Robust Detection of Unauthorized Wireless Access Points Export

@article{yan:detection, abstract = {Abstract Unauthorized 802.11 wireless access points (APs), or rogue APs, such as those brought into a corporate campus by employees, pose a security threat as they may be poorly managed or insufficiently secured. An attacker in the vicinity may easily get onto the internal network through a rogue AP, bypassing all perimeter security measures. Existing detection solutions do not work well for detecting rogue APs configured as routers that are protected by WEP, 802.11 i, or other security measures. In this paper, we describe a new rogue AP detection method to address this problem. Our solution uses a verifier on the internal wired network to send test traffic towards wireless edge, and uses wireless sniffers to identify rouge APs that relay the test packets. To quickly sweep all possible rogue APs, the verifier uses a greedy algorithm to schedule the channels for the sniffers to listen to. To work with the encrypted AP traffic, the sniffers use a probabilistic algorithm that only relies on observed wireless frame size. Using extensive experiments, we show that the proposed approach can robustly detect rogue APs with moderate network overhead. The results also show that our algorithm is resilient to congested wireless channels and has low false positives/negatives in realistic environments.}, author = {Yan, Bo and Chen, Guanling and Wang, Jie and Yin, Hongda}, citeulike-article-id = {5807969}, citeulike-linkout-0 = {http://dx.doi.org/10.1007/s11036-008-0109-6}, doi = {10.1007/s11036-008-0109-6}, journal = {Mobile Networks and Applications}, keywords = {80211, crawdad, dartmouth\_campus, security, wireless}, month = {August}, number = {4}, pages = {508--522}, posted-at = {2009-09-20 22:30:37}, priority = {2}, title = {Robust Detection of Unauthorized Wireless Access Points}, url = {http://dx.doi.org/10.1007/s11036-008-0109-6}, volume = {14}, year = {2009} }

TY - JOUR ID - yan:detection L3 - citeulike-article-id:5807969 N2 - Abstract Unauthorized 802.11 wireless access points (APs), or rogue APs, such as those brought into a corporate campus by employees, pose a security threat as they may be poorly managed or insufficiently secured. An attacker in the vicinity may easily get onto the internal network through a rogue AP, bypassing all perimeter security measures. Existing detection solutions do not work well for detecting rogue APs configured as routers that are protected by WEP, 802.11 i, or other security measures. In this paper, we describe a new rogue AP detection method to address this problem. Our solution uses a verifier on the internal wired network to send test traffic towards wireless edge, and uses wireless sniffers to identify rouge APs that relay the test packets. To quickly sweep all possible rogue APs, the verifier uses a greedy algorithm to schedule the channels for the sniffers to listen to. To work with the encrypted AP traffic, the sniffers use a probabilistic algorithm that only relies on observed wireless frame size. Using extensive experiments, we show that the proposed approach can robustly detect rogue APs with moderate network overhead. The results also show that our algorithm is resilient to congested wireless channels and has low false positives/negatives in realistic environments. IS - 4 JF - Mobile Networks and Applications EP - 522 TI - Robust Detection of Unauthorized Wireless Access Points VL - 14 SP - 508 KW - 80211 KW - crawdad KW - dartmouth_campus KW - security KW - wireless AU - Yan, Bo AU - Chen, Guanling AU - Wang, Jie AU - Yin, Hongda PY - 2009/August// UR - http://dx.doi.org/10.1007/s11036-008-0109-6 ER -