TCP Session Hijacking Detection Through Sequence Variation Baselines

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems struggle to effectively detect Transmission Control Protocol (TCP) session hijacking attacks, which can disrupt network operations by allowing malicious third parties to spoof packets and gain control over communication sessions.

Innovation Solution

A method and system that monitor TCP sessions for nonsequential packets with varying sequence numbers, calculate variation metrics over time intervals, and detect hijacking attacks by identifying deviations from established baselines using predictive analytics and cross-correlation techniques.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional packet spoofing detection methods are used, then detection simplicity is maintained, but detection precision deteriorates due to inability to reliably distinguish spoofed packets from genuine packets

Engineering Contradiction:

Improvedetection precisionVSAvoiddetection complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system performs preliminary actions by establishing a baseline of normal sequence number variation patterns before detecting attacks. It calculates expected sequence number variations during normal operation and uses this baseline to identify anomalies, enabling more precise detection without requiring complex real-time analysis of each packet

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces traditional mechanical packet inspection methods with statistical analysis of sequence number patterns. Instead of examining individual packet contents or relying on simple checksums, the system uses probabilistic models to analyze sequences of sequence numbers, substituting mathematical statistics for conventional detection mechanisms

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If comprehensive packet analysis is performed to improve detection reliability, then detection reliability improves, but processing time increases

Engineering Contradiction:

Improvedetection reliabilityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system extracts only the essential feature needed for detection - the sequence number pattern - from the complete packet data. By focusing solely on sequence number variations rather than analyzing entire packet contents, it achieves reliable attack detection while minimizing processing time

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies partial action by performing analysis on a subset of packets (focusing on sequence numbers) rather than comprehensive analysis of all packet attributes. This selective approach maintains detection reliability for sequence-based attacks while reducing overall processing burden

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If strict sequence number validation is applied, then detection precision improves, but false positive rate increases due to legitimate out-of-order packets

Engineering Contradiction:

Improvedetection precisionVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The system changes the detection parameter from binary sequence validation (in-order/out-of-order) to continuous measurement of sequence number variation magnitude. By analyzing the degree of variation rather than simply detecting deviations, it can distinguish between normal out-of-order delivery and attack patterns with higher precision while reducing false positives

Inventive Principle:

Principle #35Parameter changes

4Speed

If real-time detection is implemented, then response speed improves, but computational complexity increases

Engineering Contradiction:

Improvedetection speedVSAvoidcomputational complexity

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The patent uses computationally inexpensive sequence number measurements that can be discarded and recalculated for each time window. Instead of maintaining complex long-term state information, it uses simple, disposable measurements of sequence number variations over short intervals, enabling real-time detection with minimal computational overhead

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS12388844B2Detecting a TCP session hijacking attack

Publication Date: 2025.08.12 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

A computing system (500) is configured to detect a Transmission Control Protocol (TCP) session hijacking attack on a TCP session. In particular, the computing system monitors for nonsequential packets of the TCP session. The nonsequential packets each comprise a sequence number (220) that is different from a next expected sequence number of the TCP session. The computing system (500) calculates, for each of a plurality of time intervals, a variation metric representing an extent to which the sequence numbers (220) of the nonsequential packets received in the time interval differ from the next expected sequence number. The computing system determines a variation baseline representing a trend of the variation metrics over time, and detects the TCP session hijacking attack on the TCP session based on the variation metric in a given time interval being different from the variation baseline by less than a threshold.