Detecting unauthorized tethering

摘要

In systems and methods of detecting a wireless device utilizing unauthorized tethering, it is determined that a number of wireless devices in active communication with the access node meets a connections criteria, and that an access node loading meets a loading criteria. Packets received at the access node from the wireless devices are inspected to identify at least one short-lived data flow and a source wireless device of the at least one short-lived data flow. It is determined for the source wireless device a number of short-lived data flows during an observation time period, and the source wireless device is identified as performing unauthorized tethering when the number of short-lived data flows during the first time period meets a data flow threshold.

主权项

1. A method of detecting unauthorized tethering by a wireless device, comprising:
determining that a number of wireless devices in active communication with an access node meets a connections criteria, and that an access node loading meets a loading criteria; inspecting packets received at the access node from the wireless devices to identify at least one short-lived data flow and a source wireless device of the at least one short-lived data flow, wherein the at least one short-lived data flow comprises a plurality of packets such that a number of packets for the short-lived data flow is smaller than a number of packets for a long-lived data flow; determining for the source wireless device a number of short-lived data flows during an observation time period; and identifying the source wireless device as performing unauthorized tethering when the number of short-lived data flows during the first time period meets a data flow threshold.