Network intrusion mitigation
View Patent ↗A request is received to reestablish a connection to an end device in a network. At least one datum is identified indicating an error condition, the at least one datum including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet. Based on the one or more data values, user input is requested to deny the reestablish connection request. In response to the user input, the end device is prevented from reestablishing a link on the network.
1. A device that includes a processor and a memory, the memory storing instructions executable by the processor such that the device is programmed to:
receive a reestablish connection request via a first user input to terminate and then reestablish a connection to an end device in a network;
identify at least one error condition, the at least one error condition including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet;
provide a confirmation request for a second user input to deny the reestablish connection request, wherein the confirmation request for the second user input to deny the reestablish connection request is triggered by identifying the at least one error condition; and
in response to the second user input, prevent the end device from reestablishing a link on the network.
2. The device of claim 1 , wherein the network is a mesh network.
3. The device of claim 1 , wherein the device is further programmed to:
reestablish the connection between the device and the end device, based upon the second user input.
4. The device of claim 1 , wherein the device is further programmed to:
identify the BER by determining that a packet error rate for communications from the end device exceed a predetermined threshold.
5. The device of claim 4 , wherein the device is further programmed to:
start a BER timer; and
determine when the BER timer exceeds a predetermined BER timer threshold.
6. The device of claim 1 , wherein the device is further programmed to determine the RSSI value exceeds a predetermined threshold.
7. The device of claim 6 , wherein the device is further programmed to:
start a RSSI timer; and
determine when the RSSI timer exceeds a predetermined RSSI timer threshold.
8. The device of claim 1 , wherein the device is further programmed to:
identify the foreign packet by comparing an address of the foreign packet to a known address.
9. The device of claim 8 , wherein the device is further programmed to:
start a foreign packet counter; and
determine when the foreign packet counter exceeds a predetermined foreign packet counter threshold.
10. The device of claim 1 , wherein the device is a ZigBee coordinator.
11. A method comprising:
receiving a reestablish connection request via a first user input to terminate and then reestablish a connection to an end device in a network;
identifying at least one error condition, the at least one error condition including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet;
provide a confirmation request for a second user input to deny the reestablish connection request, wherein the confirmation request for the second user input to deny the reestablish connection request is triggered by identifying the at least one error condition; and
in response to the second user input, preventing the end device from reestablishing a link on the network.
12. The method of claim 11 , wherein the network is a mesh network.
13. The method of claim 11 , further comprising reestablishing the connection between the device and the end device, based upon the second user input.
14. The method of claim 11 , further comprising:
identify the BER by determining that a packet error rate for communications from the end device exceed a predetermined threshold.
15. The method of claim 14 , further comprising:
starting a BER timer; and
determining when the BER timer exceeds a predetermined BER timer threshold.
16. The method of claim 11 , further comprising determining the RSSI value exceeds a predetermined threshold.
17. The method of claim 11 , further comprising:
starting a RSSI timer; and
determining when the RSSI timer exceeds a predetermined RSSI timer threshold.
18. The method of claim 11 , further comprising:
identifying the foreign packet by comparing an address of the foreign packet to a known address.
19. The method of claim 11 , further comprising:
starting a foreign packet counter; and
determining when the foreign packet counter exceeds a predetermined foreign packet counter threshold.