Method and apparatus for machine to machine network security monitoring in a communications network
A method, non-transitory computer readable medium and apparatus for providing network security monitoring in a communications network are disclosed. For example, the method receives communications traffic associated with a sensor network from a sensor that is a member of the sensor network, analyzes the communications traffic to determine if an attack is occurring on the sensor network, and generates an alarm if the attack is occurring on the sensor network.
1. A method for generating an alarm, the method comprising:
receiving, by a processor, communications traffic associated with a sensor network at a customer premises from a security sensor that monitors an area within the customer premises, wherein the security sensor is a member of the sensor network, wherein the communications traffic comprises communications between sensors of the sensor network, wherein the communications traffic is recorded and stored in a sensor information database;
analyzing, by the processor, the communications traffic to determine when an attack is occurring on the sensor network, wherein the analyzing comprises comparing the communications traffic to historical communications traffic patterns, wherein the historical communications traffic patterns comprise: which sensors communicate with one another, when a sensor issues a communication message, an order of communications between multiple sensors, and a type of communication that is issued by the sensor; and
generating, by the processor, the alarm when the attack is occurring on the sensor network.
2. The method of claim 1 , wherein the analyzing is performed by the processor of a security monitoring server in a communications network.
3. The method of claim 1 , wherein the analyzing further comprises:
determining when a topology of the sensor network has changed based upon the communications traffic.
4. The method of claim 1 , wherein the analyzing further comprises:
detecting an unusual pattern of communications in the communications traffic.
5. The method of claim 1 , wherein the attack comprises a denial of service attack.
6. The method of claim 1 , wherein the attack comprises a message replay attack.
7. The method of claim 1 , wherein the attack comprises a malware attack.
8. The method of claim 1 , wherein the attack comprises a device insertion attack.
9. The method of claim 1 , wherein the alarm is sent to a subscriber endpoint.
10. A non-transitory computer-readable medium storing a plurality of instructions, which when executed by a processor, cause the processor to perform operations for generating an alarm, the operations comprising:
receiving communications traffic associated with a sensor network at a customer premises from a security sensor that monitors an area within the customer premises, wherein the security sensor is a member of the sensor network, wherein the communications traffic comprises communications between sensors of the sensor network, wherein the communications traffic is recorded and stored in a sensor information database;
analyzing the communications traffic to determine when an attack is occurring on the sensor network, wherein the analyzing comprises comparing the communications traffic to historical communications traffic patterns, wherein the historical communications traffic patterns comprise: which sensors communicate with one another, when a sensor issues a communication message, an order of communications between multiple sensors, and a type of communication that is issued by the sensor; and
generating the alarm when the attack is occurring on the sensor network.
11. The non-transitory computer-readable medium of claim 10 , wherein the analyzing further comprises:
determining when a topology of the sensor network has changed based upon the communications traffic.
12. The non-transitory computer-readable medium of claim 10 , wherein the analyzing further comprises:
detecting an unusual pattern of communications in the communications traffic.
13. The non-transitory computer-readable medium of claim 10 , wherein the attack comprises a denial of service attack.
14. The non-transitory computer-readable medium of claim 10 , wherein the attack comprises a message replay attack.
15. The non-transitory computer-readable medium of claim 10 , wherein the attack comprises a malware attack.
16. An apparatus for generating an alarm, the apparatus comprising:
a processor; and
a non-transitory computer-readable medium storing a plurality of instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising:
receiving communications traffic associated with a sensor network at a customer premises from a security sensor that monitors an area within the customer premises, wherein the security sensor is a member of the sensor network, wherein the communications traffic comprises communications between sensors of the sensor network, wherein the communications traffic is recorded and stored in a sensor information database;
analyzing the communications traffic to determine when an attack is occurring on the sensor network, wherein the analyzing comprises comparing the communications traffic to historical communications traffic patterns, wherein the historical communications traffic patterns comprise: which sensors communicate with one another, when a sensor issues a communication message, an order of communications between multiple sensors, and a type of communication that is issued by the sensor; and
generating the alarm when the attack is occurring on the sensor network.
17. The apparatus of claim 16 , wherein the analyzing further comprises:
determining when a topology of the sensor network has changed based upon the communications traffic.
18. The apparatus of claim 16 , wherein the analyzing further comprises:
detecting an unusual pattern of communications in the communications traffic.
19. The apparatus of claim 16 , wherein the attack comprises a denial of service attack.
20. The apparatus of claim 16 , wherein the attack comprises a message replay attack.