded by the node after the node had previously sent an earlier message in the predefined state of the sending of the earlier message, the predefined detection rule defines the expected value of the recorded message for the predefined state of the sending of the earlier message, and the confirming or refuting is performed based on (1) the determination of the node being in the predefined state when the earlier message was sent and (2) the comparison of (a) the value of the recorded message to (b) the expected value.

6. The method as recited in claim 1 , wherein the message is received by the node while the node is in the predefined state, the predefined detection rule defines the expected value of the received message whenever received while the node is in the predefined state, and the confirming or refuting is performed based on (1) the determination of the node being in the predefined state when the message is received and (2) the comparison of (a) the value of the received message to (b) the expected value.

7. The method as recited in claim 1 , wherein the message is recorded by the node while the node is in the predefined state, the predefined detection rule defines the expected value of the recorded message whenever recorded while the node is in the predefined state, and the confirming or refuting is performed based on (1) the determination of the node being in the predefined state when the message is recorded and (2) the comparison of (a) the value of the recorded message to (b) the expected value.

8. The method as recited in claim 1 , wherein the method includes the confirming of the occurrence of the anomaly, the predefined detection rule defines that the node does not receive the message whenever the node is in the predefined node state, and the occurrence is confirmed in response to determining that, in contravention to the predefined rule, the message has been received while the node was in the predefined node state.

9. The method as recited in claim 1 , wherein the method includes the confirming of the occurrence of the anomaly, the predefined detection rule defines that the node does not record the message whenever the node is in the predefined node state, and the occurrence is confirmed in response to determining that, in contravention to the predefined rule, the message has been recorded while the node was in the predefined node state.

10. A non-transitory machine-readable memory medium on which is stored a computer program for detecting anomalies in a computer network, the computer program, when executed on a computer, causing the computer to perform a method, the method comprising:
receiving or recording, by a node of the computer network, a message transmitted over the computer network;
based at least on the message, checking, by a detection mechanism of the node, whether an anomaly has occurred; and
confirming or refuting an occurrence of the anomaly according to a predefined detection rule of the detection mechanism;
wherein:
(i) the message is received by the node in response to a request by the node, the predefined detection rule defines an expected response to the request by the node, and the confirming or refuting is performed by comparing (a) the message received in the response to the request by the node to (b) the expected response;
(ii) the message is received or recorded by the node after the node had previously sent an earlier message in a predefined state, the predefined detection rule defines an expected value of the received or recorded message for the predefined state of the sending of the earlier message, and the confirming or refuting is performed based on (1) a determination of the node being in the predefined state when the earlier message was sent and (2) a comparison of (a) a value of the received or recorded message to (b) the expected value;
(iii) the message is received or recorded by the node while the node is in the predefined state, the predefined detection rule defines an expected value of the received or recorded message whenever received or recorded while the node is in the predefined state, and the confirming or refuting is performed based on (1) a determination of the node being in the predefined state when the message is received or recorded and (2) a comparison of (a) a value of the received or recorded message to (b) the expected value; or

Assignees

• Bosch Gmbh Robert

Inventors

• Boukricha Hana
• Wolfinger Janin
• Herrmann Michael
• Duplys Paulius

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title