Systems and methods for distributed P25 LMR radio vulnerability management and real-time interference monitoring
A threat monitoring and vulnerability management system is disclosed. The system includes one or more sensors configured to scan a frequency spectrum of a project 25 (P25) network and to collect data on the P25 network. The system further includes a server coupled to the sensors and configured to receive the collected data from the plurality of sensors, compare the collected data with previously stored historical data to determine whether an anomaly exists within data patterns of the collected data, responsive to determining that the anomaly exists, determine at least one of: whether use of a cloned radio that mimics an authorized connection occurs, whether jamming of a radio frequency (RF) communication occurs, or whether jamming of a voice communication occurs within the P25 network by comparing the collected data with preset thresholds, and send a real-time alert to a dispatch and control console unit coupled to the server and the P25 network in response to determining that some of the collected data exceeds at least one of the preset thresholds, such that the dispatch and control console unit provides one or more corrective actions to the P25 network.
1. A system for a project 25 (P25) network space, the system comprising:
a plurality of sensors, each sensor coupled to one or more antennas covering the P25 network space;
a plurality of processors coupled to the plurality of sensors;
a storage system to store communication data and historical data patterns within the P25 network space, wherein the storage system is coupled to the plurality of sensors and the plurality of processors;
wherein the sensors are configured to detect communication activities within the P25 network space and send communication data about the communication activities to the storage system and the plurality of processors;
wherein the plurality of processors are configured to compare the communication data with the stored historical data patterns to determine whether a security threat or a performance issue exists within the P25 network space, and provide real-time feedback of a determined security threat or a determined performance issue to a network controller, to enable the network controller to take one or more corrective actions in response to the real-time feedback.
2. The system of claim 1 , wherein the P25 network space covers an area of a digital land mobile radio (LMR) emergency communication system.
3. The system of claim 1 , wherein the storage system is configured to receive and store the communication data about the communication activities sent by the sensors.
4. The system of claim 1 , wherein the plurality of processors are further configured to update the historical data patterns based on at least one of: the communication data about the communication activities, or the determined security threat or the determined performance issue within the P25 network space.
5. The system of claim 1 , wherein the plurality of processors are further configured to determine whether data anomalies exist within the communication data based on the comparison, wherein the data anomalies exist when one or more data parameters in the communication data exceed one or more preset thresholds.
6. The system of claim 5 , wherein when the one or more data parameters exceed the one or more preset thresholds, the plurality of processors are configured to determine whether the data anomalies pose the security threat or cause the performance issue within the P25 network space, and inform the network controller of the data anomalies in response to determining that the data anomalies pose the security threat or cause the performance issue within the P25 network space.
7. The system of claim 5 , wherein the data anomalies comprise one or more of: a use of a cloned radio that mimics an authorized connection within the P25 network space, a jamming of radio frequency (RF) communication within the P25 network space, or a jamming of a voice communication within the P25 network space.
8. The system of claim 1 , wherein the plurality of processors are within a dispatch and control console sub-system (CSS) of the P25 network space or within a distributed cloud-based system associated with the P25 network space.
9. The system of claim 1 , wherein the plurality of processors are further configured to determine, from the communication data about the communication activities, a location of the security threat or a location of the performance issue within the P25 network space.
10. The system of claim 1 , wherein
the plurality of processors are further configured to extract, from the communication data, information that includes received signal strength indication (RSSI) mapping, bit error rate (BER) mapping, system degradation trends, and P25 control channel validation; and
the plurality of processors to provide the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises the plurality of processors to provide the information to the network controller.
11. The system of claim 2 , wherein the plurality of processors to provide the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises the plurality of processors to provide security and performance information of the area of the digital LMR emergency communication system.
12. A method of protecting a project 25 (P25) network space, the method comprising:
receiving, by a plurality of processors, communication data about communication activities within the P25 network space, wherein the communication activities are detected by a plurality of sensors, each sensor coupled to one or more antennas covering the P25 network space, and the communication data about the communication activities is sent to a storage system for storage;
comparing, by the plurality of processors, the communication data with historical data patterns stored in the storage system, to determine whether a security threat or a performance issue exists within the P25 network space; and
providing, by the plurality of processors, real-time feedback of a determined security threat or a determined performance issue to a network controller, to enable the network controller to take one or more corrective actions in response to the real-time feedback.
13. The method of claim 12 , wherein the plurality of processors are within a dispatch and control console sub-system (CSS) of the P25 network space or within a distributed cloud-based system associated with the P25 network space.
14. The method of claim 12 , further comprising: determining, by the plurality of processors, whether the security threat or the performance issue exists within the P25 network space, wherein determining whether the security threat or the performance issue exists within the P25 network space comprises: determining whether one or more data parameters in the communication data exceed one or more preset thresholds.
15. The method of claim 12 , wherein the provided real-time feedback includes received signal strength indication (RSSI) mapping, bit error rate (BER) mapping, system degradation trends, and P25 control channel validation.
16. The method of claim 12 , further comprising: determining, by the plurality of processors, whether data anomalies exist within the communication data based on the comparison, wherein the data anomalies exist when one or more data parameters in the communication data exceed one or more preset thresholds.
17. The method of claim 16 , further comprising: when the one or more data parameters in the communication data exceed the one or more preset thresholds, determining, by the plurality of processors, whether the data anomalies pose the security threat or cause the performance issue within the P25 network space.
18. The method of claim 17 , wherein providing the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises: informing the network controller of the data anomalies in response to determining that the data anomalies pose the security threat or cause the performance issue within the P25 network space.
19. The method of claim 12 , wherein providing the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises: providing security and performance information of an area of a digital land mobile radio (LMR) emergency communication system.
20. The method of claim 12 , further comprising: determining, by the plurality of processors from the communication data about the communication activities, a location of the security threat or a location of the performance issue within the P25 network space;
wherein the provided real-time feedback includes the location of the security threat or the location of the performance issue within the P25 network.