Network gateway spoofing detection and mitigation
US10999323B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Aug 13, 2018 |
| Grant date | May 4, 2021 |
| Priority date | — |
| Expiry date | Jun 11, 2039 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/20
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by a network gateway system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the network gateway system responsive to the determination that the received packet has a spoofed source IP address.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.