A computing system (500) is configured to detect a Transmission Control Protocol (TCP) session hijacking attack on a TCP session. In particular, the computing system monitors for nonsequential packets of the TCP session. The nonsequential packets each comprise a sequence number (220) that is different from a next expected sequence number of the TCP session. The computing system (500) calculates, for each of a plurality of time intervals, a variation metric representing an extent to which the sequence numbers (220) of the nonsequential packets received in the time interval differ from the next expected sequence number. The computing system determines a variation baseline representing a trend of the variation metrics over time, and detects the TCP session hijacking attack on the TCP session based on the variation metric in a given time interval being different from the variation baseline by less than a threshold.


    Access

    Download


    Export, share and cite



    Title :

    DETECTING A TCP SESSION HIJACKING ATTACK


    Additional title:

    ERKENNUNG EINES TCP-SITZUNGSVEREDELUNGSANGRIFFS
    DÉTECTION D´UNE ATTAQUE DE DÉTOURNEMENT DE SESSION TCP


    Contributors:

    Publication date :

    2024-01-31


    Type of media :

    Patent


    Type of material :

    Electronic Resource


    Language :

    English


    Classification :

    IPC:    H04L TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION , Übertragung digitaler Information, z.B. Telegrafieverkehr / B64D Ausrüstung für Flugzeuge , EQUIPMENT FOR FITTING IN OR TO AIRCRAFT



    DETECTING A TCP SESSION HIJACKING ATTACK

    TOSCANO ORAZIO | European Patent Office | 2022

    Free access


    Hijacking. Selected References

    A. O'Brien | NTIS | 1969


    Airplane anti-hijacking system

    LASKE JR JAMES WILLIAM | European Patent Office | 2018

    Free access

    The vehicle hijacking alarm system

    Liu, Xiaoming / Jiang, Shaozhong | IEEE | 2017