Mitigation of attacks on satellite networks
A system includes a terminal and a gateway. The terminal is programmed to identify, in received data, a signature of rogue data that includes at least a device identifier and an application identifier, and to transmit, via uplink to a satellite, the identified signature to a gateway. The gateway is programmed to block downlink data, upon determining that downlink data includes the received signature, and to broadcast the received signature to a second gateway.
1. A system comprising:
a terminal, programmed to:
sniff at least one of uplink and downlink data;
identify, in sniffed data, based on clustering the sniffed data, a signature of rogue data that includes at least a device identifier and an application identifier; and
transmit, via uplink to a satellite, the identified signature to a gateway; and the gateway, programmed to:
block downlink data, upon determining that downlink data includes the received signature; and
broadcast the received signature to a second gateway.
2. The system of claim 1 , further comprising a second terminal, programmed to:
receive the signature from the second gateway;
receive data from a user device; and
block uplink data associated with the received data upon determining that the received data from the user device includes the received signature.
3. The system of claim 2 , wherein the second terminal is further programmed to store the received signature locally.
4. The system of claim 1 , wherein the gateway is further programmed to:
sniff at least one of uplink and downlink data;
identify the signature of a rogue device;
broadcast the identified signature; and
block at least one of the downlink and uplink of the rogue data.
5. The system of claim 1 , wherein the signature further includes a data pattern, a type of attack, a frequency of attack, and a status.
6. The system of claim 5 , wherein the type of attack is at least one of SYN Flood, UDP Flood, SMBLoris, ICMP Flood, and HTTP Get Flood.
7. The system of claim 1 , wherein the terminal is further programmed to change a status of the signature to expired upon determining that the received data lacks rogue data associated with the signature.
8. The system of claim 1 , wherein the terminal is further programmed to update a previously stored signature and broadcast the updated signature.
9. A method, comprising:
sniffing, at a terminal, at least one of uplink and downlink data;
identifying, in sniffed data at the terminal, based on clustering the sniffed data, a signature of rogue data that includes at least a device identifier and an application identifier; and
transmitting, via uplink to a satellite, the identified signature to a gateway;
blocking downlink data, at the gateway, upon determining that downlink data includes the received signature; and
broadcasting the received signature to a second gateway.
10. The method of claim 9 , further comprising:
receiving, at a second terminal, the signature from the second gateway;
receiving, at the second terminal, data from a user device; and
blocking uplink data associated with the received data, at the second terminal, upon determining that the received data from the user device includes the received signature.
11. The method of claim 10 , further comprising storing the received signature locally at the second terminal.
12. The method of claim 9 , further comprising:
sniffing, at the gateway, at least one of uplink and downlink data;
identifying, at the gateway, the signature of a rogue device;
broadcasting, at the gateway, the identified signature; and
blocking, at the gateway, at least one of the downlink and uplink of the rogue data.
13. The method of claim 9 , wherein the signature further includes a data pattern, a type of attack, a frequency of attack, and a status.
14. The method of claim 13 , wherein the type of attack is at least one of SYN Flood, UDP Flood, SMBLoris, ICMP Flood, and HTTP Get Flood.
15. The method of claim 9 , further comprising updating, at the terminal, a previously stored signature and broadcasting the updated signature.
16. A system, comprising:
means for sniffing, at a terminal, at least one of uplink and downlink data;
means for identifying, in sniffed data at the terminal, based on clustering the sniffed data, a signature of rogue data that includes at least a device identifier and an application identifier; and
means for transmitting, via uplink to a satellite, the identified signature to a gateway;
means for blocking downlink data, at the gateway, upon determining that downlink data includes the received signature; and
means for broadcasting the received signature to a second gateway.
17. The system of claim 16 , further comprising:
means for receiving, at a second terminal, the signature from the second gateway;
means for receiving, at the second terminal, data from a user device; and
means for blocking uplink data associated with the received data, at the second terminal, upon determining that the received data from the user device includes the received signature.