Multilayer Statistical Intrusion Detection in Wireless Networks

Abstract

The rapid proliferation of mobile applications and services has introduced new vulnerabilities that do not exist in fixed wired networks. Traditional security mechanisms, such as access control and encryption, turn out to be inefficient in modern wireless networks. Given the shortcomings of the protection mechanisms, an important research focuses in intrusion detection systems (IDSs). This paper proposes a multilayer statistical intrusion detection framework for wireless networks. The architecture is adequate to wireless networks because the underlying detection models rely on radio parameters and traffic models. Accurate correlation between radio and traffic anomalies allows enhancing the efficiency of the IDS. A radio signal fingerprinting technique based on the maximal overlap discrete wavelet transform (MODWT) is developed. Moreover, a geometric clustering algorithm is presented. Depending on the characteristics of the fingerprinting technique, the clustering algorithm permits to control the false positive and false negative rates. Finally, simulation experiments have been carried out to validate the proposed IDS.

Physical layer identification: methodology, security, and origin of variation

“…While the identification schemes reviewed so far have focused on the physical layer exclusively, a multi-layer framework for intrusion detection was recently proposed in [28]. Focusing on 802.11b and Bluetooth devices, the maximal overlap discrete wavelet transform was used to extract the transient; geometric unsupervised classification was then used on features extracted from the transient using a sliding window, in the time and frequency domains.…”

“…We would also like to point out that several other authors also appear to assume a closed world in their work [25][26][27]36]. A valid threshold-based approach is given in [24,30,32], and while [23,28] seem to make use of thresholds, more information on their derivation is needed before a final judgement can be made as to their validity.…”