Rogue access point detection using segmental TCP jitter

ABSTRACT

Rogue Access Points (RAPs) pose serious security threats to local networks. An analytic model of prior probability distribution of Segmental TCP Jitter (STJ) is deduced from the mechanism of IEEE 802.11 MAC Distributed Coordinated Function (DCF) and used to differentiate the types of wire and WLAN connections which is the crucial step for RAPs detecting. STJ as the detecting metric can reflect more the characteristic of 802.11 MAC than ACK-Pair since it can eliminate the delay caused by packet transmission. The experiment on an operated network shows the average detection ratio of the algorithm with STJ is more than 92.8% and the average detection time is less than 1s with improvement of 20% and 60% over the detecting approach of ACK-Pair respectively. Farther more no WLAN training trace is needed in the detecting algorithm.

REFERENCES

• 1: Beyah, S. Kangude. Rogue access point detection using temporal traffic characteristics. In: Proceedings of IEEE GLOBECOM'04, Dallas, Texas, USA, 2004:2271 2275
• 2: Wei Wei , Kyoungwon Suh , Bing Wang , Yu Gu , Jim Kurose , Don Towsley, Passive online rogue access point detection using sequential hypothesis testing with TCP ACK-pairs, Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, October 24-26, 2007, San Diego, California, USA [doi>10.1145/1298306.1298357]
• 3: Chad D. Mano , Andrew Blaich , Qi Liao , Yingxin Jiang , David A. Cieslak , David C. Salyers , Aaron Striegel, RIPPS: Rogue Identifying Packet Payload Slicer Detecting Unauthorized Wireless Hosts Through Network Traffic Conditioning, ACM Transactions on Information and System Security (TISSEC), v.11 n.2, p.1-23, March 2008 [doi>10.1145/1330332.1330334]
• 4: Wei Wei, Sharad Jaiswal, Jim Kurose, Don Towsley. Identifying 802.11 Traffic from Passive Measurements Using Iterative Bayesian Inference. In: Proceedings of IEEE INFOCOM'06, Barcelona, Catalunya, 2006: 1 12
• 5: Tickoo O, Sikdar B. Queueing analysis and delay mitigation in IEEE 802.11 random access MAC based wireless networks. In: Proceedings of IEEE INFOCOM'04, HongKong, 2004: 1404 1413

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network management

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network monitoring

General Terms:
Management, Measurement

Keywords:
analytic model, rogue ap, segmental tcp jitter, sequential hypothesis testing