System anomaly detection using signal fingerprinting

Abstract

Systems, methods, and devices for detecting anomalies within a system based on signal fingerprints are described herein. A plurality of electrical signals are simultaneously received from a transceiver over a time period. The time period is divided into a plurality of sampling windows. Electrical signals of the plurality of electrical signals are sequentially selected. For a sequentially selected electrical signal, a temporal snapshot of the electrical signal is iteratively captured over a sampling window of the plurality of sampling windows. This iterative capturing is repeated for remaining sampling windows of the plurality of sampling windows. Each captured temporal snapshot over the time period is temporally concatenated according to its respective temporal position in the time period to generate a signal fingerprint.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Application No. 16 / 399,812, filed April 30, 2019, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] The subject matter described herein relates to enhanced techniques for signal fingerprinting to detect anomalies within a system. Background Art

[0004] As connectivity and computing power increase, the storage and transmission of electronic data is also increasing. This storage and transmission may be subject to malicious attacks. Protecting against malicious attacks can increase consumer confidence in the storage and transmission of electronic data while providing a means to preserve stored and transmitted data. Summary of the Invention

[0005] This document describes systems, methods, and devices for detecting anomalies within a system based on signal fingerprinting. In one aspect, multiple electrical signals are received simultaneously from a transceiver within a time period. The time period is divided into multiple sampling windows. An electrical signal from the multiple electrical signals is sequentially selected. For the sequentially selected electrical signal, a time snapshot of the electrical signal is iteratively captured within a sampling window in the multiple sampling windows. This iterative capture is repeated for the remaining sampling windows in the multiple sampling windows. Each captured time snapshot within the time period is temporally connected according to its corresponding time position in the time period to generate a signal fingerprint. The transceiver can be a 10 Mbit Ethernet transceiver, a 100 Mbit Ethernet transceiver, or a 1 Gigabit Ethernet transceiver.

[0006] In some variations, a signal difference between the real-time fingerprint and a predetermined fingerprint of the transceiver can be determined. The signal difference can be compared to a predetermined error threshold. When the signal difference is outside the predetermined error threshold, an anomaly in the system including the transceiver can be determined.

[0007] In other variations, the anomaly may be corrected by alerting the system user via a message displayed via a graphical user interface.

[0008] In some variations, the anomaly can be corrected by implementing a firewall rule that prevents the transceiver from further communicating with the system. The firewall rule can prohibit the transceiver from communicating with components of the system.

[0009] In other variations, the anomaly may be corrected by disabling one or more interfaces to the transceiver to inhibit communication between the transceiver and system components.

[0010] In some variations, the signal fingerprint characterizes a component of a system electrically coupled to the transceiver, the component comprising at least one of a data cable coupled to the transceiver, one or more data processors coupled to the transceiver, or one or more electrical cables.

[0011] In other variations, the plurality of electrical signals includes a plurality of voltage signals.

[0012] In another aspect, a system includes a transceiver, a fingerprint module, and a memory device. The transceiver is configured to receive data from a communication bus and generate a plurality of electrical signals representing the data. The fingerprint module is coupled to the transceiver. The fingerprint module is configured to receive the plurality of electrical signals and generate a real-time fingerprint of a component coupled to the communication bus. The memory device is coupled to the fingerprint module. The memory device is configured to store a baseline fingerprint of the component coupled to the communication bus for comparison with the real-time fingerprint.

[0013] In some variations, the fingerprint module generates the real-time fingerprint by simultaneously receiving multiple electrical signals from a transceiver within a time period. The time period is divided into a plurality of sampling windows. Electrical signals from the plurality of electrical signals are sequentially selected. Time snapshots of the electrical signals are iteratively captured within a sampling window in the plurality of sampling windows. The iterative capture is repeated for the remaining sampling windows in the plurality of sampling windows. Each captured time snapshot within the time period is temporally concatenated according to its corresponding time position within the time period to generate the real-time fingerprint.

[0014] In other variations, the system may further include a controller including a memory device and a controller interface coupled between the controller and the transceiver. The controller interface may be configured to facilitate data transmission between the transceiver and the controller in a compatible data format.

[0015] In some variations, the fingerprint module includes a switch, a track and hold component, a converter, a sequencer, and a serial peripheral interface. The switch can be coupled to the transceiver and configured to receive multiple electrical signals and select one of the multiple electrical signals. The track and hold component can be coupled to the switch. The track and hold component can be configured to receive the selected electrical signal and pause the selected electrical signal in a timely manner. The converter can be coupled to the track and hold component and the sequencer. The converter can be configured to sample the selected electrical signal. A serial peripheral interface (SPI) can be coupled to the sequencer and the converter, and the SPI can be configured to transmit the sampled electrical signal. The sequencer can be coupled to the transceiver, the track and hold component, and the switch. The sequencer can be configured to trigger the track and hold component and the converter to each operate at a moment in time.

[0016] In other variations, the transceiver is at least one of a 10 Megabit (Mb) Ethernet transceiver, a 100 Mb Ethernet transceiver, or a 1 Gigabit (Gb) Ethernet transceiver.

[0017] In yet another aspect, a system may include a communication bus, a first anomaly detection system, and a second anomaly detection system. The communication bus is configured to transmit data. The first anomaly detection system is coupled to the communication bus and configured to provide data to the communication bus. The second anomaly detection system is also coupled to the communication bus. The second anomaly detection system is configured to monitor the first anomaly detection system by generating a real-time fingerprint of the first anomaly detection system.

[0018] In some variations, the second anomaly detection system may generate a real-time fingerprint by simultaneously receiving multiple electrical signals from a transceiver within a time period. The time period may be divided into multiple sampling windows. Electrical signals from the multiple electrical signals may be sequentially selected. Time snapshots of the electrical signals may be iteratively captured within a sampling window within the multiple sampling windows. The iterative capture may be repeated for the remaining sampling windows within the multiple sampling windows. Each captured time snapshot within the time period may be temporally concatenated based on its corresponding time position within the time period to generate a real-time fingerprint.

[0019] In other variations, the transceiver is at least one of a 10 Megabit (Mb) Ethernet transceiver, a 100 Mb Ethernet transceiver, or a 1 Gigabit (Gb) Ethernet transceiver.

[0020] In some variations, the second anomaly detection system includes a transceiver, a fingerprint module, and a memory device. The transceiver may be configured to receive data from a communication bus and generate a plurality of electrical signals representing the data. The fingerprint module may be coupled to the transceiver. The fingerprint module may be configured to receive the plurality of electrical signals and generate a real-time fingerprint of a component coupled to the communication bus. The memory device may be coupled to the fingerprint module. The memory device may be configured to store a baseline fingerprint of the component coupled to the communication bus for comparison with the real-time fingerprint.

[0021] In other variations, the fingerprint module includes a switch, a track-and-hold component, a converter, a sequencer, and a serial peripheral interface. The switch can be coupled to the transceiver. The switch can be configured to receive multiple electrical signals and select one of the multiple electrical signals. The track-and-hold component can be coupled to the switch. The track-and-hold component can be configured to receive the selected electrical signal and pause the selected electrical signal in time. The converter can be coupled to the track-and-hold component and the sequencer. The converter can be configured to sample the selected electrical signal. The serial peripheral interface can be coupled to the sequencer and the converter. The serial peripheral interface can be configured to transmit the sampled electrical signal. The sequencer can be coupled to the transceiver, the track-and-hold component, and the switch. The sequencer can be configured to trigger the track-and-hold component and the converter to each operate at an appropriate moment.

[0022] The subject matter described herein provides numerous technical advantages. For example, the present subject matter provides for the detection of abnormal electrical characteristics (such as voltage characteristics) of a transceiver assembly. As described in detail herein, upon detection of an abnormal characteristic, data transmission can be terminated or secured to and / or from the transceiver assembly. Detecting anomalies in transceiver operation can prevent and / or correct potential malicious data attacks. Furthermore, use of the present subject matter can protect data stored within a system having a transceiver assembly and / or prevent data transmission within the system.

[0023] The details of one or more variations of the subject matter described herein are set forth in the accompanying drawings and the description below.Other features and advantages of the subject matter described herein will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is an anomaly detection system diagram illustrating an example logical system architecture for signal fingerprinting;

[0025] Figure 2 It shows Figure 1 An integrated operating system diagram of multiple anomaly detection systems;

[0026] Figure 3 is a system diagram illustrating another example logical system architecture for signal fingerprinting of a 1 Gb transceiver;

[0027] Figure 4 is a system diagram illustrating another example logical system architecture for signal fingerprinting of a 100Mb transceiver;

[0028] Figure 5 is a series of random time point sampling curves used to generate the sample waveform fingerprint;

[0029] Figure 6 is a flow chart of an example process for generating a signal fingerprint;

[0030] Figure 7A is a graph illustrating an example real-time signal fingerprint with no deviation from a baseline fingerprint; and

[0031] Figure 7B is a graph illustrating an example real-time signal fingerprint that is offset from a baseline fingerprint.

[0032] The same reference symbols in different drawings denote the same elements. DETAILED DESCRIPTION

[0033] The current subject matter relates to technology for protecting transceivers and / or communication devices and networks from alteration or malicious modification via a hardware and software platform connected to one or more transceivers. The hardware module can be connected to or embedded in a transceiver device, such as an Ethernet or automotive transceiver, to enable centralized communications and security posture assessment. Such a platform can provide defense capabilities such as communication encryption, attack detection and prevention, transceiver fingerprinting and authentication, message modification prevention, message activity logging, and a next-generation firewall. The platform can also provide awareness of attacks or compromises, control communications from affected transceivers to the network, and protect against compromised transceivers on the network. In addition, the security platform can be used to monitor the integrity and malicious modifications of human-machine interfaces and third-party firmware within systems with transceivers, reporting them to users or external security personnel.

[0034] Figure 1 FIG1 is an anomaly detection system diagram 100 illustrating an example logical system architecture for signal fingerprinting. According to some variations, the anomaly detection system 100 may include a controller 110, a fingerprint module 120, a transceiver 130, a controller interface 140, and a plurality of other system components 150. The transceiver 130 may transmit and / or receive data. The data may be sent to a communication bus such as a wireless communication bus via a wired connection (e.g., an Ethernet connection). Figure 2 As shown. The transceiver 130 can be any component having the ability to transmit and / or receive data. For example, according to some aspects and as Figure 3-Figure 4 As described in more detail in , the transceiver 130 may be a 10 megabit (Mb) transceiver, a 100 Mb transceiver, or a 1 gigabit (Gb) transceiver, based on the system architecture of the anomaly detection system 100. The anomaly detection system 100 may further include one or more system components 150, such as, but not limited to, a media independent interface (MII) register, an auto-negotiation strategy (such as an auto-negotiation strategy for managing different line rates, chip or board-level test systems), a clock management component, and / or a phase-locked loop (PLL) controller.

[0035] Data received and / or transmitted by transceiver 130 may be sent to and / or from controller 110 via controller interface 140. Controller interface 140 may be configured to facilitate data transmission between transceiver 130 and controller 110 in a data format compatible with both transceiver 130 and controller 110. Data received by transceiver 130 may be encoded in the physical layer. To interface with controller 110, such data may be encoded by controller interface 140 so that it can be transmitted within a data link layer, such as a media access control (MAC) layer and / or a logical link control (LLC) layer. Controller interface 140 may be, for example, a reduced media independent interface (RMII), a gigabit media independent interface (GMII), a reduced gigabit media independent interface (RGMII), a 10-gigabit media independent interface (xGMII), MII, a serial gigabit media independent interface (SGMII), or any media independent interface (xMII).

[0036] Figure 2 An operating system 200 including two or more anomaly detection systems 100A, 100B is shown. For example, each anomaly detection system 100A, 100B may have Figure 1 and / or Figure 3-Figure 4 The structure shown. Operating system 200 may include at least two anomaly detection systems coupled together via jack 210, wall plate 220, wall plate 230, and jack 240. Wall plates 220, 230 may be coupled together via an Ethernet connection capable of sending and / or receiving data. A patch cord may couple the wall plates to the corresponding jacks. For example, a patch cord may couple wall plate 220 to jack 210. Similarly, a patch cord may couple wall plate 230 and jack 240 together. One anomaly detection system (e.g., one of 100A and 100B) may detect modifications to the transmitting-side transceiver / unit of another anomaly detection system. For example, anomaly detection system 100A may detect an anomaly in anomaly detection system 100B. In this example, anomaly detection system 100A knows the expected signal fingerprint of anomaly detection system 100B. In other words, anomaly detection system 100A determines a baseline signal fingerprint. In addition, the anomaly detection system 100A generates and monitors a real-time fingerprint of the anomaly detection system 100B to identify any deviations from the baseline signal fingerprint of the anomaly detection system 100B. At least two anomaly detection systems provide the functionality of detecting anomalies in the operating system 200. Having three or more anomaly detection systems can provide a degree of integrity against malicious data attacks or corruption. Figure 1 In some variations, the fingerprint module 120 may be a hardware module electrically coupled to the transceiver 130, such as Figure 3-Figure 4Modifications to aspects of one of the anomaly detection systems 100A, 100B of which the transceiver 130 is not a part can be detected by the fingerprint module 120 monitoring the other anomaly detection system 100A, 100B. The fingerprint module 120 can operate in at least two operating modes: an imprint mode and a monitoring mode. For illustrative purposes, Figure 1 An example of anomaly detection system 100 is considered Figure 2 Anomaly detection system 100A. During imprint mode, fingerprint module 120 can capture operational electrical signal characteristics, such as voltage characteristics, of the transceivers of anomaly detection system 100B. Fingerprint module 120 can generate a baseline fingerprint for anomaly detection system 100B. The baseline fingerprint is stored in memory for later use (e.g., in memory 115). The baseline fingerprint can take into account operational signals and various system interferences or influences, such as various cable lengths of cables (e.g., data cables coupling system components within anomaly detection system 100B). The baseline signal fingerprint can also take into account electrical component tolerances of one or more electrical components within anomaly detection system 100B. During monitoring mode, fingerprint module 120 of anomaly detection system 100A can monitor the operational signals of the transceivers in anomaly detection system 100B and generate a real-time fingerprint of the transceivers of anomaly detection system 100B. The generated real-time fingerprint can be compared to a baseline fingerprint (e.g., a predetermined fingerprint) to identify differentials within the fingerprint signal, such as voltage differences. These differentials can be evaluated against an error threshold. For example, a user can establish an error threshold to define how much signal difference is acceptable within anomaly detection system 100B. For example, if there is a difference between the baseline fingerprint and the real-time fingerprint that exceeds an error threshold (e.g., a predetermined error threshold), an anomaly can be identified. Although anomaly detection system 100A is described by way of example, it should be understood that anomaly detection system 100B can operate in a similar manner to generate a baseline signal fingerprint and monitor the real-time fingerprint of anomaly detection system 100A.

[0037] Figure 33 is a system diagram 300 illustrating another example logical system architecture for signal fingerprinting of a 1Gb transceiver. The transceiver 130 may be a 1Gb transceiver, such as transceiver 330. The transceiver 330 may include a timing recovery component 331, a five-level pulse amplitude modulation (PAM-5) decoder 332, a PAM-5 encoder 333, a trellis decoder 334, a crosstalk (Xtalk) component 335, an echo cancellation component 336, an analog-to-digital converter (ADC) 337, a transmit component (TxEQ) 338, a digital-to-analog converter (DAC) and variable gain amplifier (VGA) component 339, a receiver component (RxEQ) 341, and a hybrid component 342. In one embodiment, an Ethernet cable may be coupled to the hybrid component 342 and transmit data, such as an Ethernet cable having four pairs of ADs. Hybrid component 342 enables the transmission and reception of data or signals transmitted along the Ethernet cable (e.g., TxRxA-TxRxD) simultaneously in each direction on each cable pair. The recovered receive signal sent to ADC 337 can be the difference between the signal on the Ethernet cable and the signal transmitted by DAC and VGA component 339. The recovered receive signal generated by hybrid component 342 can be sampled by ADC 337 to capture the waveform associated with the Ethernet data. The captured waveform generated by ADC 337 can be provided to a multi-tap digital filter (e.g., receiver component Rx EQ 341) to compensate for cable conditions such as length or transmission loss. Receiver component Rx EQ 341 can generate a filtered signal. The filtered signal can be provided to summation component 343 along with the signals generated by crosstalk component 335 and echo component 336. Summation component 343 can cancel or remove the portion of the filtered signal that contains aspects of crosstalk or echo that were not removed by hybrid component 342. The trellis decoder 334 recovers coded information that may have been corrupted during data transmission along one or more data cables (such as Ethernet cables). The trellis decoder 334 can generate a synchronous data stream (e.g., a PAM-5 symbol stream) to the timing recovery component 331 and the PAM-5 decoder 332. The timing recovery component 331 can use the synchronous data stream to recover a clock that matches the remote transmit clock. Timing recovery can be accomplished in several ways, but generally involves finding transition points in the signal that are located on certain boundaries between one legal value and another legal value. These transitions should occur between one clock and the other. The recovery subsystem measures the time offset between the actual transition point and the location where the transition point should be. Using a proportional-integral-derivative (PID) loop, the local clock can be incrementally adjusted until the local clock frequency and phase are locked to the signal received from the remote transmit transceiver.This clock signal can be fed forward into ADC 337 to align clocks within sequencer 325 and timing recovery component 331. The synchronized data stream can be decoded back into the original data stream using PAM-5 decoder 332 and provided to xMII interface 340. xMII interface 340 ensures that the data output from transceiver 330 is compatible with controller 110.

[0038] The transceiver 330 may also receive data from the controller 110 via the xMII interface 340. The xMII interface 340 may ensure that the data provided to the transceiver 330 is compatible with the transceiver 330. The data received from the xMII interface 340 may be encoded into a PAM-5 symbol stream using a PAM-5 encoder 333. The transmitted symbols may be transformed to compensate for expected crosstalk between the data transmission cables within the hybrid component 342 (e.g., the four Ethernet cable pairs TxRxA-TxRxD) and the Ethernet jack and the cables themselves. The transmitted symbols may also be transformed to compensate for expected echoes returning from the far end of the cables and fed to the summing component 343. The transmitted symbols may also be provided to a multi-tap digital filter (e.g., the transmitter component Tx EQ 338) to compensate for cable conditions.

[0039] The fingerprint module 120 can monitor the operation of other transceivers (such as Figure 2 ) to detect any anomaly outside the system 100, such as any anomaly within the transceiver 330 of the external system 100 or other components coupled to the transceiver 330 of the external system 100. The fingerprint module 120 may include a serial peripheral interface (SPI) register 321, a low-speed ADC 322, a track and hold component 323 (such as an amplifier), a selector switch 324, a sequencer component 325, and a symbol first-in-first-out (FIFO) component 327. Figure 2 In the example shown, each of the eight signals (e.g., 4 Rx and 4 Tx in TxRxA-TxRxD) from the hybrid component 342 can be provided to the selector switch 324. The selector switch 324 can route each signal one at a time to the track and hold component 323. In some variations, the selector switch 324 can be an 8:1 selector switch or a 1:1 selector switch. Figure 42:1 selector switch shown. Alternatively, selector switch 324 can be any selector switch that facilitates input of data from transceiver 130 to fingerprint module 120. Selector switch 324 can be enabled with extremely high bandwidth (e.g., greater than 10 GHz). Track and hold component 323 receives one signal from selector switch 324 at a time. Track and hold component 323 pauses the signal at a specific point in time. Pausing and dividing the signal into the smallest possible units can determine the upper limit of the detail that fingerprint module 120 can capture. The selector switch input bandwidth matches the bandwidth of track and hold component 323 and can be set to a level sufficient to capture any signal nuances (e.g., expected normal operation in the 10 GHz range). In some variations, multiple track and hold components 323 can be placed sequentially between selector switch 324 and low-speed ADC 322 to achieve a faster signal tracking window. The pause signal (or hold signal) from track and hold component 323 can be provided to low-speed ADC 322 for sampling. The low-speed ADC may have a relatively low sampling rate (e.g., 1 Msps compared to 125-250 Msps) compared to the sampling rate of ADC 337. The low-speed ADC 322 may have a high resolution (e.g., equal to or greater than 12 bits) to ensure that the signal is sampled with high fidelity.

[0040] The converted samples can be added to registers in the SPI interface 321, and then the controller 110 can shift them out via the SPI interface. Raw PAM-5 symbols from the transceiver 330, either via the input of the PAM-5 decoder 332 or the output of the PAM-5 encoder 333, can be provided to the symbol FIFO component 327. These PAM-5 symbols can be captured at a time that matches the time at which the track-and-hold component 323 captures the signal. The symbol FIFO 327 can be used to buffer the raw PAM-5 symbols from the transceiver 330. The sequencer 325 can trigger each of the other components of the fingerprint module 120 (e.g., the track-and-hold component 323, the selector switch 324, the low-speed ADC 322, and the symbol FIFO component 327) to operate at precisely the right moment. To achieve a high effective sampling rate, the track-and-hold component 323 can be triggered at a very specific point, which is a controllable fraction (phase) of the recovered clock. The fine delay component 326 of the sequencer 325 determines the effective statistical sampling rate of the system 300 by delaying the recovered clock from the timing recovery 331 by a fraction of the nominal clock rate. For example, if the delay can achieve approximately 256 taps (e.g., a fraction) on the 125 MHz recovered clock from the timing recovery component 331, an effective sampling rate of approximately 32 GHz per second can be achieved for the sequencer 325. In this example, a signal of approximately 10 GHz can be captured from the track and hold component 323.

[0041] Figure 4 4 is a system diagram illustrating another example logical system architecture 400 for signal fingerprinting of a 100Mb transceiver. In this example, the transceiver 130 may be a 100Mb transceiver 430. The transceiver 430 may include amplifiers 431 and 432, a receive component Rx EQ 441, modulators 433 and 434, descramblers 435 and 436, a 4B5B decoder 437, and a 4B5B encoder 438. The modulators 433, 434 may be data modulators such as non-return to zero inversion (NRZI) and multi-level transmission (MLT-3). The transceiver 430 may interface with the controller 110 via an MII interface 440. Similar to Figure 31Gb transceiver 330, transceiver 432 can be coupled to transceiver 430. In this example, transceiver 430 receives data input signals and passes them through amplifier 431. The output of amplifier 431 and the input of amplifier 432 can be provided to selector switch 324 (e.g., a 2:1 switch in the example of 100Mb transceiver 430). Similarly, data in the form of 4B5B encoded data (e.g., 5-bit data mapped from a 4-bit input) can be provided to symbol FIFO component 327. Note that fingerprint module 120 operates in a similar manner regardless of the transceiver 130 to which it is coupled. Selector switch 324 is a modifiable switch that can depend on the type of transceiver within a given system (e.g., 10Mb transceiver, 100Mb transceiver, 1Gb transceiver).

[0042] Figure 5 is a graph of a series of random time point samples used to generate the example waveform fingerprint 500. The x-axis of the graph showing the signal fingerprint 500 can be expressed in units of time. The y-axis of the graph showing the signal fingerprint 500 can be the unit of signal measurement, in this example, voltage. The signal fingerprint 500 can be generated using Figure 2-Figure 3 The fingerprint module 120 described in the above is used to generate the fingerprint. Figure 4 It is not explicitly described, but the following algorithm can be applied to any number of signal inputs to generate a signal fingerprint.

[0043] As previously in Figure 3 As described in , the selector switch 324 controls the transmission of one signal from the transceiver 330. Each signal transmitted from the mixing component 342 can be sequentially selected by the selector switch 324. For each such signal, a time snapshot (e.g., the instantaneous voltage component of the waveform at a specific point in time) can be captured by the track and hold component 323 in conjunction with the low-speed ADC 322, generating multiple time snapshots of the signal. The sequencer 325 can be configured via the SPI register 321 to associate a snapshot of a given signal level transition (e.g., at Figure 5 , the y-axis has a gradient of signal levels 1 to 5, and the captured transition is from level 2 to level 5. Sequencer 325 or one of controllers 110 can create a delay (according to fine delay 326) for each possible signal transition (1→2, 1→3, 1→4, 1→5, 2→1, 2→3, 2→4, 2→5, 3→1, etc.) for each of the input signals Rx and Tx (A, B, C, and D). Multiple time samples for each time delay (e.g., 256 steps according to fine delay 326) produce a complete average waveform for each combination. The multiple waveforms for all combinations of signals (A, B, C, D) and transitions are combined to form a fingerprint. The combined fingerprint can be a baseline fingerprint or a real-time fingerprint used to determine potential abnormal system activity.

[0044] Figure 6 6 is an example process flow diagram 600 for generating a signal fingerprint, such as an Ethernet fingerprint. At 610, the selector switch 324 can simultaneously receive multiple electrical signals from the transceiver 330 within a time period. The time period can be divided into multiple sampling windows (e.g., t1, t2, t3, t4, t5, t6, t7, t8, t9, t10). At 620, the selector switch 324 can sequentially select one of the multiple electrical signals, one at a time, to provide to the track and hold component 323 (e.g., an amplifier). At 630, the track and hold component 323 can iteratively capture a time snapshot of the electrical signal over a sampling window for each sequentially selected electrical signal. At 640, the iterative capture can be repeated for each sampling window within the time period, over the entire time period (e.g., for all sampling windows t1, t2, t3, t4, t5, t6, t7, t8, t9, t10). At 650 , a signal fingerprint 500 of the transceiver 330 , 430 may be generated by temporally concatenating each time snapshot captured within the time period according to its corresponding time position within the time period.

[0045] During the imprinting mode, the fingerprint module 120 can generate a baseline fingerprint of the transmitting node on the bus of the system 100. During the monitoring mode, the fingerprint module 120 can monitor the operation of the transceiver 330, 430 by generating a real-time fingerprint of the transceiver 330, 430, such as Figure 4-Figure 5 As shown. The fingerprint module 120 can identify a signal difference between a real-time fingerprint generated during monitoring and a predetermined fingerprint (such as a baseline fingerprint generated during imprint mode). In some variations, the signal difference can be compared to an error threshold configured within the fingerprint module 120. If the signal difference is outside the error threshold, an anomaly in the system (e.g., system 300, 400) can be identified. The anomaly can be corrected in a variety of different ways, such as, but not limited to, alerting a user of the system through a graphical user interface, implementing a firewall rule that blocks the transceiver 330, 430 from allowing the system to continue operating, and / or disabling one or more interfaces of the transceiver 330, 430. In some variations, the firewall rule can be applied to the selector switch 324.

[0046] Figure 7A is a graph 700 showing an example real-time signal fingerprint that has no deviation from the baseline fingerprint. For example, curve 702 represents the baseline signal fingerprint generated during the imprint mode. Curve 704 represents the real-time signal fingerprint generated using Figure 6 The error or deviation range 706 defines the acceptable range within which the real-time signal fingerprint is generated using the method described in Figure 6The real-time signal fingerprint (e.g., curve 704) generated by the method described in can deviate from the baseline or expected signal fingerprint (e.g., curve 702). Figure 7A As shown, there is minimal or no signal difference between the baseline signal fingerprint (eg, curve 702) and the real-time signal fingerprint (eg, curve 704). As a result, the monitored system causing curve 700 may not contain an anomaly.

[0047] Figure 7B 7 is a graph 750 showing example real-time signal fingerprints that are offset from a baseline fingerprint. For example, curve 752 represents a baseline signal fingerprint generated during an imprinting mode. Curve 754 represents a real-time signal fingerprint generated during a monitoring mode. Figure 7B As shown, there is a signal difference 756 between the real-time signal fingerprint and the baseline signal fingerprint. If the difference is outside the system-defined error threshold window, the fingerprint module 120 can identify an anomaly in the system. The fingerprint module 120 can communicate the anomaly to the controller 110. The controller 110 can then correct the anomaly in various ways, such as alerting the user of the system via a graphical user interface, implementing firewall rules that prevent further operation of the transceiver with the system, or disabling one or more interfaces of the transceiver.

[0048] One or more aspects or features of the subject matter described herein can be implemented in digital electronic circuits, integrated circuits, specially designed application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) computer hardware, firmware, software, and / or combinations thereof. These different aspects or features can be implemented in one or more computer programs executable and / or interpretable on a programmable system comprising at least one programmable processor, the programmable processor being either dedicated or general purpose, coupled to receive data and instructions from a storage system, at least one input device, and at least one output device, and to send data and instructions to the storage system, at least one input device, and at least one output device. A programmable system or computing system can include a client and a server. The client and server are typically remote from each other and typically interact via a communication network. The relationship between the client and the server is generated by computer programs running on respective computers and having a client-server relationship with each other.

[0049] These computer programs (which may also be referred to as programs, software, software applications, applications, components or codes) include machine instructions for a programmable processor and may be implemented in high-level procedural languages, object-oriented programming languages, functional programming languages, logic programming languages ​​and / or assembly / machine languages. As used herein, the term "computer-readable medium" refers to any computer program product, apparatus and / or device for providing machine instructions and / or data to a programmable processor, such as a disk, an optical disk, a memory and a programmable logic device, including a computer-readable medium that receives machine instructions as a computer-readable signal. The term "computer-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor. A computer-readable medium may store such machine instructions non-temporarily, such as a non-temporary solid-state memory or a magnetic hard drive or any equivalent storage medium. A computer-readable medium may alternatively or additionally store such machine instructions in a transient manner, such as a processor cache or other random access memory associated with one or more physical processor cores.

[0050] In the above description and in the claims, phrases such as "at least one of..." or "one or more of..." may appear after a connected list of elements or features. The term "and / or" may also appear in a list of two or more elements or features. Unless otherwise implicitly or explicitly contradicted by the context in which it is used, such a phrase is intended to represent any one of the elements or features listed individually, or a combination of any one of the listed elements or features with any one of the other listed elements or features. For example, the phrases "at least one of A and B," "one or more of A and B," and "A and / or B" are each intended to represent "only A, only B, or A and B together." A similar interpretation applies to lists that include three or more items. For example, the phrases "at least one of A, B, and C," "one or more of A, B, and C," and "A, B, and / or C" are each intended to represent "only A, only B, only C, A and B together, A and C together, B and C together, or A and B and C together." Furthermore, the term "based on" as used above and in the claims is intended to mean "based at least in part on" such that unrecited features or elements are also permissible.

[0051] Depending on the desired configuration, the subject matter described herein may be embodied in systems, devices, methods and / or articles. The implementations set forth in the foregoing description do not represent all implementations consistent with the subject matter described herein. Instead, they are merely some examples consistent with aspects related to the described subject matter. Although some variations have been described in detail above, other modifications or additions are possible. In particular, in addition to the features and / or variations set forth herein, other features and / or variations may also be provided. For example, the implementations described above may be directed to various combinations and subcombinations of the disclosed features and / or combinations and subcombinations of several other features disclosed above. In addition, the logic flows depicted in the accompanying drawings and / or described herein do not necessarily require the specific order shown or the order of the sequence to achieve the desired results. Other implementations may also be within the scope of the following claims.

Claims

1. A method for implementation by one or more data processors forming one or more computing devices, the method comprising: receiving, by a switch coupled to the transceiver, a plurality of electrical signals simultaneously from the transceiver over a time period, wherein the time period is divided into a plurality of sampling windows; sequentially selecting an electrical signal from the plurality of electrical signals; For the sequentially selected electrical signals, iteratively capturing time snapshots of the electrical signals within a sampling window in the plurality of sampling windows, comprising: receiving, by a track and hold component coupled to the switch, the selected electrical signal and pausing the selected electrical signal in a timely manner; sampling the selected electrical signal by a converter coupled to the track and hold component and the sequencer; triggering each of the track and hold component and the converter to operate at an appropriate moment by the sequencer, the sequencer being coupled to the transceiver, the track and hold component, and the switch; Repeating the iterative capturing for remaining sampling windows in the plurality of sampling windows; and Each captured time snapshot within the time period is temporally concatenated according to its corresponding time position in the time period to generate a real-time fingerprint.

2. The method according to claim 1, further comprising: A signal difference between the real-time fingerprint and a predetermined fingerprint of the transceiver is identified by at least one data processor.

3. The method according to claim 2, further comprising: comparing, by at least one data processor, the signal difference to a predetermined error threshold; as well as When the signal difference is outside the predetermined error threshold, an anomaly in a system including the transceiver is identified by at least one data processor. 4 . The method of claim 3 , further comprising correcting, by at least one data processor, the anomaly by alerting a user of the system via a message displayed on a graphical user interface.

5. The method of claim 3 or 4, further comprising correcting, by at least one data processor, the anomaly by implementing a firewall rule that prevents the transceiver from further communicating with the system. The method of claim 5 , wherein the firewall rules prohibit communication by the transceiver with components of the system.

7. The method of claim 3 or 4, further comprising correcting, by at least one data processor, the anomaly by disabling one or more interfaces to the transceiver to inhibit communication between the transceiver and components of the system.

8. The method of claim 3 or 4, wherein the real-time fingerprint characterizes a component of the system electrically coupled to the transceiver, the component comprising at least one of a data cable coupled to the transceiver, one or more data processors coupled to the transceiver, or one or more electrical cables.

9. A system comprising: a transceiver configured to receive data from the communication bus and generate a plurality of electrical signals representing the data; a fingerprint module coupled to the transceiver, the fingerprint module configured to receive the plurality of electrical signals and generate a real-time fingerprint of a component coupled to the communication bus; as well as a memory device coupled to the fingerprint module, the memory device configured to store a baseline fingerprint of the component coupled to the communication bus for comparison with the real-time fingerprint, The fingerprint module includes: a switch coupled to the transceiver, the switch configured to receive the plurality of electrical signals and select one of the plurality of electrical signals; a track and hold component coupled to the switch, the track and hold component configured to receive the selected electrical signal and to pause the selected electrical signal in a timely manner; a converter coupled to the track-and-hold component and the sequencer, the converter configured to sample the selected electrical signal; and The sequencer is coupled to the transceiver, the track and hold component, and the switch, and is configured to trigger each of the track and hold component and the converter to operate at an appropriate moment.

10. The system of claim 9, further comprising: a controller including said memory device; as well as A controller interface is coupled between the controller and the transceiver, the controller interface being configured to facilitate data transmission between the transceiver and the controller in a compatible data format.

11. A system comprising: a communication bus configured to transmit data; a first anomaly detection system coupled to the communication bus, the first anomaly detection system configured to provide data to the communication bus; as well as a second anomaly detection system coupled to the communication bus, the second anomaly detection system configured to monitor system anomalies of the first anomaly detection system by generating a real-time fingerprint of the first anomaly detection system and comparing the real-time fingerprint to a baseline fingerprint associated with the first anomaly detection system; The second anomaly detection system comprises a system according to any one of claims 9 to 10.

12. The system of any one of claims 9 to 11, wherein the transceiver is at least one of a 10 Megabit (Mb) Ethernet transceiver, a 100 Mb Ethernet transceiver, or a 1 Gigabit (Gb) Ethernet transceiver.

Images