Methods and Devices for Defending a 3G Wireless Network Against Malicious Attacks

Abstract

Wireless state information collected or inferred from a 3G wireless network is used to detect and prevent malicious attacks against the network.

We claim: 
     
         1 . A method for detecting an attack against a wireless network comprising:
 Generating a profile based on non-attack, wireless traffic conditions;   obtaining wireless state information comprising wireless data channel set-up and release information and application based information; and   comparing the obtained information to the profile to determine whether an attack is directed at an element in the wireless network.   
     
     
         2 . The method as in  claim 1  further comprising preventing malicious traffic intended for a mobile device in the network from reaching the device when the comparison indicates an attack. 
     
     
         3 . The method as in  claim 1  wherein the state information is collected from one or more network elements in the network. 
     
     
         4 . The method as in  claim 1  wherein the state information is inferred from knowledge of the network. 
     
     
         5 . A device for detecting an attack against a wireless network operable to:
 generate a profile based on non-attack, wireless traffic conditions;   obtain wireless state information comprising wireless data channel set-up and release information and application based information; and   compare the obtained information to the profile to determine whether an attack is directed at an element in the wireless network.   
     
     
         6 . The device as in  claim 5  further operable to prevent malicious traffic intended for a mobile device in the network from reaching the device when the comparison indicates an attack. 
     
     
         7 . The device as in  claim 5  wherein the device is further operable to collect the state information from one or more elements in the network. 
     
     
         8 . The device as in  claim 5  wherein the device is further operable to infer state information from knowledge of the network. 
     
     
         9 . The method as in  claim 1  wherein the wireless state information further comprises time-based mobility activity information. 
     
     
         10 . The method as in  claim 1  wherein the wireless state information further comprises IP layer information. 
     
     
         11 . The method as in  claim 10  wherein the IP layer information comprises packet arrivals and information from IP/TCP application layer headers. 
     
     
         12 . The device as in  claim 5  wherein the wireless state information further comprises time-based mobility activity information. 
     
     
         13 . The device as in  claim 5  wherein the wireless state information further comprises IP layer information. 
     
     
         14 . The device as in  claim 13  wherein the IP layer information comprises packet arrivals and information from IP/TCP application layer headers.