US 12,333,012 B2
Apparatuses, methods, and computer programs for detecting an impostor system
Anusha Pradeep Mujumdar, Bangalore (IN); Vijaya Yajinanarayana, Bangalore (IN); Senthamiz Selvi Arumugam, Solna (SE); and Ramamurthy Badrinath, Karnataka (IN)
Assigned to TELEFONAKTIEBOLAGET LM ERICSSON (PUBL), Stockholm (SE)
Appl. No. 17/776,700
Filed by Telefonaktiebolaget LM Ericsson (publ), Stockholm (SE)
PCT Filed Nov. 15, 2019, PCT No. PCT/IN2019/050843
§ 371(c)(1), (2) Date May 13, 2022,
PCT Pub. No. WO2021/095044, PCT Pub. Date May 20, 2021.
Prior Publication US 2022/0398318 A1, Dec. 15, 2022
Int. Cl. G06F 21/00 (2013.01); G06F 18/22 (2023.01); G06F 21/57 (2013.01); H04L 9/40 (2022.01)
CPC G06F 21/57 (2013.01) [G06F 18/22 (2023.01); H04L 63/1408 (2013.01); H04L 63/1433 (2013.01)] 13 Claims
OG exemplary drawing
 
1. A method for detecting whether a first system should be declared as an impostor, the method comprising:
obtaining baseline system output information that was generated based on first system input, wherein the first system input comprises a plurality of input features;
obtaining first system output information generated by the first system based on the first system's exposure to the first system input, wherein
obtaining the first system output information comprises exposing the first system to the first system input and then collecting data from the first system,
the first system is a network traffic monitoring function for monitoring network traffic, and
exposing the first system to the first system input comprises generating simulated network traffic and exposing the network traffic monitoring function to the simulated network traffic;
determining a first similarity measure that indicates a similarity between the baseline system output information and the first system output information generated by the first system; and
using the first similarity measure, determining whether or not to declare the first system as an impostor.