Patent Application
20060168193
The present invention generally relates to detecting incidents within a communications network and, more particularly, relates to profiling or fingerprinting network elements to detect hacker intrusions within a communications network.
Communications network security is not only critical today to diminish the impact of technical problems before communication is hindered but to counter attempts by hackers to sabotage communication. In today's environment each communications operating company needs to intimately know the structure of their communications network, for example signaling system 7 (SS7) networks, and make sure the network is secure in every respect. Communication companies that provide government communication services have an additional responsibility to provide an extra layer of security to counter threats to network functionality and/or privacy.
Many communications network incidents are not identified until it is too late and network processing has ceased. Even after problems are discovered it is often difficult to determine through investigation where the incident originated and how it developed. Thus, when a change occurs in the structure of message communications, previous systems do not have a way of proactively identifying the change and the origin of the change. There is a great deal of information on a communications network. Thus, administrators may unknowingly allow undetected and intruding information to be present within the network. Therefore without a way to detect information within a communications network and to know when there's an intruder, network communications remain vulnerable.
Accordingly there is an unaddressed need in the industry to address the aforementioned deficiencies and inadequacies.
Embodiments of the present invention provide methods, computer program products, and systems for detecting incidents within a communications network. A way to help in detecting a communications network attack/intrusion and in investigating an attack or incident, should one occur, is to establish a fingerprint of one or more network elements associated with the communications network, for instance a Signaling System 7 (SS7) Network. As defined herein the term fingerprint includes messages, responses, message signaling characteristics and parameters, and/or a point code of a network element associated with the communications network. Any time there is a network element without an existing fingerprint introduced or a change in an existing fingerprint, then action can be taken immediately.
One embodiment is a method for detecting an incident within a communications network. The communications network is associated with network elements. The method involves establishing a fingerprint for at least one of the network elements associated with the communications network. Each fingerprint established includes at least one message signaling characteristic and/or at least one message signaling parameter of a network element. The method also involves monitoring message communications within the communications network, comparing the message communications monitored to each fingerprint established, and determining whether a change to an established fingerprint and/or a network element without a fingerprint has been introduced within the communications network. The method may also involve providing notice of the change and/or network element without a fingerprint.
Still further, the method may involve establishing a fingerprint for each of the network elements by capturing messages sent from each of the network elements for each message type supported by a network element for which the fingerprint is being established, recording the messages captured as at least part of the fingerprint for that network element sending the message, and generating messages to the network elements. Additionally, the method may involve capturing responses to the messages generated from the network elements for each message type supported by a network element for which the fingerprint is being established, recording the responses captured as at least part of the fingerprint for that network element responding, and recording a unique point code for each network element as at least part of the fingerprint for that network element. Each fingerprint established is specific to a network element and specific to a function of the network element in the communications network.
Another embodiment is a computer program product including a computer-readable medium having control logic stored therein for causing a computer to detect an incident within a communications network where the communications network is associated with network elements. The control logic includes computer-readable program code for causing the computer to establish a fingerprint for at least one of the network elements associated with the communications network where each fingerprint established includes at least one message signaling characteristic and/or at least one message signaling parameter of one of the network elements. The control logic also includes computer-readable program code for causing the computer to monitor message communications within the communications network, compare the message communications monitored to each fingerprint established, and determine whether a change to at least one fingerprint established has been introduced within the communications network.
Still another embodiment is a system for detecting an incident within a communications network, wherein the communications network is associated with network elements. The system includes a computing apparatus operative to establish a fingerprint for at least one of the network elements associated with the communications network, monitor message communications within the communications network, compare the message communications monitored to each fingerprint established, and determine whether a change to at least one fingerprint established has been introduced within the communications network.
Other systems, computer program products, methods, features, and advantages of the present invention will be or become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description, be within the scope of the present invention, and be protected by the accompanying claims.
As described briefly above, embodiments of the present invention provide methods, systems, and computer program products for detecting incidents within a communications network. In the following detailed description, references are made to accompanying drawings that form a part hereof, and in which are shown by way of illustration specific embodiments or examples. These illustrative embodiments may be combined, other embodiments may be utilized, and structural changes may be made without departing from the spirit and scope of the present invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is defined by the appended claims and their equivalents.
Referring now to the drawings, in which like numerals represent like elements through the several figures, aspects of the present invention and the illustrative operating environment will be described.
Generally, program modules include routines, operations, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that the invention may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
It is advantageous to describe an illustrative operating environment in which the present invention may operate.
The PSTN also incorporates the AIN. Some of the AIN components are illustrated in
After a communications network attack incident has occurred, then fingerprints from before and after the incident can be compared to establish where in the communications network the incident originated. Communications network element fingerprinting as defined herein includes a process to identify specific signaling characteristics and signaling parameters of one or more network elements within the communications network, such as an SS7 Network, and then record each of these characteristics and parameters by network element. Also, the order of appearance of the characteristics and parameters may be important as each message is received. Each network element has unique signaling parameters and signaling characteristics associated with it based on each vendor's interpretation of the Telecordia Generic Requirements (GR) Signaling documents. Once these signaling parameters and characteristics are recorded, then a comparison may be executed on an hourly, daily, weekly, or monthly interval to verify no new network elements without a fingerprint have been introduced or no changes to any existing network element has occurred. The signaling parameters and characteristics may be recorded in raw ANSI SS7 format and in a spreadsheet. Fingerprinting each network element is one way to insure security and investigate incidents.
Referring still to
Each piece of terminating equipment in the PSTN is assigned a directory number. The terms “telephone directory number”, “telephone number”, and “directory number” are used herein in a manner consistent with its generally understood meaning of a number that is dialed or input by an originating or calling party at an originating station to reach a terminating station associated with the directory number. A directory number, typically a ten digit number, is commonly referred to as a “telephone number” and may be assigned to a specific telephone line.
Much of the intelligence, and the basis for many of the enhanced features of the network, resides in a local Service Control Point (SCP) 110 that has a database containing subscriber information, and is connected to a Signal Transfer Point (STP) 114 via an SS7 data A link 107. As is known to those skilled in the art, relatively powerful fault tolerant computers physically implement SCPs, such as SCP 110. Among the functions performed by the SCPs is maintenance of the network databases used in providing enhanced services and the execution of Service Package Applications (SPA).
In operation, the intelligent network elements of the operating environment 100, as described above, communicate with each other via digital data messages transmitted over the network of digital data links 107 and 108 which may include A, B, D, and/or F links. An SSP may be configured to interface with these network elements through the use of a terminating attempt trigger (TAT) (not shown). A trigger in the network is an event associated with a particular subscriber line or call that causes the SSP 112 to generate a data packet message to be sent to an SCP. It should be appreciated that the call reaching the TAT may originate from the telephone of a calling party, from a computer, from the Internet, or from other communications signal sending equipment.
The message created by the SSP 112 in response to the TAT is known as a “query” message. A query message opens a “transaction” and the SSP generally holds the communication until it receives a reply from an appropriate network element via the network of digital links instructing the SSP 112 to take action. If the SSP 112 receives no instructions with a certain amount of time, the SSP “times out” and executes a default task for the communication. The reply to the query message may be a “conversation” message or a “response” message. Conversation messages allow for bi-directional exchanges between network elements while the transaction remains open. A “response” message closes the transaction opened by the query message, and usually instructs the SSP 112 to route the held communication for connection with a terminating station. Query messages, conversation messages, and response messages are standard types of messages defined by the AIN protocol. The details of the AIN protocol are known to those skilled in the art and will not be further described herein.
A network message analyzer (NMA) 102 interfaces with signal transfer point (STP) 114 where all message signaling is processed via connectors 105 connected to A links 107 and B link 108. In certain networks, gateway STPs are used. Gateway STPs are components by which calls from outside the carrier network enter the carrier network and through which queries reach an SCP. An external STP 117 may send and receive messages to the communications network via the STP 114 by way of the B link 108. The NMA 102 monitors inbound and outbound messages to, from, and within the carrier network collecting data from protocol messages. The NMA 102 captures the information necessary to establish fingerprints of network elements associated with the communications network and monitors communications to detect incidents. When an incident occurs, the NMA 102 provides notice of the incident by transmitting an alarm to a network operations center 103 via a network 104, for example a TCP/IP network. Additional details regarding the NMA 102 will be describe below with respect to
The message analyzer application 224 establishes the fingerprints of the network elements, for example the SCP 110, the SSPs 112, the STP 114, and the external STP 117. The fingerprints are stored in a network element fingerprint database 230. Each fingerprint is specific to a network element and the network element's function in the communications network. Thus, SCP fingerprints 232, SSP fingerprints 234, and STP fingerprints 237 are stored in the database 230 and may be stored in the worksheet application 227. Additional details regarding establishing fingerprints and detecting incidents will be described below with respect to
The MSD 214 is connected to the CPU 208 through a mass storage controller (not shown) connected to the system bus 210. The MSD 214 and its associated computer-readable media, provide non-volatile storage for the NMA 102. Although the description of computer-readable media contained herein refers to a mass storage device, such as a hard disk or RAID array, it should be appreciated by those skilled in the art that computer-readable media can be any available media that can be accessed by the CPU 208.
An input/output controller/cradle 220 may also be included with the NMA 102 for receiving and processing input from a number of input devices such as the connectors 105. The input/output controller 220 communicates with the CPU 208 through the system bus 210.
The CPU 208 may employ various operations, discussed in more detail below with reference to
According to various embodiments of the invention, the NMA 102 operates in a networked environment, as shown in
A computing apparatus, such as the NMA 102, typically includes at least some form of computer-readable media. Computer readable media can be any available media that can be accessed by the NMA 102. By way of example, and not limitation, computer-readable media might comprise computer storage media and communication media.
Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, disk drives, a collection of disk drives, flash memory, other memory technology or any other medium that can be used to store the desired information and that can be accessed by the NMA 102.
Communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media. Computer-readable media may also be referred to as computer program product.
The SSP fingerprints 234 may include SSP fingerprints 304a-304n for each SSP associated with the communications network where n is the number of associated SSPs. An SSP 1 fingerprint 304a, as does each SSP fingerprint, includes a point code 332 identifying and distinguishing the SSP 1 network element from other network elements. The SSP 1 fingerprint 304a also includes Integrated Services Digital Network User Part (ISUP) type 317 messages such as initial address messages (IAM), address complete messages (ACM), answer messages (ANM), release messages (REL), release complete messages RLC, continuing check messages (COT), and exit message (EXM). The ISUP message type 317 is known in the art.
The SSP 1 fingerprint 304a also includes Message Transfer Part (MTP) type 318, for example level 3, messages such as link management messages 320, traffic management messages 322, and route management messages 324. The route management messages 324 may include transfer prohibits (TFP), transfer restrictions (TFR), transmission control protocol (TCP) and transaction confirmation report (TCR). The MTP message type 318 is known in the art. The SSP 1 fingerprint 304a also includes network, for example SS7, circuit management type 327 messages such as unassigned circuit identification code (CIC) messages and ISUP, circuit group blocking (CGB), and block (BLK) messages.
The STP fingerprints 237 may include STP fingerprints 307a-307n for each STP associated with the communications network where n is the number of associated STPs. An STP 1 fingerprint 307a, as does each STP fingerprint, includes a point code 342 identifying and distinguishing the STP 1 network element from other network elements. The STP 1 fingerprint 307a also includes the ISUP type 317 messages, the MTP type 318 messages, the TCAP type 314 messages, and the network circuit management type 327 messages describe above.
Referring now to
The routine 400 then continues to operation 404 where the NMA 102 monitors message communications within the communications network. The routine 400 then continues to operation 405 where the NMA 102 compares the monitored message communications to the established fingerprints to verify whether any changes to network elements that have established fingerprints have been introduced and/or whether any network elements without fingerprints have been introduced within the communications network. Comparing the message signaling characteristics of the message communications monitored to each fingerprint established may include comparing a sequence of signaling parameters and/or a quantity of signaling parameters to a sequence of signaling parameters recorded and/or a quantity of signaling parameters recorded in each fingerprint established. The routine 400 then continues to operation 407.
At operation 407, the NMA 102 determines whether a change to at least one network element having a fingerprint established has been introduced and/or whether a network element without a fingerprint has been introduced within the communications network. When no changes and/or network elements are detected at operation 407, the routine 400 continues to operation 410 where the NMA 102 determines whether a next monitor cycle is pending. The communications network may be monitored continuously or on a periodic basis, such as hourly, daily, monthly etc. When the next monitor cycle is pending, the routine 400 continues from operation 410 to operation 404 described above. When the next monitor cycle is not pending the routine 400 continues from operation 410 to return operation 412 where control is passed to other routines.
When at operation 407 a change and/or a network element without a fingerprint is detected, the routine 400 continues to operation 408. At operation 408 the NMA 102 provides notice of the change and or newly introduced network element. This notice may be in the form of an alarm transmission to the network operations center 103 via the network 104. The routine 400 then continues to return operation 412 described above.
Turning now to
The routine 500 then continues to operation 504 where the NMA 102 records the messages captured as at least part of the fingerprint for the network element sending the message captured. For example, in a SS7 network the recorded messages captured may include message signaling parameters such as calling and called telephone directory numbers, and a termination status for each captured message. The termination status refers to an indicator as to whether a monitored message is terminated or answered.
Next the routine 500 continues to operation 505 where the NMA 102 configures itself as an SSP. The routine 500 then continues to operation 507 where the NMA 102 generates messages as the configured SSP to at least one of the network elements, such as the SCP 110. The routine 500 then continues to operation 508.
At operation 508, the NMA 102 captures responses to the messages generated from at least one of the network elements. It should be appreciated that the captured messages and responses may be captured for each message type supported by an individual network element. For instance, the SCP 114 supports the TCAP 314 type message whereas in contrast the external STP 117 supports the TCAP 314, the ISUP 317, the MTP 318 level 3, and the network circuit management 327 type messages.
The routine 500 then continues to operation 510 where the NMA 102 records the responses captured as at least part of the fingerprint and records a unique point code associated with the network element as at least part of the fingerprint. The routine 500 then returns to operation 404 of
Thus, the present invention is presently embodied as methods, systems, computer program products or computer readable mediums encoding computer programs for detecting an incident within a communications network.
The above specification, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the spirit and scope of the invention, the invention resides in the claims hereinafter appended.
