Attack detection and mitigation for fine timing measurement

1. A method comprising:

recording, at a receiving device, a plurality of parameters associated with fine timing measurement (FTM) frames exchanged between a sending device and the receiving device by:

receiving a request FTM frame from the sending device;

recording, for the request FTM frame from the sending device, a received signal strength indicator (RSSI) value, a frame timestamp, a time of departure (ToD) value, a time of arrival value (ToA), a ToD error value, a ToA error value, and a burst window parameter value; and

performing an iterative FTM burst sequence according to the burst window parameter value;

identifying, using the recorded plurality of parameters, a device profile for the sending device comprising at least one of a chipset type, an operating system (OS), and OS traffic schedule variations;

determining, using the device profile, a behavior filter for FTM traffic from the sending device; and

filtering FTM traffic from the sending device according to the behavior filter.

2. The method of claim 1 ,

wherein performing an iterative FTM burst sequence according to the burst window parameter value comprises:

transmitting a responder FTM frame to the sending device;

recording a ToD value for the responder FTM frame;

receiving an acknowledgement (ACK) frame from the sending device;

recording a ToA value for the responder FTM frame at the sending device, a ToD value for the ACK frame, and a ToA value for the ACK frame at the receiving device; and

repeating the iterative FTM burst sequence according to the burst window parameter value; and

storing the recorded plurality of parameters as learning model input data.

3. The method of claim 2 , further comprising:

determining, using a long short-term Memory (LSTM) classifier and from the learning model input data at least one learned device profile for one of the plurality of sending devices; and

wherein identifying the device profile for the sending device further comprises:

identifying the device profile for the sending device using the at least one learned device profile.

4. The method of claim 3 , wherein the method further comprise:

during the performance an iterative FTM burst sequence, determining from the learning model input data when a device profile is available;

when the device profile is not available, continuing the iterative FTM burst sequence and recording additional parameters; and

when the device profile is available, filtering FTM traffic in the iterative FTM burst sequence from the sending device according to the behavior filter.

5. The method of claim 1 , wherein determining the behavior filter for FTM traffic from the sending device comprises:

determining at least one expected traffic pattern for FTM traffic from the sending device based on the device profile; and

determining a variation threshold for the at least one expected traffic pattern.

6. The method of claim 5 , wherein filtering FTM traffic from the sending device according to the behavior filter further comprises:

receiving FTM traffic marked as from the sending device;

comparing traffic parameters for the FTM traffic to the at least one expected traffic pattern and the variation threshold for the sending device;

wherein when the comparison indicates the traffic parameters are outside of the variation threshold for the at least one expected traffic pattern, dropping the FTM traffic marked as from the sending device; and

wherein when the comparison indicates the traffic parameters are within the variation threshold for the at least one expected traffic pattern:

recording a plurality of parameters associated with FTM frames of the FTM traffic marked as from the sending device; and

responding to the FTM frames.

7. The method of claim 1 , further comprising:

detecting a responder impersonation from the FTM traffic;

interrupting the FTM traffic;

transmitting an updated burst window parameter value to the sending device; and

resuming FTM traffic according to the updated burst window parameter value.

8. A system comprising one or more computer processors and a memory containing a program which when executed by the computer processors performs an operation comprising:

recording, at a receiving device, a plurality of parameters associated with fine timing measurement (FTM) frames exchanged between a sending device and the receiving device by:

receiving a request FTM frame from the sending device;

recording, for the request FTM frame from the sending device, a received signal strength indicator (RSSI) value, a frame timestamp, a time of departure (ToD) value, a time of arrival value (ToA), a ToD error value, a ToA error value, and a burst window parameter value; and

performing an iterative FTM burst sequence according to the burst window parameter value;

identifying, using the recorded plurality of parameters, a device profile for the sending device comprising at least one of a chipset type, an operating system (OS), and OS traffic schedule variations;

determining, using the device profile, a behavior filter for FTM traffic from the sending device; and

filtering FTM traffic from the sending device according to the behavior filter.

9. The system of claim 8 ,

wherein performing an iterative FTM burst sequence according to the burst window parameter value comprises:

transmitting a responder FTM frame to the sending device;

recording a ToD value for the responder FTM frame;

receiving an acknowledgement (ACK) frame from the sending device;

recording a ToA value for the responder FTM frame at the sending device, a ToD value for the ACK frame, and a ToA value for the ACK frame at the receiving device; and

repeating the iterative FTM burst sequence according to the burst window parameter value; and

storing the recorded plurality of parameters as learning model input data.

10. The system of claim 9 , further comprising:

determining using a long short-term Memory (LSTM) classifier and from the learning model input data at least one learned device profile for one of the plurality of sending devices; and

wherein identifying the device profile for the sending device further comprises:

identifying the device profile for the sending device using the at least one learned device profile.

11. The system of claim 10 , wherein the operation further comprise:

during the performance an iterative FTM burst sequence, determining from the learning model input data when a device profile is available;

when the device profile is not available, continuing the iterative FTM burst sequence and recording additional parameters; and

when the device profile is available, filtering FTM traffic in the iterative FTM burst sequence from the sending device according to the behavior filter.

12. The system of claim 8 , wherein determining the behavior filter for FTM traffic from the sending device comprises:

determining at least one expected traffic pattern for FTM traffic from the sending device based on the device profile; and

determining a variation threshold for the at least one expected traffic pattern.

13. The system of claim 12 , wherein filtering FTM traffic from the sending device according to the behavior filter further comprises:

receiving FTM traffic marked as from the sending device;

comparing traffic parameters for the FTM traffic to the at least one expected traffic pattern and the variation threshold for the sending device;

wherein when the comparison indicates the traffic parameters are outside of the variation threshold for the at least one expected traffic pattern, dropping the FTM traffic marked as from the sending device; and

wherein when the comparison indicates the traffic parameters are within the variation threshold for the at least one expected traffic pattern:

recording a plurality of parameters associated with FTM frames of the FTM traffic marked as from the sending device; and

responding to the FTM frames.

14. The system of claim 8 , wherein the operation further comprises:

detecting a responder impersonation from the FTM traffic;

interrupting the FTM traffic;

transmitting an updated burst window parameter value to the sending device; and

resuming FTM traffic according to the updated burst window parameter value.

15. A computer program product comprising:

a non-transitory computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by one or more computer processors to perform an operation comprising:

recording, at a receiving device, a plurality of parameters associated with fine timing measurement (FTM) frames exchanged between a sending device and the receiving device by:

receiving a request FTM frame from the sending device;

recording, for the request FTM frame from the sending device, a received signal strength indicator (RSSI) value, a frame timestamp, a time of departure (ToD) value, a time of arrival value (ToA), a ToD error value, a ToA error value, and a burst window parameter value; and

performing an iterative FTM burst sequence according to the burst window parameter value;

identifying, using the recorded plurality of parameters, a device profile for the sending device comprising at least one of a chipset type, an operating system (OS), and OS traffic schedule variations;

determining, using the device profile, a behavior filter for FTM traffic from the sending device; and

filtering FTM traffic from the sending device according to the behavior filter.

16. The computer program product of claim 15 ,

wherein performing an iterative FTM burst sequence according to the burst window parameter value comprises:

transmitting a responder FTM frame to the sending device;

recording a ToD value for the responder FTM frame;

receiving an acknowledgement (ACK) frame from the sending device;

recording a ToA value for the responder FTM frame at the sending device, a ToD value for the ACK frame, and a ToA value for the ACK frame at the receiving device; and

repeating the iterative FTM burst sequence according to the burst window parameter value; and

storing the recorded plurality of parameters as learning model input data.

17. The computer program product of claim 16 , further comprising:

determining using a long short-term Memory (LSTM) classifier and from the learning model input data at least one learned device profile for one of the plurality of sending devices; and

wherein identifying the device profile for the sending device further comprises:

identifying the device profile for the sending device using the at least one learned device profile.

18. The computer program product of claim 17 , wherein the operation further comprises:

during the performance an iterative FTM burst sequence, determining from the learning model input data when a device profile is available;

when the device profile is not available, continuing the iterative FTM burst sequence and recording additional parameters; and

when the device profile is available, filtering FTM traffic in the iterative FTM burst sequence from the sending device according to the behavior filter.

19. The computer program product of claim 15 , wherein determining the behavior filter for FTM traffic from the sending device comprises:

determining at least one expected traffic pattern for FTM traffic from the sending device based on the device profile; and

determining a variation threshold for the at least one expected traffic pattern.

20. The computer program product of claim 19 , wherein filtering FTM traffic from the sending device according to the behavior filter further comprises:

receiving FTM traffic marked as from the sending device;

comparing traffic parameters for the FTM traffic to the at least one expected traffic pattern and the variation threshold for the sending device;

wherein when the comparison indicates the traffic parameters are outside of the variation threshold for the at least one expected traffic pattern, dropping the FTM traffic marked as from the sending device; and

wherein when the comparison indicates the traffic parameters are within the variation threshold for the at least one expected traffic pattern:

recording a plurality of parameters associated with FTM frames of the FTM traffic marked as from the sending device; and

responding to the FTM frames.