Network anomaly detection method

Abstract

Method for detecting network anomalies. This description relates to a method comprising: - receiving, via an interface (112) of an electronic device (100), a first stream of packets sent by an external source and / or sending a first stream of packets to an external destination; - calculating, by a processing circuit (110), a first packet stream identifier based on at least: a packet source address of the packets in the first stream; and a packet destination address of the first stream; - searching, in an ordered dynamic data structure (114) stored in a memory (104, 106) and comprising a plurality of entries, wherein the search is performed on the basis of the value of the first packet stream identifier compared to one or more search threshold values;and - based on metadata associated with the first entry, blocking the reception of the first packet stream. Figure for the abbreviation: Fig. 1;

Description

Title of the invention: Method for detecting network anomalies Technical field

[0001] The present description relates generally to the field of network communications and, in particular, to the detection of network anomalies. Prior art

[0002] In the field of embedded systems with the Internet of Things (IoT), for example in the automotive field, connections to networks such as the Internet are becoming ubiquitous. These connections make devices embedded in such networks prone to becoming potential victims of hackers through network intrusion attacks. A defense mechanism against such attacks is to detect any anomalies present in communications to or from the network in order to detect potential attacks and to enable countermeasures to be taken to ensure the security and confidentiality of sensitive data of the embedded device.

[0003] Several techniques have been developed to detect any anomalies in data communications between a device and a network. For example, network intrusion detection systems (IDS) have been proposed, and more particularly a flow-based IDS.

[0004] However, a disadvantage of existing techniques is that they tend to require relatively high processing power and / or be slow to keep track of all current flows. Summary of the invention

[0005] There is a need in the state of the art for network anomaly detection that overcomes all or part of the problems of the prior art.

[0006] Embodiments of the present description overcome all or part of the drawbacks of known methods for detecting network anomalies.

[0007] One embodiment overcomes all or part of the drawbacks of a known method for detecting network anomalies.

[0008] One embodiment provides a method comprising: - receiving, via an interface of an electronic device, a first stream of packets sent by a source which is external to the electronic device and / or transmitting, via the interface, a first stream of packets to a destination external to the electronic device; - The calculation, by a processing circuit of the electronic device, of a first packet flow identifier on the basis of at least one address among: a packet flow address packet source of the packets of the first flow; and a packet destination address of the packets of the first flow; and - searching, in an ordered dynamic data structure stored in a memory of the electronic device and comprising a plurality of entries, each entry comprising packet flow metadata associated with a corresponding packet flow identifier, to identify a first entry associated with the first packet flow identifier, wherein the search is performed based on the value of the first packet flow identifier relative to one or more search threshold values; and - based on the metadata associated with the first entry, blocking the reception of the first stream of packets.

[0009] According to one embodiment, the ordered data structure is a dynamic data structure, the method further comprising: - receiving, via the interface, a second stream of packets sent by another source which is external to the electronic device and / or transmitting, via the interface, a second stream of packets to another destination external to the electronic device; - Calculating, by the processing circuit, a second packet flow identifier based on at least one packet source address and one packet destination address of the packets of the second flow; and - searching, in the ordered dynamic data structure, for a second entry associated with the second packet flow identifier, wherein if it is determined that the second packet flow identifier does not match any of the entries: - extracting metadata characterizing the second packet stream; and - inserting, into the ordered dynamic data structure, a new entry comprising the metadata characterizing the second packet flow in association with the second packet flow identifier.

[0010] According to one embodiment, the packet flow metadata associated with each packet flow identifier comprises at least one of the following values: - a destination port address of a packet flow identified by the packet flow identifier; - an internet protocol of a packet stream identified by the packet stream identifier; - a duration of a packet flow identified by the packet flow identifier; - a ratio of a number of downlink packets to a number of uplink packets in a packet flow identified by the packet flow identifier; - a maximum length of packets in a packet stream identified by the packet stream identifier; - an average forward and / or reverse packet length in a packet stream identified by the packet stream identifier; - a rate in bytes per second for a packet stream identified by the packet stream identifier; - a packet rate for a packet flow identified by the packet flow identifier; - a number of forward and / or reverse packets in a packet flow identified by the packet flow identifier; - a total forward and / or reverse packet length in a packet stream identified by the packet stream identifier; and - a maximum length of a forward and / or reverse packet in a packet stream identified by the packet stream identifier.

[0011] According to one embodiment, the ordered dynamic data structure is a spanning list.

[0012] According to one embodiment, the ordered dynamic data structure is a balanced binary tree.

[0013] According to one embodiment, the ordered dynamic data structure is a two-color tree.

[0014] According to one embodiment, the first packet flow identifier is a concatenation, performed by the processing circuit in a shift register of the device, of at least the packet source address and / or the packet destination address of the packets of the first flow.

[0015] According to one embodiment, the first packet flow identifier is an integer value.

[0016] According to one embodiment, the first packet flow identifier is a floating point value.

[0017] According to one embodiment, the first packet flow identifier is further based on the packet source port address and the packet destination port address.

[0018] One embodiment provides an electronic device comprising: - an interface configured to receive a first stream of packets, sent by a source which is external to the electronic device and / or to transmit a first stream of packets to a destination which is external to the electronic device; - a processing circuit configured to calculate a first packet flow identifier belonging to an ordered set, on the basis of one of: a packet source address of the packets of the first flow; and a destination address of packets of the packets of the first flow; and - a memory configured to store an ordered dynamic data structure comprising a plurality of entries, each entry comprising packet flow metadata associated with a corresponding packet flow identifier, the processing circuitry being further configured to search, in the ordered dynamic data structure, to identify a first entry associated with the first packet flow identifier, wherein the search is performed based on the value of the first packet flow identifier compared to one or more search threshold values, and to block reception of the first packet flow based on the metadata.

[0019] According to one embodiment, the interface is further configured to receive a second stream of packets sent by another external source or to transmit a second stream of packets to another destination which is external to the electronic device and in which the processing circuit is further configured to: - calculating a second packet flow identifier based on at least one packet source address and one packet destination address of the packets of the second flow; and - searching the ordered dynamic data structure for a second entry associated with the second packet flow identifier and, if it is determined that the second packet flow identifier does not match any of the entries: - extract metadata characterizing the second packet stream; and - insert, into the ordered dynamic data structure, a new entry comprising the metadata characterizing the second packet flow in association with the second packet flow identifier.

[0020] According to one embodiment, the processing circuit is further configured to calculate the first packet flow identifier by concatenating at least the packet source address and the packet destination address of the packets of the first flow. Brief description of the drawings

[0021] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0022] [Fig.l] schematically represents an example of an electronic device according to an embodiment of the present description;

[0023] [Fig.2] represents an example of an unordered data structure;

[0024] [Fig.3] represents another example of an unordered data structure;

[0025] [Fig.4] represents an example of an ordered data structure;

[0026] [Fig.5] is a diagram showing the element insertion time for multiple data structures;

[0027] [Fig.6] shows another example of an ordered data structure; and

[0028] [Fig.7] is a flowchart illustrating operations of a network anomaly detection method according to an embodiment of the present disclosure. Description of Embodiments

[0029] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0030] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed. In particular, different unordered and ordered data structures have not been described and are known to those skilled in the art.

[0031] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0032] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0033] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0034] In the following description, the terms uplink and downlink refer respectively to the uploading of data from an end device in a network and the downloading of data from a network to an end device. The terms forward packets and backward packets refer respectively to data packets traversing a gateway of a network in opposite directions, the forward direction corresponding for example to the direction of a first data packet of a given stream of packets.

[0035] [Fig.l] schematically represents an example of an electronic device 100 comprising an integrated circuit 102 according to an embodiment of the present description. The electronic device 100 is for example a terminal device in a network, or a gateway device in a network, or can act as a terminal device for certain packet flows and a gateway device for other packet streams.

[0036] In some embodiments, the device 100 is an IoT device. Additionally or alternatively, the electronic device 100 is, for example, part of an electronic system of an automobile.

[0037] The electronic device 100 further comprises a non-volatile memory 104 (NV MEM) and a volatile memory 106 (RAM). The non-volatile memory 104 is for example a FLASH memory. The volatile memory 106 is for example a random access memory. The memories 104 and 106 are for example connected to each other via a bus 108.

[0038] The electronic device 100 further comprises a processing circuit 110 (CPU) and a communications interface 112 (INTERFACE), for example connected to the memories 104 and 106 via the bus 108. In certain embodiments, the processing circuit 110 is a processor configured to execute instructions stored for example in the memory 106. According to another example, the processing circuit 110 is implemented by dedicated hardware, for example by a dedicated electronic subsystem or an ASIC (from the English "Application Specific Integrated Circuit").

[0039] The communications interface 112 is for example configured to transmit and receive packet streams to or from devices external to the electronic device 100. In some embodiments, the communications interface 112 is a wireless interface configured to receive streams of data packets from external sources and sent via a network such as, for example, a Wi-Fi (Wireless Fidelity) network. In addition or according to a variant, the communications interface 112 is a wireless interface configured to transmit streams of data packets to external destinations via a network such as, for example, a Wi-Fi network. For example, the electronic device 100 is connected to the Internet of Things via the interface 112.In another embodiment, interface 112 is a wired interface configured to receive streams of data packets from external sources and sent via a wired network such as, for example, an Ethernet network.

[0040] The electronic device 100 is for example configured to implement a flow-based IDS method to protect the device 100 against hacker attacks. The flow-based IDS involves analyzing the current packet flow to extract metadata over time, which is then compared to one or more thresholds to detect anomalies indicative of an attack. For example, the metadata comprises a number n of information parts. The number n of information parts is, for example, equal to 41 in a KDD-CUP99 IDS dataset, 49 in an UNSW-NB IDS dataset or 84 in a CICIDS2017 IDS dataset. More generally, the number of information parts may vary and depends on a given IDS dataset. For example, the metadata is based on the number of packets of a given packet stream received during a given time period and / or on the total packet size associated with a given packet stream received during a given time period. Each packet stream corresponds for example to the packets sent from a given source address to a given destination address. The metadata is for example collected during the packet stream and stored in a data structure 114 (DATA STRUC.), which is for example stored in the volatile memory 106. If the stream already exists in the data structure 114, the associated metadata is updated in the data structure 114.If the stream does not exist in data structure 114, metadata is calculated for this new stream and inserted into data structure 114.

[0041] The effectiveness of a stream-based IDS depends on the search time complexity of the data structure 114. Indeed, new and / or updated metadata regarding a given stream should be stored in the appropriate entry of the data structure 114 in real time so that no information is missed and an appropriate alert can be generated in the event of an anomaly detection. In particular, the data structure can be used to load current and new packet streams to enable the collection and storage of metadata and the generation of alerts in the event that anomalies are detected.

[0042] The data structure 114 is for example a dynamic data structure, meaning that new entries can be added to the data structure in such a way that the new entries, as well as all existing entries, can be located by searching the data structure. Advantageously, the data structure 114 is an ordered dynamic data structure.

[0043] Some examples of unordered and ordered dynamic data structures are described below in connection with Figures 2 to 6.

[0044] [Fig.2] represents an example of an unordered data structure 200 and, in particular, a linked list structure.

[0045] For example, the linked list 200 comprises 9 elements, which are represented as integers. For example, the first to ninth elements of the list are the integers 62, 15, 12, 29, 33, 23, 58, 47 and 79 respectively. Each time a new element is inserted into the linked list 200, it becomes, for example, the new first or the new last element of the list. Thus, a linked list has an unordered structure, in that the integers of the linked list 200 are arranged in order of insertion into the list and not in ascending or descending order.

[0046] During a search for a target element in the linked list 200, the elements of the list are analyzed, one by one, starting with the first element, until the target element is found. The search time in a 200 linked list is thus proportional to the number of elements it contains. In other words, for a linked list comprising n number of elements, the search time complexity is O(n). Search time complexity is a well-known concept in the field and provides an indication of the search time in a given data structure.

[0047] [Fig. 3] shows an example of another unordered data structure 300 and, in particular, a hash table structure which is shown according to an example in which it is used to store data from a telephone directory.

[0048] The hash table 300 makes it possible to associate an element, for example a pair of values ​​302 comprising a name and a telephone number, with a key (KEY). In the example of the hash table 300, the pair of values ​​(LISA SMITH, 521-8976) is associated with the key LISA SMITH.

[0049] All the elements of the hash table 300 are stored consecutively and are accessible by an index (INDEX) corresponding, for example, to a hash value. For example, the index associated with the pair (LISA SMITH, 521-8976) is generated by applying a hash function (HASH) to the key LISA SMITH. For example, the index value corresponds to the generated hash value, modulo the size of the hash table 300. For example, the index value associated with the pair (LISA SMITH, 521-8976) is the value 001. For example, the hash table 300 further comprises a pair (SAM DOE, 521-5030) having, for index, the value 254 and a pair (TED BAKER, 418-4165) having, for index, the value 153.

[0050] Therefore, during the search for a target element, the corresponding index is calculated from a corresponding key, for example, the name. The target element is then accessed with the index value.

[0051] To insert a given new element into the hash table 300, for example the name SANDRA DEE with the telephone number 521-9655, the corresponding index, for example 152, is generated and the element is inserted into the data structure 300. In the example of the hash table 300, another element, which is the pair (JOHN SMITH, 521-1234), is already identified by the index value 152. Therefore, there is a conflict and, in such a case, the elements having the same index are for example arranged in a linked list. In the example shown in [Fig. 3], an entry 304 indicates whether there is at least one conflict. For example, a cross (x) indicates that there is no conflict and a dot (❖) indicates the presence of at least one conflict for the corresponding index. Conflicts only appear when the hash table 300 is almost full, that is, when the number of stored data elements is close to a threshold size value.For example, the threshold size value is equal to a percentage of the size of the hash table 300, where the percentage is . equal to 75%.

[0052] When the hash table 300 reaches a threshold size, its size is for example doubled and all the indexes are recalculated. This makes it possible to rearrange the hash table 300 and to eliminate certain conflicts. For example, by doubling the size of the hash table 300, the hash value of the key SANDRA DEE, modulo the new size of the hash table, will no longer be equal to 152.

[0053] For a hash table with no conflicts, all elements are accessible with a constant time delay. Due to the occurrence of some delay from time to time, such as for example in the case of a conflict or an increase in the size of the hash table 300, the search time complexity is 0(1) in an amortized time.

[0054] [Fig.4] represents an example of an ordered data structure 400 and, in particular, a spanning list structure comprising nine integer elements.

[0055] The 400 spanning list is a probabilistic data structure sharing some of the properties of a linked list, while limiting its drawbacks.

[0056] The spanning list 400 comprises, for example, four layers. A lower layer Lo is a linked list comprising the nine elements, a base value (-❖) and a head value (+❖), these elements and values ​​being arranged in an increasing manner. The base value is smaller than all the elements of the spanning list 400 and the head value is larger than all the elements of the spanning list 400. During the construction of the spanning list 400, each integer element of the layer Lq has a probability 1 / p, where p 1, of being added to a second layer L}. In other words, for each element, a random decision is made as to whether or not to add it to the second layer L^. In the example of the 400 spanning list, P is for example equal to 2 so statistically 1 out of 2 of the elements are added to the second layer which in the example of figure 4 corresponds to elements 15, 29, 33 and 62.Similarly, during the construction of the spanning list 400, each element in layer Li has a probability 1 / p of being added to the layer above, which is layer L2. The probability of placing an element on an n-th layer L„, n being an integer, is equal to 1 / ( p( «+0 ), which reduces the probability that the number . of layers increases considerably. In the example of the spanning list 400, only element 29 is added to layer L2. In addition, layers and L2 are also ordered lists and contain the base and head elements. Element 29 is for example not communicated to a third layer and a layer upper L3 contains only the base and head elements. In general, a list with spannings of n elements includes a log number (n) of layers and one layer superior.

[0057] The search for a target element begins in the top layer. The elements are analyzed horizontally, from the smallest, until an element is found that is greater than or equal in value to the target element. When the analyzed element is equal to the target element, then the target element has been found. When the analyzed element is greater than the target element, the process is repeated after returning to the previous element, i.e., the smaller element closest to the target element in the layer, and jumping to the next lower layer. In the example of Figure 4, the target element is, for example, the integer 79, and the analysis of the top layer L3 automatically leads to the analysis of the base element in layer L2. Since the base element is by definition smaller than the target element, the next element in layer L2 is analyzed, element 29 is smaller than the target element, but the next element is the high value.So the scan continues from element 29 in layer L^_ In the layer element 29 is followed by elements 33 and 62, each smaller than the target element. The leading element follows element 62. So the search continues from element 62 in layer Lq. In the layer element, the target element follows element 62, and is thus found.

[0058] The process of inserting a new entire element is similar to the search process. The spanning list is scanned from the top layer to the bottom layer to identify the location in which to insert, in an orderly fashion, the new element in the bottom layer. The new element is then added to the layer above with probability 1 / p and, if added to the layer above, it is then added to the layer above with probability 1 / p, etc.

[0059] For a spanning list, the search time complexity and the insertion time complexity are O( log(n) )• Similar to search time complexity, insertion time complexity is a well-known concept in the field and provides an indication of the time to insert a new entry into a given data structure.

[0060] [Fig.5] is a diagram 500 representing the insertion time of elements for several data structures. In particular, the diagram 500 represents three graphs 502, 504 and 506 respectively representing the insertion time (TIME(ns)) in nanoseconds as a function of the size (NB OF ELEMENTS) of the hash table 300, the spanning list 400 and the linked list 200.

[0061] Inserting elements into the hash table 300, for example, causes the size of the hash table to double only when the insertion causes the hash table 300 to reach a size threshold. For example, the hash table initially has a size allowing the storage of 12 elements. Inserting the thirteenth element, for example, causes the size of the hash table 300 to double. The doubling causes a peak in the graph 502. Subsequent insertions, up to twenty-fourth, are not time-consuming because the hash table already has the locations for these insertions. As with the thirteenth, the twenty-fifth insertion causes a spike in the graph 502. Indeed, each insertion causing the hash table 300 to double causes such a spike. The insertion time required for each doubling of the size of the hash table 300 becomes increasingly large. For example, the insertion time required to insert the thirteenth element is approximately 103 nanoseconds, while the insertion time required to insert the 393,217th element is approximately 1()8 nanoseconds. When a hash table is used to implement the data structure 114 of [Fig. 1], this exponentially increasing time can lead to the overload of the processing circuit 110 when a relatively large number of packet streams are received.

[0062] The insertion time required for the spanning list 400 increases slowly as a function of the size of the spanning list 400. For example, the maximum insertion time required to insert an element, when the size is less than 393,216, is approximately 3,000 nanoseconds, which is considerably shorter than for the hash table 300.

[0063] The time to insert elements into the linked list 200 is relatively constant and a little less than 100 nanoseconds. The low insertion time required is due to the low complexity of inserting an element into the linked list 200. Indeed, elements are always inserted, for example, at the beginning or end of the linked list, whereas, for the spanning list 400, the element is ordered between the existing elements. Nevertheless, the complexity of the search time for the linked list 200 largely offsets the time savings provided by the relatively short insertions.

[0064] [Fig.6] represents an example of an ordered data structure 600 and, in particular, a balanced two-color tree structure.

[0065] The balanced two-color tree 600 is a type of balanced binary tree. The tree 600 comprises, for example, a root 602 with which a data value is associated, equal to 29 in the example of [Fig. 6]. The tree 600 further comprises nodes, including a node 603, a node 604 and a node 605 respectively associated with data values ​​15, 62 and 79. The tree 600 comprises, for example, a plurality of other nodes, not referenced in [Fig. 6]. The tree 600 further comprises leaves 606, each leaf 606 being a final node of the tree 600. The leaves 606 are not associated with any data value and are represented with a null element NIL. The root and each node are parents of two children, a child being either another node or a leaf.For a given node, a right child (child positioned to the right of the node in the layer below) has a value greater than that of the node, or is a leaf, and a left child (child positioned to the left of the node in the layer below) has a value less than that of the node, or is a leaf.

[0066] As with a balanced binary tree, searching for a target element, for example 79, in tree 600 involves traversing the tree, from the root, until the target element is found. For example, element 29 of the root of tree 600 is less than the target element and the search continues by analyzing the right child of the root, which is node 604 with the value 62. The value 62 is less than the target element and the search continues by analyzing the right child of node 604 which is node 605. Node 605 is associated with the target element and thus the search ends. The search time complexity of a balanced binary tree, including a balanced binary two-color tree, comprising a number n of elements is O(log(n ) ) •

[0067] Compared to standard balanced binary trees, each node of the two-color tree 600 is further associated with an additional attribute. For example, the additional attribute is a single bit of information, which can be conceptually represented by a color, red or black. The root and leaves of a balanced two-color tree are always black. In addition, the non-leaf children of a black node are red nodes and the non-leaf children of a red node are black. An important property of a balanced two-color tree is that each path from a given node to any of its descendant leaves passes through the same number of black nodes. This rule provides the advantage that the insertion time into a balanced two-color binary tree is better than the insertion time into a normal balanced binary tree.Indeed, the insertion time for a normal balanced binary tree comprising n elements is between O(log(nj) and O{n\ depending on the tree, and is O(log(n)) for a balanced two-color tree. .

[0068] [Fig.7] is a flowchart representing operations of a method for detecting network anomalies appearing in the device 100 of [Fig.1] according to an embodiment of the present description.

[0069] In an operation 700 (COMMUNICATION), a communication is for example established between the device 100 and an external source. This communication is for example established via a data communication network, such as the Internet, and / or other local networks. During the operation 700, the device 100 receives and / or transmits for example one or more current streams of packets.

[0070] Operation 700 is for example followed by an operation 702 (NORMAL TASKS), in which the device 100 for example performs tasks on the basis of the packets received.

[0071] To ensure that the packets in a current packet flow are not the result of a network anomaly, such as, for example, an intrusion, an operation 704 (INTRUSION DETECTION) is for example performed in parallel with the operation 702.

[0072] Operation 704 is for example performed by processing circuit 110 and involves a plurality of operations 706 to 715.

[0073] For example, in operation 706 (WAIT FOR PACKET), the processing circuit 110 monitors the interface 112, waiting for the reception of a new stream of packets or waiting for the reception of a new packet belonging to a current stream of packets. A received packet may come from an external source or may be a packet that is to be transmitted to an external destination. The processing circuit 110 is for example configured to determine whether or not a packet of a stream of packets is received by the interface in an operation 707 (PACKET RECEIVED?). If the processing circuit 110 detects no packet (branch N), the process continues by repeating operation 706 after a given time delay and this is repeated until a packet is received.

[0074] If, in operation 707, the processing circuit 110 detects the reception of a packet (branch Y), the process continues in a step 708 (IDENTIFICATION AND SEARCHING).

[0075] According to one embodiment, operation 708 involves generating an identifier for the current flow of packets, based on the received packet. This identifier is for example based on a combination of fields uniquely identifying the current flow. The fields include for example the packet source address and / or the packet destination address. The fields may further include the packet source port address and the packet destination port address. The fields may further include an indication of the protocol, such as for example TCP (Transmission Control Protocol), or the service, such as for example FTP (File Transfer Protocol), used for the communication, which are categorical data and difficult to convert into integer data.For example, the communications interface 112 includes a plurality of ports transmitting packet streams and a plurality of ports for receiving packet streams. The source and destination port addresses are, for example, fields in the header of each packet in the stream, and one or both of these fields are thus, for example, used to calculate the identifier of the current packet stream.

[0076] According to one embodiment, the identifier is generated so as to belong to an ordered data structure, such as, for example, the definition of real numbers or natural integers.

[0077] According to one embodiment, the identifier is generated based on a concatenation of the values ​​of the fields on which it is based. For example, the processing circuit 110 comprises a shift register configured to receive a plurality of fields of the received packet in a serial manner and to output the bits of the fields in parallel to form the identifier.

[0078] According to another embodiment, the identifier is generated by the processing circuit 110, which is further configured to apply a mathematical function to the field values. The mathematical function could, for example, be any combination of addition, subtraction, multiplication, and / or other mathematical operations. In another example, the mathematical function is applied as a preprocessing of the field values ​​before generating the identifier based on a concatenation.

[0079] According to one embodiment, for a bidirectional packet flow, two separate identifiers are calculated based on the fields that identify the incoming and outgoing packets as separate flows. For example, in this case, the packet destination address is not used to calculate the identifier of the unidirectional packets.

[0080] According to one embodiment, the ordered data structure is a spanning list or a balanced binary tree, such as, for example, a bicolor tree, B- trees, B+ trees, etc., stored in volatile memory 106.

[0081] The ordered data structure is for example empty at each start of the processing circuit 110. Furthermore, the ordered data structure is for example configured to store metadata, originating from the packets of a packet stream received by the interface 112, in association with an entry. The entry is for example identified by the identifier generated from fields of the packets of the packet stream.

[0082] The processing circuit 110 is for example further configured to search for the identifier in the ordered data structure and to determine, in an operation 709 (FOUND?), whether the identifier matches an existing entry in the ordered data structure. The search comprises for example comparing the identifier to one or more search threshold values, which correspond for example to the elements of the spanning list of [Fig. 4] or to the nodes of the binary tree of [Fig. 6]. If the identifier does not match any of the existing entries, or if the ordered data structure is empty (branch N), the process continues in an operation 710 (INSERTION), in which a new entry is inserted into the data structure and the metadata constitutes the entry in the ordered data structure in association with the identifier.The input inserted in operation 710 contains, for example, metadata characterizing the received packet stream. The number of metadata elements for a new packet stream is, for example, the same as the number of metadata elements of a current stream. In another example, some statistical values ​​require more samples to calculate, in which case the number of metadata elements of a new packet stream differs from the number of metadata elements of a current stream.

[0083] The time to insert a new entry in association with the identifier depends on the type of the ordered data structure. Once operation 710 is complete, the process continues by returning to operation 706 and waiting for another packet to be received.

[0084] If, during operation 709, the processing circuit 110 finds an entry of the ordered data structure (Y branch) corresponding to the identifier, then the process continues in an operation 711 (UPDATE MET AD AT A). In operation 711, the processing circuit 110 extracts, for example, information constituting the metadata that characterizes the packet of the current stream. The processing circuit 110 also uses, for example, the extracted information to update metadata of the current stream. For example, the metadata of the current stream includes one or more of the following values: - a destination port address of a packet flow identified by the packet flow identifier; - an internet protocol of a packet stream identified by the packet stream identifier; - a duration of a packet flow identified by the packet flow identifier; - a ratio of a number of downlink packets to a number of uplink packets in a packet flow identified by the packet flow identifier; - a maximum length of packets in a packet stream identified by the packet stream identifier; - an average forward and / or reverse packet length in a packet stream identified by the packet stream identifier; - a rate in bytes per second for a packet stream identified by the packet stream identifier; - a packet rate for a packet flow identified by the packet flow identifier; - a number of forward and / or reverse packets in a packet flow identified by the packet flow identifier; - a total forward and / or reverse packet length in a packet stream identified by the packet stream identifier; - a maximum length of a forward and / or reverse packet in a packet stream identified by the packet stream identifier; and - a ratio between a number of forward packets and a number of backward packets in a packet flow identified by the packet flow identifier, for example in the case where the packets pass through a gateway. These examples of possible information values ​​constituting metadata are not exhaustive and many other information values ​​could be considered.

[0085] The metadata of the current stream further includes, for example: - a minimum and / or maximum arrival interval time between packets in a packet flow identified by the packet flow identifier; - an average value and / or a standard deviation value of minimum and / or maximum arrival time interval between packets in a packet flow identified by the packet flow identifier; - a packet indicator value from a packet flow identified by the packet flow identifier, the indicator being for example a URG indicator (URGENT), a PSH indicator (PUSH), etc. Additionally, metadata is for example extracted from the forward direction, or the reverse direction, or both directions of a current packet flow identified by the packet flow identifier.

[0086] The processing circuit 110 is for example configured to update the metadata stored in the ordered data structure in association with the identifier each time a packet associated with this identifier is received. Updating the metadata comprises for example updating the statistics on the basis of appropriate algorithms in order to take into account the characteristics of each new packet.

[0087] In an operation 712 (RECEPTION ENDED?), the processor 110 determines, for example, whether the reception of the current stream of packets identified in the operation 709 is complete. For example, the final packet of the stream contains in its header an indication that it is the last packet of the current stream.

[0088] In another example, the circuit 102 further comprises a timer configured to send a signal to the processing circuit 110 when a threshold time value has been reached since the start of the operation 706. The processing circuit 110 is for example configured to determine that the reception of the current stream is finished upon receipt of this signal.

[0089] If it is determined in operation 712 that reception of the packet stream is not yet complete (branch N) the process continues by repeating operation 706, involving waiting for another packet from the current packet stream.

[0090] If, in operation 712, it is determined that the current flow of packets is terminated (Y branch), then the process continues in an operation 713 (CLASSIFY).

[0091] During this operation 713, the processing circuit 110 is for example configured to compare the metadata stored in the ordered data structure associated with the identifier with one or more thresholds, which makes it possible for example to classify the flow as normal or abnormal. For example, the one or more thresholds may correspond to: an upper limit of the average packet size of the packets in the packet flow; and / or an upper and / or lower limit of the standard deviation of the packet size of the packets in the packet flow; and / or a su- greater than the number of packets in the packet stream.

[0092] In an operation 714 (ATTACK?), the processing circuit 110 is for example configured to determine, on the basis of the classification performed in operation 713, whether the current flow originates from a network anomaly, such as a network intrusion attack. If the processing circuit 110 determines that there is no network anomaly (branch N), the process continues by repeating operation 706, involving waiting for a new flow of packets.

[0093] If the processing circuit determines, in operation 714, that there is possibly a network anomaly (Y branch), the process continues in an operation 715 (TAKE ACTION) in which at least one countermeasure is taken. For example, the current flow of packets is blocked, which means that the packets of the flow are discarded without being processed in operation 702. The method then returns for example to operation 706, involving waiting for a new flow of packets.

[0094] An advantage of embodiments of the present disclosure is that, by generating an identifier of each packet stream based on fields of any packet in the stream and using this identifier to locate a corresponding entry in an ordered list, metadata associated with the current packet stream can be accessed in a timely manner, allowing network anomalies, such as network intrusion attacks, to be quickly identified. Furthermore, by using a spanning list as the ordered data structure, the insertion time can be considerably slow, allowing a relatively large number of new packet streams to be inserted.

[0095] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art. In particular, although particular examples have been described of the fields that may be used to generate the packet flow identifiers, it will be apparent to those skilled in the art that other packet fields could be used that allow a given flow to be identified uniquely by a value falling within an ordered set. Furthermore, although certain examples of ordered data structures having particular advantages have been described, it will be apparent to those skilled in the art that the use of other types of ordered data structures would be possible.

[0096] Finally, the practical implementation of the embodiments and variants described is within the reach of those skilled in the art from the functional indications given above.

Claims

Claims

1. A method comprising: - receiving, via an interface (112) of an electronic device (100), a first stream of packets sent by a source which is external to the electronic device and / or transmitting, via the interface, a first stream of packets to a destination external to the electronic device; - calculating, by a processing circuit (110) of the electronic device, a first packet flow identifier based on at least: a packet source address of the packets of the first flow; and a packet destination address of the packets of the first flow; and - searching, in an ordered dynamic data structure (114) stored in a memory (104, 106) of the electronic device and comprising a plurality of entries, each entry comprising packet flow metadata associated with a corresponding packet flow identifier, to identify a first entry associated with the first packet flow identifier, wherein the search is performed based on the value of the first packet flow identifier compared to one or more search threshold values; and - based on the metadata associated with the first entry, blocking the reception of the first packet flow.

2. The method of claim 1, wherein the ordered data structure (114) is a dynamic data structure, the method further comprising: - receiving, via the interface (112), a second stream of packets sent by another source which is external to the electronic device and / or transmitting, via the interface, a second stream of packets to another destination external to the electronic device; - calculating, by the processing circuit (110), a second packet flow identifier based on at least one packet source address and one packet destination address of the packets of the second flow; and - searching, in the ordered dynamic data structure, for a second entry associated with the second packet flow identifier, wherein if it is determined that the second packet flow identifier does not match any of the entries: - extracting metadata characterizing the second packet stream; and - inserting, into the ordered dynamic data structure, a new entry comprising the metadata characterizing the second packet stream in association with the second packet stream identifier.

3. The method of claim 1 or 2, wherein the packet flow metadata associated with each packet flow identifier comprises at least one of the following values: - a destination port address of a packet flow identified by the packet flow identifier; - an internet protocol of a packet flow identified by the packet flow identifier; - a duration of a packet flow identified by the packet flow identifier; - a ratio of a number of downlink packets to a number of uplink packets in a packet flow identified by the packet flow identifier; - a ratio of a number of backward packets to a number of forward packets in a packet flow identified by the packet flow identifier; - a maximum length of packets in a packet flow identified by the packet flow identifier;- an average forward and / or reverse packet length in a packet stream identified by the packet stream identifier; - a throughput in bytes per second for a packet stream identified by the packet stream identifier; - a packet rate for a packet stream identified by the packet stream identifier; - a number of forward and / or reverse packets in a packet stream identified by the packet stream identifier; - a total forward and / or reverse packet length in a packet stream identified by the packet stream identifier; and - a maximum length of a forward and / or reverse packet in a packet stream identified by the packet stream identifier.;

4. The method of any one of claims 1 to 3, wherein the ordered dynamic data structure (114) is a spanning list.

5. The method of any one of claims 1 to 3, wherein the ordered dynamic data structure (114) is a balanced binary tree.

6. The method of claim 5, wherein the ordered dynamic structure (114) is a two-color tree.

7. A method according to any one of claims 1 to 6, wherein the first packet flow identifier is a concatenation, performed by the processing circuit in a shift register of the device (100), of at least the packet source address and / or the packet destination address of the packets of the first flow.

8. The method of any one of claims 1 to 7, wherein the first packet flow identifier is an integer value.

9. The method of any one of claims 1 to 7, wherein the first packet flow identifier is a floating point value.

10. The method of any one of claims 1 to 9, wherein the first packet flow identifier is further based on the packet source port address and the packet destination port address.

11. An electronic device (100) comprising: - an interface (112) configured to receive a first packet stream, sent by a source that is external to the electronic device and / or to transmit a first packet stream to a destination that is external to the electronic device; - a processing circuit (110) configured to calculate a first packet stream identifier belonging to an ordered set, on the basis of at least one address among: a packet source address of the packets of the first stream; and a packet destination address of the packets of the first stream;and - a memory (104, 106) configured to store an ordered dynamic data structure (114) comprising a plurality of entries, each entry comprising packet flow metadata associated with a corresponding packet flow identifier, the processing circuitry being further configured to search, in the ordered dynamic data structure, to identify a first entry associated with the first packet flow identifier, wherein the search is performed based on the value of the first packet flow identifier compared to one or more search threshold values and to block reception of the first packet flow based on the metadata.;

12. The electronic device (100) of claim 11, wherein the interface (112) is further configured to receive a second packet stream sent by another external source or to transmit a second packet stream to another destination that is external to the electronic device and wherein the processing circuitry is further configured to: - calculating a second packet flow identifier based on at least one packet source address and one packet destination address of the packets of the second flow; and - searching the ordered dynamic data structure (114) for a second entry associated with the second packet flow identifier and, if it is determined that the second packet flow identifier does not match any of the entries: - extracting metadata characterizing the second packet flow; and - inserting, into the ordered dynamic data structure, a new entry comprising the metadata characterizing the second packet flow in association with the second packet flow identifier.

13. The electronic device (100) of claim 11 or 12, wherein the processing circuit (110) is further configured to calculate the first packet flow identifier by concatenating at least the packet source address and the packet destination address of the packets of the first flow.

Images