Methods and devices for defending a 3G wireless network against malicious attacks
View Patent ↗Wireless state information collected or inferred from a 3G wireless network is used to detect and prevent malicious attacks against the network.
1. A method for detecting an attack against a wireless network comprising:
generating a profile based on non-attack, wireless traffic conditions;
obtaining wireless state information comprising wireless data channel set-up and release information, the time that a mobile device is active and application based information from at least a radio network controller, wherein the application based information is categorized based on the type of multimedia service it provides to a user of the mobile device; and
comparing the obtained information to the profile to determine whether an attack is directed at an element in the wireless network.
2. The method as in claim 1 further comprising preventing malicious traffic intended for a mobile device in the network from reaching the device when the comparison indicates an attack.
3. The method as in claim 1 wherein the state information is collected from one or more network elements in the network.
4. The method as in claim 1 wherein the state information is inferred from knowledge of the network.
5. A device for detecting an attack against a wireless network operable to:
generate a profile based on non-attack, wireless traffic conditions;
obtain wireless state information comprising wireless data channel set-up and release information, the time that a mobile device is active and application based information from at least a radio network controller, wherein the application based information is categorized based on the type of multimedia service it provides to a user of the mobile device; and
compare the obtained information to the profile to determine whether an attack is directed at an element in the wireless network.
6. The device as in claim 5 further operable to prevent malicious traffic intended for a mobile device in the network from reaching the device when the comparison indicates an attack.
7. The device as in claim 5 wherein the device is further operable to collect the state information from one or more elements in the network.
8. The device as in claim 5 wherein the device is further operable to infer state information from knowledge of the network.
9. The method as in claim 1 wherein the wireless state information further comprises time-based mobility activity information.
10. The method as in claim 1 wherein the wireless state information further comprises IP layer information.
11. The method as in claim 10 wherein the IP layer information comprises packet arrivals and information from IP/TCP application layer headers.
12. The device as in claim 5 wherein the wireless state information further comprises time-based mobility activity information.
13. The device as in claim 5 wherein the wireless state information further comprises IP layer information.
14. The device as in claim 13 wherein the IP layer information comprises packet arrivals and information from IP/TCP application layer headers.