An Intelligent Approach to Detect Probe Request Attacks in IEEE 802.11 Networks

Abstract

Abstract. In Wireless Local Area Networks (WLAN), beacon, probe request and response messages are unprotected, so the information is visible to sniffers. Probe requests can be sent by anyone with a legitimate Media Access Control (MAC) address, as association to the network is not required at this stage. Legitimate MAC addresses can be easily spoofed to bypass Access Point (AP) access lists. Attackers take advantage of these vulnerabilities and send a flood of probe request frames which can lead to a Denial-of-Service (DoS) to legitimate stations. This paper discusses an intelligent approach to recognise probe request attacks in WLANs. The research investigates and analyses WLAN traffic captured on a home wireless network, and uses supervised feedforward neural network with 4 input neurons, 2 hidden layers and an output neuron to determine the results. The computer simulation results demonstrate that this approach improves detection of MAC spoofing and probe request attacks considerably.

Improved Detection of Probe Request Attacks - Using Neural Networks and Genetic Algorithm

“…The regression value of the final GA was 0.97682, which outperforms or similar to current research in the field of WIDS. However, GA did not reach the R value 0.98043 obtained in Ratnayake et al (2011) as it never simulated with exact combination of NN structural values. However, the minimum regression value 0.96101 suggests that this NN model can be applied to unseen data successfully.…”

“…capturing of training data (used for training, validation and testing of NN) and simulation data were from a real home WLAN. However, the GA never reached the R value obtained in (Ratnayake et al, 2011). Population of trainVal, validVal, and testVal and NeuL1 were between 1-62, 1-86, 7-88 and 1-30 respectively, whereas (Ratnayake et al, 2011) used 70, 15, 15 and 20 respectively (Table 1).…”

“…However, the GA never reached the R value obtained in (Ratnayake et al, 2011). Population of trainVal, validVal, and testVal and NeuL1 were between 1-62, 1-86, 7-88 and 1-30 respectively, whereas (Ratnayake et al, 2011) used 70, 15, 15 and 20 respectively (Table 1). Hence, although all the regression results are very close to global optimality and ideal fitness value of 1, it is reasonable to suggest that the GA could be further improved.…”

“…The initial design divided the data sample and used 70% of the data to train the network and 15% each for validation and testing respectively. Levenberg-Marquardt back propagation algorithm was utilised for training (Ratnayake et al, 2011). The results are shown in Table 1.…”

“…The parallel architecture facilitates high response and computational times. These make NNs a perfect candidate for application of wireless attack detection in real world complex environments (Karygiannis and Owens, 2002); (Landau and Taylor, 1997); (Ratnayake et al, 2011); (Zhang et al, 2008) In a previous empirical study by the authors (Ratnayake et al, 2011), an external attacker was identified by analysing the traffic generated from a user MAC address in a single frequency band of a WLAN. A supervised feed-forward NN with four distinct inputs, delta-time, sequence number, signal strength and frame sub-type is applied to identify and differentiate a genuine frame from a rogue frame.…”