NTP Spoofing Attack Detection on Time Servers with GNSS Sensors Based on Long Short-Term Memory Algorithm

The synchronization process in computer networks is a particularly important process for a variety of critical applications. This process is achieved by some network elements called time servers. Time servers are optimized to provide highly accurate timing data for a very large number of hosts in a network. Synchronisation data is obtained by servers from one of the primary timing sources such as GNSS (Global Navigation Satellite Systems), atomic clocks or international standards. Then, the time servers use the synchronization data from these sources to distribute it to the network using protocols such as NTP (Network Time Protocol) or PTP (Precision Time Protocol). One of the issues we propose to study is related to the effects caused by the manipulation of the timing data using various techniques. At the same time, we propose a solution based on machine learning algorithms to secure this process performed by time servers. Thus, in this paper, we will use a network topology synchronized by two time servers to analyze the effects generated by the NTP Spoofing attack. Furthermore, we will use the results to train the LSTM (Long Short-Term Memory) algorithm to detect and prevent the attack.