Rogue Access Point Detection through Statistical Analysis

Simple item page
dc.contributor.authorKanaujia, Swatien
dc.contributor.committeechairPark, Jung-Min Jerryen
dc.contributor.committeememberYang, Yalingen
dc.contributor.committeememberBuehrer, R. Michaelen
dc.contributor.departmentElectrical and Computer Engineeringen
dc.date.accessioned2014-03-14T21:35:53Zen
dc.date.adate2010-05-26en
dc.date.available2014-03-14T21:35:53Zen
dc.date.issued2010-05-05en
dc.date.rdate2010-05-26en
dc.date.sdate2010-05-09en
dc.description.abstractThe IEEE 802.11 based Wireless LAN (WLAN) has become increasingly ubiquitous in recent years. However, due to the broadcast nature of wireless communication, attackers can exploit the existing vulnerabilities in IEEE 802.11 to launch various types of attacks in wireless and wired networks. This thesis presents a statistical based hybrid Intrusion Detection System (IDS) for Rogue Access Point (RAP) detection, which employs distributed monitoring devices to monitor on 802.11 link layer activities and a centralized detection module at a gateway router to achieve higher accuracy in detection of rogue devices. This detection approach is scalable, non-intrusive and does not require any specialized hardware. It is designed to utilize the existing wireless LAN infrastructure and is independent of 802.11a/b/g/n. It works on passive monitoring of wired and wireless traffic, and hence is easy to manage and maintain. In addition, this approach requires monitoring a smaller number of packets for detection as compared to other detection approaches in a heterogeneous network comprised of wireless and wired subnets. Centralized detection is done at a gateway router by differentiating wired and wireless TCP traffic using Weighted Sequential Hypothesis Testing on inter-arrival time of TCP ACK-pairs. A decentralized module takes care of detection of MAC spoofing and totally relies on 802.11 beacon frames. Detection is done through analysis of the clock skew and the Received Signal Strength (RSS) as fingerprints using a naïve Bayes classifier to detect presence of rogue APs. Analysis of the system and extensive experiments in various scenarios on a real system have proven the efficiency and accuracy of the approach with few false positives/negatives and low computational and storage overhead.en
dc.description.degreeMaster of Scienceen
dc.identifier.otheretd-05092010-222903en
dc.identifier.sourceurlhttp://scholar.lib.vt.edu/theses/available/etd-05092010-222903/en
dc.identifier.urihttp://hdl.handle.net/10919/42576en
dc.publisherVirginia Techen
dc.relation.haspartKanaujia_S_T_2010.pdfen
dc.rightsIn Copyrighten
dc.rights.urihttp://rightsstatements.org/vocab/InC/1.0/en
dc.subjectHypothesis Testen
dc.subjectIntrusion Detectionen
dc.subjectRogue Access Pointen
dc.subjectIEEE 802.11en
dc.subjectNaïve Bayes Classifiersen
dc.titleRogue Access Point Detection through Statistical Analysisen
dc.typeThesisen
thesis.degree.disciplineElectrical and Computer Engineeringen
thesis.degree.grantorVirginia Polytechnic Institute and State Universityen
thesis.degree.levelmastersen
thesis.degree.nameMaster of Scienceen

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Kanaujia_S_T_2010.pdf
Size:
1.19 MB
Format:
Adobe Portable Document Format
Download

Collections

Masters Theses