Apparatus and Method for Detecting a Multi-Homed Device Using Clock Skew
Loading...
Authors
Martin, Bryan J.
Tummala, Murali
McEachen, John C.
Subjects
Advisors
Date of Issue
2018-08-14
Date
Publisher
United States Patent and Trademark Office (USPTO)
Language
Abstract
The disclosure provides an apparatus and method for the detection of multi-homed hosts on a computer network utilizing a network comprising a plurality of host computers and a central host. Each host computer has one or more network interfaces and transmits TCP packets over the network to the other hosts and the central host. The central host monitors exchanged traffic and sorts received timestamped TCP packets by source address, and utilizes the sorted packets to determine a clock skew associated with each source address. Generally the host computer conducts this process over multiple iterations and provides a representative clock skew, with the representative clock skew typically bounded by a confidence interval determined through probability distribution fitting. The apparatus and method compares the representative clock skews to determine similarity and identify potentially multi-homed hosts.
Type
Patent
Description
Series/Report No
Patents
Department
Organization
Research and Sponsored Programs Office (RSPO)
Identifiers
US 10,050,731 B1
NPS Report Number
Sponsors
Funding
Format
22 p.
Citation
Distribution Statement
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.