Action detection and network security policy enforcement based on wireless-transmission interference patterns
Systems of the present disclosure can detect user activities on endpoint devices based on the interference patterns those actions produce in wireless transmissions between those endpoint devices and another device (e.g., an edge device operating as a web security gateway). A web security gateway sends time-series data describing interference on wireless transmissions sent from, or received by, an agentless endpoint device to a network security service. In response, the network security service uses a machine-learning model to infer a type of an action that occurred on the agentless endpoint device concurrently with the wireless transmissions. The network security service sends an indication of the action type to the web security gateway. The web security gateway applies a network security policy to the action or a network communication associated therewith.
1. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a physical processor of at least one computing device, cause the computing device to perform a method for a network security service to assist a web security gateway to enforce a network security policy, the method comprising:
collecting, at the web security gateway, time-series data describing interference patterns in a series of wireless transmissions sent between the web security gateway and an endpoint device, wherein the wireless transmissions occurred at least partially concurrently with an action performed upon a user interface at the endpoint device and the time-series data comprises at least one of channel state information (CSI) values, received signal strength (RSS) values, or Doppler shift values;
sending the time-series data to a remotely executed network security service via a network;
receiving, from the remotely executed network security service in response to the sending, an action type of the action, the action type indicating at least one of a scrolling action, a pressing action, and a clicking action;
comparing the action type to the network security policy; and
blocking a network communication associated with the action based on the comparison.
2. The medium of claim 1 , wherein the method further comprises:
identifying an Internet Protocol (IP) address to which the network communication associated with the action is directed; and
sending an indication of the IP address to the network security service before receiving the action type.
3. The medium of claim 1 , wherein the method further comprises:
identifying a device type of the endpoint device; and
sending an indication of the device type to the network security service before receiving the action type.
4. The medium of claim 1 , wherein the time-series data comprises the channel state information values of at least one channel for the wireless transmissions.
5. The medium of claim 1 , wherein the wireless transmissions comprise Internet Control Message Protocol (ICMP) ping packets sent between the web security gateway and the endpoint device.
6. The medium of claim 5 , wherein the method further comprises setting a ping frequency for the ICMP ping packets to at least 2,500 packets per second.
7. The medium of claim 1 , wherein the method further comprises:
determining a user identifier associated with a current web session at the endpoint device; and
sending an indication of the user identifier to the network security service before receiving the action type.
8. A method for a web security gateway to enforce a network security policy, the method comprising:
collecting, at the web security gateway, time-series data describing interference patterns in a series of wireless transmissions sent between the web security gateway and an endpoint device, wherein the wireless transmissions occurred at least partially concurrently with an action performed upon a user interface at the endpoint device and the time-series data comprises at least one of channel state information (CSI) values, received signal strength (RSS) values, or Doppler shift values;
sending the time-series data to a remotely executed network security service via a network;
receiving, from the remotely executed network security service in response to the sending, an action type of the action, the action type indicating at least one of a scrolling action, a pressing action, and a clicking action;
comparing the action type to the network security policy; and
blocking a network communication associated with the action based at least in part on the comparison.
9. The method of claim 8 , further comprising:
identifying an Internet Protocol (IP) address to which the network communication associated with the action is directed; and
sending an indication of the IP address to the network security service before receiving the action type.
10. The method of claim 8 , further comprising:
identifying a device type of the endpoint device; and
sending an indication of the device type to the network security service before receiving the action type.
11. The method of claim 8 , wherein the time-series data comprises the channel state information values of at least one channel for the wireless transmissions.
12. The method of claim 8 , wherein the wireless transmissions comprise Internet Control Message Protocol (ICMP) ping packets sent between the web security gateway and the endpoint device.
13. The method of claim 12 , further comprising:
setting a ping frequency for the ICMP ping packets to at least 2,500 packets per second.
14. The method of claim 8 , further comprising:
determining a user identifier associated with a current web session at the endpoint device; and
sending an indication of the user identifier to the network security service before receiving the action type.
15. A system comprising:
one or more processors; and
a non-transitory memory storing one or more instructions that, when executed on the one or more processors, perform an operation, the operation comprising:
collecting, at a web security gateway that enforces a network security policy, time-series data describing interference patterns in a series of wireless transmissions sent between the web security gateway and an endpoint device, wherein the wireless transmissions occurred at least partially concurrently with an action performed upon a user interface at the endpoint device and the time-series data comprises at least one of channel state information (CSI) values, received signal strength (RSS) values, or Doppler shift values;
sending the time-series data to a remotely executed network security service via a network;
receiving, from the remotely executed network security service in response to the sending, an action type of the action, the action type indicating at least one of a scrolling action, a pressing action, and a clicking action;
comparing the action type to the network security policy; and
blocking a network communication associated with the action based at least in part on the comparison.
16. The system of claim 15 , wherein the operation further comprises:
identifying an Internet Protocol (IP) address to which the network communication associated with the action is directed; and
sending an indication of the IP address to the network security service before receiving the action type.
17. The system of claim 15 , wherein the operation further comprises:
identifying a device type of the endpoint device; and
sending an indication of the device type to the network security service before receiving the action type.
18. The system of claim 15 , wherein the time-series data comprises the channel state information values of at least one channel for the wireless transmissions.
19. The system of claim 15 , wherein the wireless transmissions comprise Internet Control Message Protocol (ICMP) ping packets sent between the web security gateway and the endpoint device.
20. The system of claim 19 , further comprising:
setting a ping frequency for the ICMP ping packets to at least 2,500 packets per second.