SYSTEM AND METHOD FOR PROCESSING ANOMALOUS ACTIVITY IN O-RAN NEAR REAL-TIME RIC PLATFORMS

Abstract

The method executed by at least one processor includes detecting onboarding of an application. The method further includes determining one or more application properties of the application in response to the detecting. The method further includes generating a protection program based on the one or more application properties. The method further includes deploying the protection program. The protection program provides a mitigation action in response to detecting an attack against the application.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U.S. Provisional Patent Application No. 63 / 399,434, filed August 19, 2022, the disclosure of which is incorporated by reference in its entirety herein. [Technical field]

[0002] Apparatus and methods consistent with example embodiments of the present disclosure relate to a framework for providing real-time detection and resolution of anomalous activity in a Radio Access Network (RAN) Intelligent Controller (RIC) platform. [Background technology]

[0003] Related art O-RAN specifications do not provide internal or functional aspects or definitions of security services in near-real-time (near-RT) Radio Access Network (RAN) Intelligent Controllers (RICs). Thus, related art O-RAN architectures do not incorporate solutions to near-RT RIC (e.g., hosted applications (xApps), etc.) threats or malware attacks (e.g., volumetric attacks, fraud, etc.).

[0004] The most commonly used solution to volumetric attacks in the related art is to run a sidecar proxy alongside the core container of each component / service in the container platform. However, this solution requires high latency, operational complexity, and increased resource utilization (e.g., memory, random access memory (RAM), storage space, etc.). As a result, implementing this solution in a RIC platform cannot detect and mitigate / handle attacks such as volumetric attacks and file system operational attacks in real time.

[0005] Therefore, there is a need to detect and mitigate attacks launched by malicious actors against the RAN and RIC platforms from compromised RIC applications (xApps) and compromised devices (e.g., User Equipment (UE) and Internet of Things (IoT) devices).

[0006] Improvements are presented herein that may also be applicable to other multi-access technologies and telecommunications standards that use these technologies. Summary of the Invention [Problem to be solved by the invention]

[0007] The following presents a simplified summary of one or more embodiments of the present disclosure in order to provide a basic understanding of such embodiments. This summary is not an extensive overview of all possible embodiments, and is not intended to identify key or critical elements of all embodiments or to delineate the scope of any or all embodiments. Its sole purpose is to present some concepts of one or more embodiments of the present disclosure in a simplified form as a prelude to the more detailed description that is presented later.

[0008] A method, apparatus, and non-transitory computer-readable medium for providing real-time detection and resolution of anomalous activity in a RAN RIC platform.

[0009] According to an example embodiment, a method executed by at least one processor includes detecting onboarding of an application. The method further includes determining one or more application properties of the application in response to the detecting. The method further includes generating a protection program based on the one or more application properties. The method further includes deploying the protection program. The protection program provides a mitigation action in response to detecting an attack against the application.

[0010] According to an exemplary embodiment, a network node operating in a wireless communication network includes at least one memory configured to store computer program code and at least one processor configured to access the at least one memory and operate as instructed by the computer program code. The computer program code includes detection code configured to cause at least one of the at least one processor to detect onboarding of an application. The computer program code includes determination code configured to cause at least one of the at least one processor to determine one or more application properties of the application in response to the detection. The computer program code includes generation code configured to cause at least one of the at least one processor to generate a protection program based on the one or more application properties. The computer program code further includes deployment code configured to cause at least one of the at least one processor to deploy a protection program. The protection program provides a mitigation action in response to detection of an attack on the application.

[0011] Additional embodiments are set forth in the description that follows, and in part will be apparent from the description and / or may be learned by practice of presented embodiments of the present disclosure. [Brief description of the drawings]

[0012] The above and other aspects, features, and aspects of embodiments of the present disclosure will become apparent from the following description taken in conjunction with the accompanying drawings.

[0013] [Figure 1] FIG. 2 is a diagram of an exemplary network device in accordance with various embodiments of the present disclosure.

[0014] [Diagram 2] FIG. 1 is a schematic diagram of an example O-RAN communication system, in accordance with various embodiments of the present disclosure.

[0015] [Diagram 3] FIG. 2 illustrates an exemplary RIC architecture, in accordance with various embodiments of the present disclosure.

[0016] [Figure 4] FIG. 1 illustrates an exemplary RIC platform in accordance with various embodiments of the present disclosure.

[0017] [Diagram 5] 3 shows a flowchart of an attack detection and mitigation process according to various embodiments of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] The following detailed description of the exemplary embodiments refers to the accompanying drawings, in which the same reference numbers in different drawings may identify the same or similar elements.

[0019] The foregoing disclosure provides illustrations and descriptions, but is not intended to be exhaustive or to limit the implementation to the precise form disclosed. Modifications and variations are possible in light of the above disclosure or may be acquired from practice of the implementations. Moreover, one or more features or components of one embodiment may be incorporated in or combined with another embodiment (or one or more features of another embodiment). In addition, in the flowcharts and descriptions of operations provided below, it is understood that one or more operations may be omitted, one or more operations may be added, one or more operations may be performed (at least partially) simultaneously, and the order of one or more operations may be permuted.

[0020] It will be apparent that the systems and / or methods described herein may be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods is not intended to limit the implementation. Thus, the operation and behavior of the systems and / or methods are described herein without reference to any specific software code, and it will be understood that software and hardware can be designed to implement the systems and / or methods based on the description herein.

[0021] Although particular combinations of features are recited in the claims and / or disclosed herein, these combinations are not intended to limit the disclosure of possible implementations. Indeed, many of these features may be combined in ways not specifically recited in the claims and / or disclosed herein. Although each dependent claim listed below may depend directly on only one claim, the disclosure of possible implementations includes each dependent claim in combination with every other claim in the claim set.

[0022] No element, act, or instruction used herein should be construed as critical or essential unless expressly stated as such. Also, as used herein, the articles "a" and "an" are intended to include one or more items and may be used interchangeably with "one or more." When only one item is intended, the term "one" or similar phrases are used. Also, as used herein, terms such as "has," "have," "having," "include," "including," and the like are intended to be open-ended terms. Furthermore, the phrase "based on" is intended to mean "based at least in part on," unless specifically stated otherwise. Furthermore, phrases such as "at least one of [A] and [B]" or "at least one of [A] or [B]" should be understood to include only A, only B, or both A and B.

[0023] Throughout this specification, reference to "one embodiment," "an embodiment," or similar language means that a particular feature, structure, or characteristic described in connection with the illustrated embodiment is included in at least one embodiment of the solution. Thus, the phrases "in one embodiment," "in an embodiment," and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.

[0024] Furthermore, the features, advantages, and characteristics described in the present disclosure may be combined in any suitable manner in one or more embodiments. In light of the description herein, one skilled in the art will recognize that the present disclosure can be practiced without one or more of the specific features or advantages of a particular embodiment. In other instances, additional features and advantages may be recognized in certain embodiments that may not be present in all embodiments of the present disclosure.

[0025] Embodiments of the present disclosure relate to a real-time Security Monitoring and Control framework (SMCF). In some embodiments, the SMCF may be provided to the O-RAN near-RT RIC platform layer to identify various attacks. The attacks may include volumetric attacks against xApps, compromised xApps, xApp fraud, and improper configuration. These attacks may degrade near-RT RIC performance.

[0026] The identified risks can be mitigated by enforcing runtime policies or isolating the affected services / applications as a preventative action. These policies can also expose APIs to the Northbound (NB) for Security xApp that require any kind of metrics / events for offline analysis (e.g. ML related attacks). Additionally, the Security xApp can provide policy guidance or rules to the RIC SMCF.

[0027] In some embodiments, the SMCF prepares one or more protection programs based on application properties. The protection programs can be prepared using the extended Berkley Packet Filter (eBPF) + eXpress Data Path (XDP) framework. These protection programs can be configured with one or more detection / rule patterns to detect attacks against the application. For example, these protection programs can be used to detect various attacks, such as volumetric attacks. These protection programs can also be configured to capture file system events (e.g., open / read / write) and subsequently load the captured events into the eBPF space to detect attacks.

[0028] 1 is a diagram of an exemplary device 100 for implementing the method of the present disclosure. The device 100 can implement the SMCF. The device 100 can correspond to any type of known computer, server, or data processing device. For example, the device 100 can include a processor, a personal computer (PC), a printed circuit board (PCB) with computing device, a minicomputer, a mainframe computer, a microcomputer, a telephone computing device, a wired / wireless computing device (e.g., a smartphone, a personal digital assistant (PDA)), a laptop, a tablet, a smart device, or any other similarly functional device.

[0029] In some embodiments, as shown in FIG. 1, device 100 may include a set of components, such as a processor 120, a memory 130, a storage component 140, an input component 150, an output component 160, and a communication interface 170.

[0030] Bus 110 may include one or more components that enable communication between a set of components of device 100. For example, bus 110 may be a communication bus, a crossover bar, a network, etc. Although bus 110 is shown in FIG. 1 as a single line, bus 110 may be implemented using multiple (two or more) connections between a set of components of device 100. The disclosure is not limited in this respect.

[0031] Device 100 may include one or more processors, such as processor 120. Processor 120 may be implemented in hardware, firmware, and / or a combination of hardware and software. For example, processor 120 may include a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a general purpose single-chip or multi-chip processor, or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, or any conventional processor, controller, microcontroller, or state machine. Processor 120 may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. In some embodiments, certain processes and methods may be performed by electrical circuitry specific to a given function.

[0032] The processor 120 may control the overall operation of the device 100 and / or a set of components of the device 100 (eg, memory 130, storage components 140, input components 150, output components 160, communication interface 170).

[0033] Device 100 may further comprise memory 130. In some embodiments, memory 130 may include random access memory (RAM), read only memory (ROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic memory, flash memory, and / or another type of dynamic or static storage device. Memory 130 may store information and / or instructions for use (e.g., execution) by processor 120.

[0034] Storage component 140 of device 100 may store information and / or computer readable instructions and / or code related to the operation and use of device 100. For example, storage component 140 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, and / or a solid-state disk), a compact disk (CD), a digital versatile disk (DVD), a universal serial bus (USB) flash drive, a Personal Computer Memory Card International Association (PCMCIA) card, a floppy disk, a cartridge, a magnetic tape, and / or another type of non-transitory computer readable medium along with a corresponding drive.

[0035] Device 100 may further comprise input component 150. Input component 150 may include one or more components that enable device 100 to receive information via user input, etc. (e.g., a touch screen, a keyboard, a keypad, a mouse, a stylus, a button, a switch, a microphone, a camera, etc.) Alternatively or additionally, input component 150 may include sensors for sensing information (e.g., a Global Positioning System (GPS) component, an accelerometer, a gyroscope, an actuator, etc.).

[0036] Output components 160 of device 100 may include one or more components capable of providing output information from device 100 (e.g., a display, a liquid crystal display (LCD), a light emitting diode (LED), an organic light emitting diode (OLED), a haptic feedback device, a speaker, etc.).

[0037] Device 100 may further comprise a communication interface 170. Communication interface 170 may include a receiver component, a transmitter component, and / or a transceiver component. Communication interface 170 may enable device 100 to establish a connection and / or transfer a communication with another device (e.g., a server, another device). The communication may occur via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface 170 may enable device 100 to receive information from another device and / or provide information to another device. In some embodiments, communication interface 170 can provide communication with another device over a network, such as a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a private network, an ad-hoc network, an intranet, the Internet, an optical fiber-based network, a cellular network (e.g., a fifth generation (5G) network, a long term evolution (LTE) network, a third generation (3G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a telephone network (e.g., a public switched telephone network (PSTN)), etc., and / or a combination of these or other types of networks. Alternatively or additionally, communication interface 170 can provide communication with another device over a device-to-device (D2D) communication link, such as FlashLinQ, WiMedia, Bluetooth, ZigBee, Wi-Fi, LTE, 5G, etc. In other embodiments, communication interface 170 can include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, etc.

[0038] The device 100 may be included in the core network 240 and may perform one or more processes described herein. The device 100 may perform operations based on the processor 120 executing computer readable instructions and / or code, which may be stored by a non-transitory computer readable medium, such as the memory 130 and / or the storage component 140. The computer readable medium may refer to a non-transitory memory device. The memory device may include memory space within a single physical storage device and / or memory space distributed across multiple physical storage devices.

[0039] Computer readable instructions and / or code may be loaded into memory 130 and / or storage component 140 from another computer readable medium or from another device via communications interface 170. The computer readable instructions and / or code stored in memory 130 and / or storage component 140, when executed by processor 120, can cause device 100 to perform one or more processes described herein.

[0040] Alternatively, or in addition, hardwired circuitry may be used in place of, or in combination with, software instructions to implement one or more processes described herein. Thus, embodiments described herein are not limited to any specific combination of hardware circuitry and software.

[0041] The number and arrangement of components shown in Figure 1 are provided as an example. In practice, there may be additional, fewer, different, or differently arranged components than those shown in Figure 1. Furthermore, two or more of the components shown in Figure 1 may be implemented within a single component, or a single component shown in Figure 1 may be implemented as multiple distributed components. Additionally or alternatively, a set of components shown in Figure 1 may perform one or more functions that are described as being performed by another set of components shown in Figure 1.

[0042] 2 illustrates an example O-RAN communications system 200 in accordance with various embodiments of the present disclosure. The O-RAN communications system 200 may include one or more user equipments (UEts) 210, one or more O-RAN radio units (O-RUs) 220, one or more O-RAN distributed units (O-DUs) 230, and one or more O-RAN centralized units (O-CUs) 240.

[0043] Examples of UE 210 may include a mobile phone, a smartphone, a Session Initiation Protocol (SIP) phone, a laptop, a personal digital assistant (PDA), a satellite radio, a global positioning system (GPS), a multimedia device, a video device, a digital audio player (e.g., MP3 player), a camera, a game console, a tablet, a smart device, a wearable device, a vehicle, an electric meter, a gas pump, a large or small kitchen appliance, a healthcare device, an implant, a sensor / actuator, a display, or any other similarly functioning device. Some of the one or more UEs 210 may be referred to as Internet of Things (IoT) devices (e.g., a parking meter, a gas pump, a toaster, a vehicle, a heart monitor, etc.). One or more UEs 210 may also be referred to as a station, a mobile station, a subscriber station, a mobile unit, a subscriber unit, a radio unit, a remote unit, a mobile device, a wireless device, a wireless communication device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile agent, a client, or some other suitable terminology.

[0044] The O-RU 220 couples with one or more cells 220A (e.g., antennas) within the site. The one or more cells 220A may wirelessly communicate with one or more UEs 210. Each of the one or more cells 220A may provide communication coverage to one or more UEs 210 located within the geographic coverage area of ​​that cell 220A. In some embodiments, as shown in FIG. 2, the cell 220A may transmit one or more beamformed signals to the one or more UEs 210 in one or more transmit directions. The one or more UEs 210 may receive the beamformed signals from the cell 220A in one or more receive directions. Alternatively or additionally, the one or more UEs 210 may transmit the beamformed signals to the cell 220 in one or more transmit directions. Cell 220A can receive beamformed signals from one or more UEs 210 in one or more receive directions and transmissions to cell 220 in one or more transmit directions.

[0045] The one or more cells 220A may include a macrocell (e.g., a high-power cellular base station) and / or a small cell (e.g., a low-power cellular base station). Small cells may include femtocells, picocells, and microcells. The cell 220A, whether a macrocell or a large cell, may include and / or be referred to as an access point (AP), an evolved (or evolved Universal Terrestrial Radio Access Network (E-UTRAN)) Node B (eNB), a next generation Node B (gNB), or any other type of base station known to those skilled in the art. In some embodiments, the cell 220A includes a cellular antenna.

[0046] In some embodiments, the O-RU 220 may be connected to the O-DU 230 via an FH link 224. The FH link may be a 25 Gbps line over which user plane (U-plane) and control plane (C-plane) packets are downloaded from the O-DU 230 to the O-RU 220. In some embodiments, the O-DU 230 may be connected to the O-CU 240 via a midhaul link 234. The O-CU 240 may include an O-CU control plane (O-CU-CP) packet generator 240A and an O-CU user plane (O-CU-UP) packet generator 240B. The C-plane and U-plane packets may originate from the O-CU-CP packet generator 240A and the O-CU-UP packet generator 240B, respectively.

[0047] FIG. 3 illustrates an example of a high-level RIC architecture 300 with xApp deployment. The high-level RIC architecture can include a service management and orchestration (SMO) layer 302, a near-RT RIC layer 304, an artificial intelligence / machine learning (AI / ML) framework layer 306, and a node layer 308. The SMO layer 302A can include a non-RT RIC 302A. The near-RT RIC layer 304 can include xApps, such as xApp1 through xAppN. The near-RT RIC layer 304 can also include a RIC platform 304A that includes one or more services (e.g., message services, subscription management, API services, management services, databases, E2 termination, etc.) as well as an SMCF 304A_1. The near-RT RIC layer 304 can interface with the SMO layer 302 via an A1 interface. The node layer 308 may correspond to an E2 node and may include an O-DU 308A, an O-CU-UP 308B, and an O-CU-CP 308C, which may correspond to the O-DU 230, the O-CU-CP 240A, and the O-CU-UP 240B, respectively. The node layer 308 may interface with the near-RT-RIC layer 304 via an E2 interface. The AI / ML framework layer 306 may include a database 306A for storing events, metrics, and collection logs.

[0048] FIG. 4 illustrates an example RIC platform 400 including a node 402 and an AI / ML framework 404. The AI / ML framework 404 may correspond to the AI / ML framework layer 306 (FIG. 3). The node 402 may include several pods, such as pod 402A, pod 402B, and pod 402C. The pod 402A may correspond to a compromised xApp attacked by a malicious actor 406. The pod 402B may include an SMCF, which may correspond to the SMCF 304A_1. In some embodiments, when an attack is detected, the affected application may be isolated. For example, the xApp corresponding to the pod 402A may be isolated from other xApps.

[0049] RIC platform 400 may also include a container network interface (CNI) agent 402D. In some embodiments, the SMCF uses a CNI agent, such as CNI agent 402D, to collect properties of each application (e.g., a RIC xApp). These application properties may include the application's ID (e.g., container ID), service, the corresponding pod / container's running process, and existing network policies.

[0050] Pod 402B can deploy eBPF 402E and / or eBPF 402F. eBPF 402E can include packet filtering options to drop or pass packets based on packet inspection. eBPF 402F can include file system operation functions to block unauthorized file system operations. eBPF 402E and eBPF 402F can communicate with map eBPF 402G. For example, eBPF 402E can read packet counts from map eBPF 402G based on protocol type and source / destination ports, which can be used to detect anomalous behavior in incoming network traffic. Pod 402B (SMCF) can create and update map eBPF 402G. Pod 402B (SMCF) can further read data / information from map eBPF 402G for offline analysis. In some embodiments, eBPF programs can be updated in real time. For example, after an eBPF program is deployed, if any of the application properties it reads change (e.g., the list of blacklisted ports is changed), the eBPF program can be updated in real time. Thus, the eBPF can be dynamically updated with policies or rules.

[0051] In some embodiments, if an eBPF program (such as eBPF 402E) detects any anomaly or sudden spike in network traffic or resource consumption, the eBPF program can apply enforcement rules or prepare policies in real time to mitigate or take preventative action if the attack is detected as a volumetric attack. In some embodiments, an eBPF program (such as eBPF 402E) can include an eBPF eXpress Data Path (XDP) program, which can parse incoming IP packets, check characteristics such as IP transport, protocol type, port, and target subnet, and validate against static blacklisted IP addresses / subnets and ports to detect volumetric attacks. For example, an eBPF program may be configured with a list of blacklisted protocol types or ports, and an attack is detected if an incoming packet specifies a protocol type or port included in the blacklist. Once an attack is detected, the eBPF program can take mitigation or preventative action, such as dropping the inspected packet. Exemplary instructions implemented by the eBPF XDP program for such detection and handling of volumetric attacks are presented below. if(h_proto==htons(ETH_P_IP)) if(iph->protocol==IPPROTO_UDP / / Protocol type-TCP or UDP &&udph->dest==htons(1243))&&udph->src==htons(2432)){ return XDP_DROP; } }

[0052] In the above example, the blacklist may specify that the packet should be dropped if it is an Ethernet packet, specify the UDP protocol, specify the destination port as "1234", and specify the source port as "2432". Thus, in the above example, a value of "XDP_DROP" is returned, indicating that the inspected packet should be dropped.

[0053] For a particular volume measurement, the loaded eBPF program may count and classify incoming packets based on destination / source ports and protocol type, and periodically (e.g., every 500 ms) check whether the counter value exceeds a maximum threshold limit. If the counter value exceeds the maximum limit, an associated filter rule may be applied to block / drop the target packet. As an example, a volume attack may be detected if a large number of inspected packets are received within a predefined period. As another example, a volume attack may be detected if a number of inspected packets with a particular destination / source port and / or protocol type are received within a predefined period.

[0054] In some embodiments, the eBPF program may be extended to collect measurements such as packet drop counts and packet counts with specific ports and / or protocol types. Volumetric attack detection may be performed as follows. MAX_THRESHOLD_LIMIT=10000.if(iph->protocol==IPPROTO_UDP &&udph->dest==htons(1243))&&counter>=MAX_THRESHOLD_LIMIT){ return XDP_DROP; }

[0055] In the above example, if the number of packets specifying UDP protocol and destination port as "1234" exceeds a threshold limit (e.g., MAX_THRESHOLD_LIMIT) of 10000 within a given period of time, a volumetric attack is detected and a value of "XDP_DROP" is returned indicating that one or more packets should be dropped. The threshold is not fixed and may be adjusted to an appropriate value as needed. The protocol type may be TCP or UDP.

[0056] In some embodiments, with respect to file system operations, if detection rules are added to monitor events when a system file is intended to be modified / updated with false information, an eBPF program such as eBPF402F can detect and apply rules to block / terminate the file system operation. For example, if the file system operation involves an unknown process or modifies a file with false information, an attack may be detected. Detection of file system operation attacks can be performed as follows: if(file.open.path=='' / etc / shadow''&&file.process.path not in ['' / usr / bin / system'','' / usr / bin / docker'']){ Return-1 / / Block or Exit the operation if unknown process }

[0057] In the above example, processes associated with "system" and "docker" may be specified in the list of known processes. Thus, if a file system operation specifies a process other than "system" or "docker," an attack may be detected and the file system operation may be blocked or terminated.

[0058] In some embodiments, process execution events may be detected and blocked by adding detection rules for select or critical processes. The embodiments of the present disclosure ensure that the RAN RIC platform and applications are not adversely affected by volumetric attacks and recover immediately without compromising and impeding the core functionality of the system in near real-time. The SMCF, through its generated / configured and deployed eBPF program according to example embodiments, can detect and mitigate these attacks or take preventative action in near real-time within the latency requirements defined for the O-RAN near-RT RIC.

[0059] FIG. 5 is a flow chart illustrating one embodiment of an attack detection and mitigation process 500. Process 500 may be performed for each application onboarded on a RIC platform, such as RIC platform 304 (FIG. 3). Process 500 may be performed by device 100 (FIG. 1). Process 500 may begin at step S502, where onboarding of an application, such as xApp, may be detected. For example, onboarding of any of xApp1-xAppN (FIG. 3) may be detected. Proceeding to step S504, app properties of the application are retrieved. For example, the application properties may include an application ID, a list of blacklisted ports, a list of blacklisted transport protocols, a list of known processes, etc. In another example, the application properties may include a list of approved ports, a list of approved transport protocols, etc.

[0060] Proceeding to step S506, a protection program such as eBPF is deployed. The eBPF may correspond to eBPF 402E or eBPF 402F (FIG. 4). The eBPF may be configured based on the retrieved application properties. For example, if the retrieved properties include a list of approved ports, the eBPF may be configured to drop packets that specify ports that are not included in the list. Proceeding to S508, an application event is detected. The application event may correspond to receipt of a packet, a file system operation, or a network operation.

[0061] Proceeding to step S510, it is determined whether an attack is detected. Detection of an attack may be based on detection of anomalous application behavior, spikes in traffic within a predetermined time period, or improper file system operation. If an attack is detected, proceeding to step S512, the type of attack is determined. For example, the process may determine whether the attack is a volumetric attack or an improper file system operation. Proceeding to step S514, mitigation actions are performed. For example, mitigation actions may include dropping packets for volumetric attacks or blocking file system operations for file system attacks.

[0062] If no attack is detected in step S510, the process proceeds to step S516 where the application event is completed without any mitigation action being taken by the protection program. From step S514 or step S516, the process proceeds to step S518 where it is determined whether the application has been deboarded. If the application has not been deboarded, the process returns to step S508. If the application has been deboarded, the process illustrated in FIG. 5 ends.

[0063] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the implementations to the precise forms disclosed. Modifications and variations are possible in light of the above disclosure or may be acquired from practicing the implementations.

[0064] It is understood that the particular order or hierarchy of blocks in the processes / flowcharts disclosed herein is an example of an exemplary approach. Based on design preferences, it is understood that the particular order or hierarchy of blocks within the processes / flowcharts may be rearranged. Additionally, some blocks may be combined or omitted. Although the accompanying method claims present elements of various blocks in an exemplary order, the elements of the blocks are not limited to the particular order or hierarchy presented.

[0065] Some embodiments may relate to systems, methods, and / or computer-readable media at any possible level of technical detail integration. Furthermore, one or more of the above components described above may be implemented as instructions stored on a computer-readable medium and executable by at least one processor (and / or may include at least one processor). The computer-readable medium may include a computer-readable non-transitory storage medium(s) having computer-readable program instructions for causing a processor to perform operations.

[0066] A computer-readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge-in-groove structures with instructions recorded thereon, and any suitable combination of the foregoing. A computer-readable storage medium as used herein should not be construed as a transitory signal itself, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or an electrical signal transmitted over a wire.

[0067] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium into each computing / processing device, or downloaded to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0068] The computer readable program code / instructions for performing the operations may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or may be either source code or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform an aspect or operation.

[0069] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, whereby the instructions, executed via the processor of the computer or other programmable data processing apparatus, generate means for performing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium capable of directing a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions that perform aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0070] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to execute a series of operational steps to generate a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0071] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer-readable media according to various embodiments. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or part of instructions that includes one or more executable instructions for implementing the specified logical function. The methods, computer systems, and computer-readable media may include additional, fewer, different, or differently arranged blocks compared to the blocks shown in the figures. In some alternative implementations, the functions described in the blocks may be performed out of the order described in the figures. For example, two blocks shown in succession may actually be executed simultaneously or substantially simultaneously, or the blocks may sometimes be executed in the reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, as well as combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that executes the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0072] It will be apparent that the systems and / or methods described herein may be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods is not intended to limit the implementation. Thus, the operation and behavior of the systems and / or methods are described herein without reference to any specific software code, and it will be understood that software and hardware can be designed to implement the systems and / or methods based on the description herein.

[0073] The above disclosure also encompasses the embodiments listed below.

[0074] (1) A method executed by at least one processor, the method including: detecting onboarding of an application; in response to the detection, determining one or more application properties of the application; generating a protection program based on the one or more application properties; and deploying the protection program, wherein the protection program provides a mitigation action in response to detection of an attack against the application.

[0075] (2) The method of feature (1), wherein detecting an attack against the application includes inspecting the received packet by a protection program, and the mitigation action includes dropping the received packet in response to detecting the attack based on the inspection.

[0076] (3) The method of feature (2), wherein the application properties include a list of ports, and detection of the attack occurs in response to determining, based on the inspection, that the received packet specifies a port that is not included in the list of ports.

[0077] (4) The method of any one of (2) to (4), wherein the application properties include a list of transport protocols, and wherein detecting the attack is performed in response to determining, based on the inspection, that the received packet specifies a transport protocol that is not included in the list of transport protocols.

[0078] (5) The method of feature (2), wherein the application properties include a list of target subnets, and detecting the attack is in response to determining, based on the inspection, that the received packet specifies a target subnet that is not included in the list of target subnets.

[0079] (6) A method according to any one of features (1) to (5), wherein the one or more application properties include a list of predetermined processes for the application, and detecting an attack against the application is performed in response to detecting execution of a process not included in the list of predetermined processes, and the mitigation action includes blocking processes not included in the list of predetermined processes.

[0080] (7) A method according to any one of features (1) to (6), wherein the one or more application properties include a list of approved changes to the application, and wherein detecting an attack on the application is performed in response to detecting a change to the application that is not included in the list of approved changes, and wherein the mitigation action includes blocking changes to the application that are not included in the list of approved changes.

[0081] (8) The method of any one of features (1) to (7), wherein detecting an attack against the application is performed in response to detecting a number of packets received within a time period that exceeds a threshold, and the mitigation action includes blocking one or more packets received within the time period.

[0082] (9) The method according to feature (8), wherein detecting an attack on an application is performed in response to detecting that a large number of packets having a predetermined destination and source exceed a threshold value within a period of time.

[0083] (10) The method of feature (8), wherein detecting an attack on the application is performed in response to detecting receiving a number of packets having a predetermined protocol type in excess of a threshold within a time period.

[0084] (11) The method of any one of features (1) to (10), further comprising the steps of determining new properties of the application after deploying the protection program and adjusting one or more rules of the protection program.

[0085] (12) The method of any one of features (1) to (11), further comprising deleting the protected program in response to determining that the application has been deleted.

[0086] (13) The method according to any one of features (1) to (12), wherein the protection program is an extended Berkley Packet Filter (eBPF).

[0087] (14) A network node operating in a wireless communication network, the network node including at least one memory configured to store computer program code; and at least one processor configured to access the at least one memory and operate as instructed by the computer program code, the computer program code including: detection code configured to cause at least one of the at least one processor to detect onboarding of an application; determination code configured to cause the at least one of the at least one processor to determine one or more application properties of the application in response to the detection; generation code configured to cause the at least one of the at least one processor to generate a protection program based on the one or more application properties; and deployment code configured to cause the at least one of the at least one processor to deploy the protection program, the protection program providing a mitigation action in response to detection of an attack against the application.

[0088] (15) The network node of feature (14), wherein detecting an attack against the application includes a protection program inspecting the received packets, and the mitigation action includes dropping the received packets in response to detecting the attack based on the inspection.

[0089] (16) The network node of feature (15), wherein the application properties include a list of ports, and detection of the attack occurs in response to determining, based on the inspection, that the received packet specifies a port that is not included in the list of ports.

[0090] (17) The network node of feature (15), wherein the application properties include a list of transport protocols, and detection of the attack occurs in response to determining, based on the inspection, that the received packet specifies a transport protocol not included in the list of transport protocols.

[0091] (18) The network node of feature (15), wherein the application properties include a list of target subnets, and detection of the attack occurs in response to determining, based on the inspection, that the received packet specifies a target subnet that is not included in the list of target subnets.

[0092] (19) A network node according to any one of features (14) to (18), wherein the one or more application properties include a list of predetermined processes for the application, and wherein detecting an attack against the application occurs in response to detecting execution of a process not included in the list of predetermined processes, and wherein the mitigation action includes blocking processes not included in the list of predetermined processes.

[0093] (20) A non-transitory computer-readable medium having instructions stored therein that, when executed by a processor, cause the medium to perform a method including detecting onboarding of an application, determining one or more application properties of the application in response to the detection, generating a protection program based on the one or more application properties, and deploying the protection program, wherein the protection program provides a mitigation action in response to detecting an attack against the application.

Claims

1. 1. A method executed by at least one processor, comprising: Detecting application onboarding; determining one or more application properties of the application in response to said detecting; generating a protection program based on the one or more application properties; deploying the protection program; The method of claim 1, wherein the protection program provides a mitigation action in response to detecting an attack against the application.

2. 2. The method of claim 1 , wherein the detection of the attack against the application includes the protection program inspecting a received packet, and the mitigation action includes dropping the received packet in response to the detection of the attack based on the inspection.

3. 3. The method of claim 2, wherein the application properties include a list of ports, and the detection of the attack occurs in response to a determination based on the inspection that the received packet specifies a port that is not included in the list of ports.

4. 3. The method of claim 2, wherein the application properties include a list of transport protocols, and the detection of the attack occurs in response to a determination based on the inspection that the received packet specifies a transport protocol not included in the list of transport protocols.

5. 3. The method of claim 2, wherein the application properties include a list of target subnets, and the detection of the attack occurs in response to a determination based on the inspection that the received packet specifies a target subnet that is not included in the list of target subnets.

6. 2. The method of claim 1 , wherein the one or more application properties include a list of predetermined processes for the application, the detection of the attack against the application occurs in response to detecting execution of a process not included in the list of predetermined processes, and the mitigation action includes blocking the process not included in the list of predetermined processes.

7. 2. The method of claim 1 , wherein the one or more application properties include a list of approved changes to the application, the detection of the attack on the application occurs in response to detecting a change to the application that is not included in the list of approved changes, and the mitigation action includes blocking the changes to the application that are not included in the list of approved changes.

8. 2. The method of claim 1, wherein the detection of the attack against the application is in response to detecting a number of packets received within a time period that exceeds a threshold, and the mitigation action includes blocking one or more packets received within the time period.

9. 9. The method of claim 8, wherein the detection of the attack against the application is in response to detecting receipt of a number of packets exceeding a threshold having a predefined destination and source within a period of time.

10. 9. The method of claim 8, wherein the detection of the attack against the application is in response to detecting receiving more than a threshold number of packets having a predetermined protocol type within a period of time.

11. After deploying the protection program, determining new properties of the application; and adjusting one or more rules of the protection program.

12. The method of claim 1 , further comprising, in response to determining that the application has been deleted, deleting the protection program.

13. The method of claim 1 , wherein the protection program is an extended Berkley Packet Filter (eBPF).

14. 1. A network node operating in a wireless communication network, comprising: at least one memory configured to store computer program code; at least one processor configured to access the at least one memory and to operate as instructed by the computer program code, the computer program code comprising: detection code configured to cause at least one of the at least one processor to detect onboarding of an application; determination code configured to, in response to the detection, cause at least one of the at least one processor to determine one or more application properties of the application; generation code configured to cause at least one of the at least one processor to generate a protected program based on the one or more application properties; and a deployment code configured to cause at least one of the at least one processor to deploy the protected program; The protection program provides a mitigation action in response to detecting an attack on the application.

15. 15. The network node of claim 14, wherein the detection of the attack against the application includes the protection program inspecting a received packet, and the mitigation action includes dropping the received packet in response to the detection of the attack based on the inspection.

16. 16. The network node of claim 15, wherein the application properties include a list of ports, and the detection of the attack is in response to a determination based on the inspection that the received packet specifies a port not included in the list of ports.

17. 16. The network node of claim 15, wherein the application properties include a list of transport protocols, and the detection of the attack occurs in response to a determination based on the inspection that the received packet specifies a transport protocol not included in the list of transport protocols.

18. 16. The network node of claim 15, wherein the application properties include a list of target subnets, and the detection of the attack is in response to a determination based on the inspection that the received packet specifies a target subnet that is not included in the list of target subnets.

19. 15. The network node of claim 14, wherein the one or more application properties include a list of predefined processes for the application, the detection of the attack against the application is in response to detecting execution of a process not included in the list of predefined processes, and the mitigation action includes blocking the processes not included in the list of predefined processes.

20. A non-transitory computer-readable medium having instructions stored therein that, when executed by a processor, cause the processor to: Detecting application onboarding; determining one or more application properties of the application in response to said detecting; generating a protection program based on the one or more application properties; deploying the protection program; The protection program provides a mitigation action in response to detecting an attack on the application.

Images