Passive online rogue access point detection using sequential hypothesis testing with TCP ACK-pairs

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2007, Pages 365-378

  Wei, Wei ^a   Gu, Yu ^b   Suh, Kyoungwon ^c   Kurose, Jim ^b   Wang, Bing ^d   Towsley, Don ^b  

^a UNITED TECHNOLOGIES RESEARCH CENTER   (United States)

^b UNIVERSITY OF MASSACHUSETTS   (United States)

^c ILLINOIS STATE UNIVERSITY   (United States)

^d UNIVERSITY OF CONNECTICUT   (United States)

Author keywords

Rogue access point detection; Sequential hypothesis testing; TCP ACK pairs

Indexed keywords

ACCESS POINT (AP); ADAPTIVE (TCP) TRAFFIC; APPLIED (CO); CSMA/CA; EXCELLENT PERFORMANCE; FALSE NEGATIVES; FALSE POSITIVE (FP); FUNDAMENTAL PROPERTIES; HALF-DUPLEX; HEADER DATA; HYPOTHESIS TESTING; INTERNET MEASUREMENTS; LIGHT WEIGHTING; LOCAL NETWORKS; MAC PROTOCOLS; MONITORING POINTS; ON LINE ALGORITHMS; RAPID DETECTION; SECURITY THREATS; STORAGE OVERHEAD; TRAINING SETS; WIRELESS ACCESS POINTS (WAP); WIRELESS CHANNELS; WIRELESS HOSTS; WIRELESS LAN (WLAN);

ALGORITHMS; BOOLEAN FUNCTIONS; DIFFRACTIVE OPTICAL ELEMENTS; ELECTRONIC COMMERCE; FREQUENCY ALLOCATION; GATEWAYS (COMPUTER NETWORKS); INTERNET; INTERNET PROTOCOLS; LOCAL AREA NETWORKS; SEMICONDUCTING INTERMETALLICS; STORAGE (MATERIALS); TRANSMISSION CONTROL PROTOCOL; WELL EQUIPMENT; WIRELESS LOCAL AREA NETWORKS (WLAN);

ROUTING ALGORITHMS;

EID: 42149159995     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1298306.1298357     Document Type: Conference Paper

References (27)

1. AirDefense, Wireless LAN Security. http://airdefense.net.
2. AirMagnet. http://www.airmagnet.com.
3. AirWave, AirWave Management Platform. http://airwave.com.
4. Cisco Wireless LAN Solution Engine (WLSE). http://www.cisco.com/ en/US/products/sw/cscowork /ps3915/.
5. Host AP. http://hostap.epitest.fi.
6. http://www.endace.com.
7. Microsoft Windows 2000 TCP/IP implementation details, http://www.microsoft.com/technet/itsolu tions/network/deploy/depovg/tcpip2k .mspx.
8. NetStumbler. http://www.netstumbler.com.
9. Rogue Access Point Detection: Automatically Detect and Manage Wireless Threats to Your Network. http://www.proxim.com.
10. A. Adya, V. Bahl, R. Chandra, and L. Qiu. Architecture and techniques for diagnosing faults in ieee 802.11 infrastructure networks. In Proc. ACM MOBICOM, September 2004.
11. P. Bahl, R. Chandra, J. Padhye, L. Ravindranath, M. Singh, A. Wolman, and B. Zill. Enhancing the security of corporate Wi-Fi networks using DAIR. In Proc. ACM MOBISYS, 2006.
12. V. Baiamonte, K. Papagiannaki, and G. Iannaccone. Detecting 802.11 wireless hosts from remote passive observations. In Proc. IFIP/TC6 Networking, Atlanta, GE, May 2007.
13. R. Beyah, S. Kangude, G. Yu, B. Strickland, and J. Copeland. Rogue access point detection using temporal traffic characteristics. In Proc. IEEE GLOBECOM, Dec 2004.
14. G. Casella and R. L. Berger. Statistical Inference. Duxbury Thomson Learning, 2002.
15. L. Cheng and I. Marsic. Fuzzy reasoning for wireless awareness. International Journal of Wireless Information Networks, 8(1), 2001.
16. S. Garg, M. Kappes, and A. S. Krishnakumar. On the effect of contention-window sizes in IEEE 802.11b networks. Technical Report ALR-2002-024, Avaya Labs Research, 2002.
17. IEEE 802.11, 802.11a, 802.11b standards for wireless local area networks. http://standards.ieee.org/getieee802/802.11.html.
18. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan. Fast portscan detection using sequential hypothesis testing. In Proc. IEEE Symposium on Security and Privacy, May 2004.
19. C. Mano, A. Blaich, Q. Liao, Y. Jiang, D. Salyers, D. Cieslak, and A. Striegel. RIPPS: Rogue identifying packet payload slicer detecting unauthorized wireless hosts through network traffic conditioning. ACM Transactions on Information Systems and Security, to appear.
20. Packet trace analysis. http://ipmon.sprintlabs.com/packstat/ packetoverview.php.
21. P. Sarolahti and A. Kuznetsov. Congestion control in Linux TCP. In Proc. USENIX02, June 2002.
22. A. N. Shiryaev. Probability. Springer, 2nd edition.
23. K. Thompson, G. Miller, and R. Wilder. Wide-area Internet traffic patterns and characteristics. IEEE Network, 11(6):10-23, Nov./Dec. 1997.
24. A. Wald. Sequential Analysis. J. Wiley & Sons, 1947.
25. W. Wei, S. Jaiswal, J. Kurose, and D. Towsley. Identifying 802.11 traffic from passive measurements using iterative Bayesian inference. In Proc. IEEE INFOCOM, 2006.
26. W. Wei, B. Wang, C. Zhang, J. Kurose, and D. Towsley. Classification of access network types: Ethernet, wireless LAN, ADSL, cable modem or dialup? In Proc. IEEE INFOCOM, March 2005.
27. H. Yin, G. Chen, and J. Wang. Detecting Protected Layer-3 Rogue APs. In Proceedings of the Fourth IEEE International Conference on Broadband Communications, Networks, and Systems (BROADNETS), Raleigh, NC, September 2007.