Abstract:The broadcast nature of wireless media makes WLANs easily attacked by rogue Access Points (APs) . Rogue AP attacks can potentially cause severe privacy leakage and financial loss. Hardware fingerprinting is the state-of-the-art technology to detect rogue APs since an attacker would find it difficult to set up a rogue AP with specific hardware fingerprints. However, existing hardware fingerprints not only depend on the AP but also depend on the client, significantly limiting their application scenarios. In this work, we investigate two novel client-agnostic fingerprints, which can be extracted using commercial off-the-shelf WiFi devices, to detect rogue APs. One is the power amplifier non-linearity fingerprint and the other is the frame interval distribution fingerprint . These two fingerprints remain consistent over time and space for the same AP but vary across different APs even with the same brand, model, and firmware. We use the fingerprint similarity between the candidate AP and the authorized AP for device authentication in typical indoor environments. We have also proposed a threshold-improved authentication scheme to improve the robustness of our system in dynamic environments. Our schemes can be implemented without modifying the infrastructural APs and can work well with new clients without rebuilding the fingerprint database. We evaluate our scheme in both in-lab and field scenarios, by analyzing 18 million WiFi packets. Results show that our scheme achieves an overall 96.55% positive detection rate and a 4.31% false alarm rate. Moreover, the threshold-improved authentication scheme can further reduce the false alarm rate by 13.0%-44.8% for dynamic environments.

Automatic Discovery of Protocol Signatures

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

Packet Payload Based Anomalous Network Intrusion Detection

Automatically Mining Application Signatures for Lightweight Deep Packet Inspection

AutoSig-Automatically Generating Signatures for Applications

Detecting Rogue Access Points Using Client-agnostic Wireless Fingerprints.

Harvesting unique characteristics in packet sequences for effective application classification

P2P Traffic Identification Based on the Signatures of Key Packets

Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach

A Methodology for P2P Traffic Measurement Using Application Signature Work-in-progress

Rethinking robust and accurate application protocol identification.

A Nonparametric Approach to the Automated Protocol Fingerprint Inference

The Automatic Peer-To-Peer Signature For Source Address Validation

A Method Based on AMHI for DDoS Attacks Detection and Defense

REVERSE AUTOMATED ANALYSIS OF APT TROJAN NETWORK PROTOCOL

BitMiner

SkyTracer: Towards fine-grained identification for Skype traffic via sequence signatures

Accelerating Application Identification with Two-Stage Matching and Pre-Classification

Protocol Reverse Engineering Using LDA and Association Analysis.

Protocol Specification Inference Based on Keywords Identification

Preventing IP Source Address Spoofing: A Two-Level, State Machine-Based Method