Methods, systems, and computer readable media for detecting physical link intrusions
View Patent ↗The subject matter described herein relates to method, systems, and computer readable media for detecting physical link intrusions. A method for detecting physical link intrusions includes monitoring a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap. The method also includes determining whether a change in the link delay signature has met or exceeded a threshold value. The method further includes in response to determining that the change in the link delay signature has met or exceeded the threshold value, determining that a physical link intrusion has occurred.
1. A method for detecting physical link intrusions in a network, the method comprising:
monitoring a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap;
determining whether a change in the link delay signature has met or exceeded a threshold value; and
in response to determining that the change in the link delay signature has met or exceeded a threshold value, determining that a physical link intrusion has occurred, wherein one of the one-way link delay measurements for determining the change in the link delay signature is obtained by:
transmitting a first packet from a first network device;
passively intercepting the first packet, transmitting a first copy of the first packet to the first network device, and transmitting a second copy of the first packet to a second network device;
at the first network device, recording a time of receipt of the first copy of the first packet as an origin timestamp;
at the second network device, recording a time of receipt of the second copy of the first packet as a receive timestamp;
transmitting a second packet from the first network device, the second packet including the origin timestamp;
passively intercepting the second packet and transmitting a first copy of the second packet to the second network device;
at the second network device, receiving the first copy of the second packet and extracting the origin timestamp from the first copy of the second packet; and
calculating link delay from the first network device to the second network device using the origin timestamp and the receive timestamp.
2. The method of claim 1 wherein each of the first network device and the second network device comprises a network equipment test device.
3. The method of claim 1 wherein the first network device and the second network device are synchronized to a common clock source.
4. The method of claim 1 wherein the physical link is a wired link, an electrical link, an optical link, a fiber link, or a fiber-optic link.
5. The method of claim 1 wherein determining whether the change in the link delay signature has met or exceeded the threshold value includes performing data analysis using the one-way link delay measurements.
6. The method of claim 5 wherein the data analysis includes time analysis and/or frequency analysis.
7. The method of claim 1 wherein the threshold value meets or exceeds a baseline value.
8. The method of claim 1 wherein the one-way link delay measurements are obtained periodically, aperiodically, or dynamically.
9. A system for detecting physical link intrusions in a network, the system comprising:
a processor;
a memory; and
an intrusion detection module (IDM) implemented using the processor and the memory, wherein the IDM is configured to monitor a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap, to determine whether a change in the link delay signature has met or exceeded a threshold value, and to, in response to determining that the change in the link delay signature has met or exceeded a threshold value, determine that the physical link has been compromised, wherein one of the one-way link delay measurements for determining the change in the link delay signature is obtained by:
transmitting a first packet from a first network device;
passively intercepting the first packet, transmitting a first copy of the first packet to the first network device, and transmitting a second copy of the first packet to a second network device;
at the first network device, recording a time of receipt of the first copy of the first packet as an origin timestamp;
at the second network device, recording a time of receipt of the second copy of the first packet as a receive timestamp;
transmitting a second packet from the first network device, the second packet including the origin timestamp;
passively intercepting the second packet and transmitting a first copy of the second packet to the second network device;
at the second network device, receiving the first copy of the second packet and extracting the origin timestamp from the first copy of the second packet; and
calculating link delay from the first network device to the second network device using the origin timestamp and the receive timestamp.
10. The system of claim 9 wherein each of the first network device and the second network device comprises a network equipment test device.
11. The system of claim 9 wherein the first network device and the second network device are synchronized to a common clock source.
12. The system of claim 9 wherein the physical link is a wired link, an electrical link, an optical link, a fiber link, or a fiber-optic link.
13. The system of claim 9 wherein the IDM is configured to perform data analysis using the one-way link delay measurements.
14. The system of claim 13 wherein the data analysis includes time analysis and/or frequency analysis.
15. The system of claim 9 wherein the threshold value meets or exceeds a baseline value.
16. The system of claim 9 wherein the one-way link delay measurements are obtained periodically, aperiodically, or dynamically.
17. A non-transitory computer readable medium having stored thereon executable instructions embodied in the computer readable medium that when executed by a processor of a computer cause the computer to perform steps comprising:
monitoring a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap;
determining whether a change in the link delay signature has met or exceeded a threshold value; and
in response to determining that the change in the link delay signature has met or exceeded a threshold value, determining that a physical link intrusion has occurred, wherein one of the one-way link delay measurements for determining the change in the link delay signature is obtained by:
transmitting a first packet from a first network device;
passively intercepting the first packet, transmitting a first copy of the first packet to the first network device, and transmitting a second copy of the first packet to a second network device;
at the first network device, recording a time of receipt of the first copy of the first packet as an origin timestamp;
at the second network device, recording a time of receipt of the second copy of the first packet as a receive timestamp;
transmitting a second packet from the first network device, the second packet including the origin timestamp;
passively intercepting the second packet and transmitting a first copy of the second packet to the second network device;
at the second network device, receiving the first copy of the second packet and extracting the origin timestamp from the first copy of the second packet; and
calculating link delay from the first network device to the second network device using the origin timestamp and the receive timestamp.