Enhancing the security of corporate Wi-Fi networks using DAIR

Bahl, Paramvir; Chandra, Ranveer; Padhye, Jitendra; Ravindranath, Lenin; Singh, Manpreet; Wolman, Alec; Zill, Brian

doi:10.1145/1134680.1134682

Cited by 100 publications

(85 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A passive method that a client could use for detecting the presence of fake APs was presented by Bahl et al [4]. In particular, they used the anomaly in successive sequence numbers seen in beacon frames from the real and fake APs to detect the fake AP.…”

Section: Related Workmentioning

confidence: 99%

On the reliability of wireless fingerprinting using clock skews

Arackaparambil

Bratus

Shubina

et al. 2010

Proceedings of the Third ACM Conference on Wireless Network Security

View full text Add to dashboard Cite

Determining whether a client station should trust an access point is a known problem in wireless security. Traditional approaches to solving this problem resort to cryptography. But cryptographic exchange protocols are complex and therefore induce potential vulnerabilities in themselves. We show that measurement of clock skews of access points in an 802.11 network can be useful in this regard, since it provides fingerprints of the devices. Such fingerprints can be used to establish the first point of trust for client stations wishing to connect to an access point. Fingerprinting can also be used in the detection of fake access points.We demonstrate deficiencies of previously studied methods that measure clock skews in 802.11 networks by means of an attack that spoofs clock skews. We then provide means to overcome those deficiencies, thereby improving the reliability of fingerprinting. Finally, we show how to perform the clock-skew arithmetic that enables network providers to publish clock skews of their access points for use by clients.

show abstract

Section: Related Workmentioning

confidence: 99%

On the reliability of wireless fingerprinting using clock skews

Arackaparambil

Bratus

Shubina

et al. 2010

Proceedings of the Third ACM Conference on Wireless Network Security

View full text Add to dashboard Cite

show abstract

“…Let denote the median inter-ACK time given these samples (we use median instead of mean since it is less sensitive to outliers in the measurements [25] 4 This value is larger than that of 100-Mb/s Ethernet, which is not surprising due to the following two reasons. First, while the raw data rate of an 802.11n connection in the UConn network is up to 144 Mp/s, much lower throughput is achieved in practice (even in idealized settings, the maximum throughput of 802.11n measured in [31] is below 100 Mp/s).…”

Section: Analytical Basismentioning

confidence: 99%

“…We use an indirect approach to infer the percentage of the WLAN traffic and the belief that a flow traverses a WLAN. Most studies on WLAN management rely on distributed monitors that monitor RF airwaves [3], [4], [13], [23], [30], [37], [38]. The rationale is that RF airwave monitoring provides detailed low-level (i.e., PHY and MAC) information that is critical for analyzing the behavior of a network and troubleshooting faults in a network.…”

Section: Related Workmentioning

confidence: 99%

“…In this section, we propose an iterative Bayesian inference algorithm that probabilistically classifies a set of observations into 4 The empirical result for each connection type is obtained from its corresponding training set (i.e., a set of flows that is known to use the connection type). The training set for 100-Mb/s Ethernet is constructed based on IP addresses (see Section VII).…”

Section: Iterative Bayesian Inference Algorithmmentioning

confidence: 99%

See 1 more Smart Citation

Identifying 802.11 Traffic from Passive Measurements Using Iterative Bayesian Inference

Wei

Jaiswal

Kurose

et al. 2006

Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications

View full text Add to dashboard Cite

Abstract-In this paper, we propose a classification scheme that differentiates Ethernet and WLAN TCP flows based on measurements collected passively at the edge of a network. This scheme computes two quantities, the fraction of wireless TCP flows and the degree of belief that a TCP flow traverses a WLAN inside the network, using an iterative Bayesian inference algorithm that we developed. We prove that this iterative Bayesian inference algorithm converges to the unique maximum likelihood estimate (MLE) of these two quantities. Furthermore, it has the advantage that it can handle any general -classification problem given the marginal distributions of these classes. Numerical and experimental evaluations demonstrate that our classification scheme obtains accurate results. We apply this scheme to two sets of traces collected from two campus networks: one set collected from UMass in mid 2005 and the other collected from UConn in late 2010. Our technique infers that 4%-7% and 52%-55% of incoming TCP flows traverse an IEEE 802.11 wireless link in these two networks, respectively. Index Terms-IEEE 802.11 wireless LAN, iterative Bayesian inference, TCP ACK-pairs, wireless traffic detection.

show abstract

“…This approach requires additional hardware for measurement, this can be viewed as a form of third-party solution. Such an approach is not new for example, DAIR [7], [8], Jigsaw [9], and Wit [10]. While these approaches provide many monitoring solutions, but do not provide any interference which is possible in the technique proposed.We are also able to detect the selfish behavior of the nodes .…”

mentioning

confidence: 99%

Application Based Passive Measurement of Interference in Misbehaviour Detection

P.RODGE¹,

KUSHWAHA²

2014

IJAREEIE

View full text Add to dashboard Cite

ABSTRACT:In this paper a tool to estimate the interference between nodes and links in a live wireless network by passive monitoring of wireless traffic has been proposed. This tool proposes the use of multiple sniffers being deployed across the network to capture wireless traffic trace thus does not requires any controlled experiments, injection of probe traffic in the network, or even access to the network nodes. Using machine learning approach these traces help to infer the carrier-sense relationship between network nodes. We are also able to detect selfish carrier-sense behavior.Experimental and simulation results demonstrate that the proposed approach of estimating interference relations is significantly more accurate than simpler heuristics and quite competitive with active measurements. We use ns2 simulation to also validate the approach in a real Wireless LAN environment. KEYWORDS: 802.11 protocol, hidden Markov model, MAC layer misbehavior, interference I.INTRODUCTIONA Highly loaded network experiences a poor WiFi performance [1], [2]. In this work a technique to model and understand the wireless interference between network nodes and links in realistic WiFi network deployments is being presented. The goal is to achieve this without installing any monitoring software on the network nodes using a completely passive technique because any active measurement affects the network traffic. To achieve these goals, our approach uses a distributed set of "sniffers" that capture and record wireless frame traces. We then analyze the trace to understand the interference relations. This approach requires additional hardware for measurement, this can be viewed as a form of third-party solution. Such an approach is not new for example, DAIR [7], [8], Jigsaw [9], and Wit [10]. While these approaches provide many monitoring solutions, but do not provide any interference which is possible in the technique proposed.We are also able to detect the selfish behavior of the nodes . A selfish node can gain unfair share of the available bandwidth by manipulating different MAC protocol parameters, and can results in more collisions and can other transmitters to back off . We can detect the selfish carrier-sense behavior using the pairwise interference relationships discovered by the proposed technique which had been discussed only in one paper [11], that provides a limited solution using a nonpassive technique. Figure 1 Overview of the approach II.SYSTEM MODEL AND ASSUMPTIONS

show abstract

Enhancing the security of corporate Wi-Fi networks using DAIR

Cited by 100 publications

References 12 publications

On the reliability of wireless fingerprinting using clock skews

On the reliability of wireless fingerprinting using clock skews

Identifying 802.11 Traffic from Passive Measurements Using Iterative Bayesian Inference

Application Based Passive Measurement of Interference in Misbehaviour Detection

Contact Info

Product

Resources

About