Authors:
Kai Tao
;
Jing Li
and
Srinivas Sampalli
Affiliation:
Faculty of Computer Science, Dalhousie University, Canada
Keyword(s):
802.11 wireless networks, access point parameters, intrusion detection system, MAC address spoofing, operating system fingerprinting, received signal strength, sequence number tracking.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Intrusion Detection & Prevention
;
Wireless Network Security
Abstract:
MAC (Medium Access Control) address spoofing is regarded as an important first step in a hacker’s attempt to launch a variety of attacks on 802.11 wireless LANs. Unfortunately, MAC address spoofing is hard to detect. Most current spoofing detection systems mainly use the sequence number (SN) tracking technique, which has drawbacks. Firstly, it may lead to an increase in the number of false positives. Secondly, such techniques cannot be used in systems with wireless cards that do not follow standard 802.11 sequence number patterns. Thirdly, attackers can forge sequence numbers, thereby causing the attacks to go undetected. We present a new architecture called WISE GUARD (Wireless Security Guard) for detection of MAC address spoofing on 802.11 wireless LANs. It integrates three detection techniques – SN tracking, Operating System (OS) fingerprinting and tracking and Received Signal Strength (RSS) fingerprinting and tracking. It also includes the fingerprinting of Access Point (AP) para
meters as an extension to the OS fingerprinting for detection of AP address spoofing. We have implemented WISE GUARD on a test bed using off-the-shelf wireless devices and open source drivers. Experimental results show that the new design enhances the detection effectiveness and reduces false positives, in comparison with current approaches.
(More)