Lightweight MAC-spoof detection exploiting received signal power and median filtering

Abstract

Abstract. IEEE 802.11 networks are subject to MAC-spoof attacks. An attacker can easily steal the identity of a legitimate station, even Access Points, thus enabling him to take full control over network basic mechanisms or even access restricted resources. In this paper we propose a method to detect this kind of attack based on signal power monitoring. The main contribution of our work is the introduction of a median filter that enables the detection of the attack by looking at the variance of the signal power. We take into account two types of references for the samples, time and number of frames, and compare their detection capabilities. Our experimental results show that the spoofing attack is successfully detected with both type of references. Moreover the median filter helps to reject false positives.

Detecting Access Point Spoofing Attacks Using Partitioning-based Clustering

“…Several works have been proposed to separate the RSS sequences in order to detect the spoofing attack. The mechanisms include median filtering [10], normalization technique [11], Pearson correlation coefficient [12], Kmeans clustering [3,4] and K-medoids clustering [5]. In this work, we propose a client-centric AP spoofing detection framework by adapting the work undertaken in [3,4,5].…”