Echo detection of Man-in-the-Middle LAN attacks
Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.
1. A computing system for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising at least one processor and at least one memory storage communicatively coupled to the at least one processor on which is stored computer-readable instructions that when executed by the at least one processor cause the computing system to perform steps including:
during a first period of network operation, emitting a plurality of first echo excitation signals onto the LAN, each first excitation signal x being a sequence of echo requests;
determining, for each first excitation signal, a respective output sequence y of round-trip times (RTTs) and responsively determining, for each first excitation signal, a vector of first network features, wherein the first network features include a mean RTT, a measure of impulse response energy, and a measure of jitter distribution, wherein a value of impulse response energy is calculated as an inverse discrete Fourier transform (DFT) of a ratio of discrete Fourier transforms of the excitation signal x and the output sequence y;
generating from the plurality of vectors of the first network features corresponding to the first excitation signals, a behavior model characterizing a first period operation;
subsequently emitting one or more second excitation signals of sequences of echo requests onto the LAN;
measuring respective vectors of second network features from responses to the second echo excitation signals;
determining, according to the behavior model characterizing the first period operation, that the vectors of the second network features are anomalous with respect to the vectors of the first network features; and
responsively issuing an MITM alert.
2. The system of claim 1 , wherein packet sizes of the echo requests of each of the first and second excitation signals are randomly set to either a maximum or a minimum echo request packet size.
3. The system of claim 2 , wherein the randomly set packet sizes are selected by a pseudorandom binary sequence generator incorporating maximal linear feedback shift registers to provide a maximal length sequence signal.
4. The system of claim 1 , wherein the impulse response energy is calculated for each excitation signal as:
1
N
∑
k
=
1
N
❘
"\[LeftBracketingBar]"
Y
[
k
]
X
[
k
]
❘
"\[RightBracketingBar]"
2
,
wherein functions X and Y are respectively discrete Fourier transforms of the excitation signal x and the output signal y.
5. The system of claim 1 , wherein generating the behavior model characterizing the first period operation comprises applying one or more of a neural network auto-encoder, a “local outlier factor” algorithm, or a machine-learning clustering model, to the first network feature vectors.
6. A computer-based method for detecting Man-in-the-Middle (MITM) intrusions on a local area network (LAN), comprising:
during a first period of network operation, emitting a plurality of first excitation signals onto the LAN, each first excitation signal x being a sequence of echo requests;
determining, for each first excitation signal, a respective output sequence y of round-trip times (RTTs) and responsively determining, for each first excitation signal, a vector of first network features, wherein the first network features include a mean RTT, a measure of impulse response energy, and a measure of jitter distribution, wherein a value of impulse response energy is calculated as an inverse discrete Fourier transform (DFT) of a ratio of discrete Fourier transforms of the excitation signal x and the output sequence y;
generating from the plurality of vectors of the first network features corresponding to the first excitation signals, a behavior model characterizing a first period operation;
subsequently emitting one or more second excitation signals of sequences of echo requests onto the LAN;
measuring respective vectors of second network features from responses to the second excitation signals;
determining, according to the behavior model characterizing the first period operation, that the vectors of the second network features are anomalous with respect to the vectors of the first network features; and
responsively issuing an MITM alert.
7. The method of claim 6 , wherein packet sizes of the echo requests of each of the first and second excitation signals are randomly set to either a maximum or a minimum echo request packet size.
8. The method of claim 7 , wherein the randomly set packet sizes are selected by a pseudorandom binary sequence generator incorporating maximal linear feedback shift registers to provide a maximal length sequence signal.
9. The method of claim 6 , wherein the impulse response energy is calculated for each excitation signal as:
wherein functions X and Y are respectively discrete Fourier transforms of the excitation signal x and the output signal y.
10. The method of claim 6 , wherein generating the behavior model characterizing the first period operation comprises applying one or more of a neural network auto-encoder, a “local outlier factor” algorithm, or a machine-learning clustering model to the first network feature vectors.