Anomaly Detection and Modeling in 802.11 Wireless Networks

Abstract

IEEE 802.11 Wireless Networks are getting more and more popular at university campuses, enterprises, shopping centers, airports and in so many other public places, providing Internet access to a large crowd openly and quickly. The wireless users are also getting more dependent on WiFi technology and therefore demanding more reliability and higher performance for this vital technology. However, due to unstable radio conditions, faulty equipment, and dynamic user behavior among other reasons, there are always unpredictable performance problems in a wireless covered area. Detection and prediction of such problems is of great significance to network managers if they are to alleviate the connectivity issues of the mobile users and provide a higher quality wireless service. This paper aims to improve the management of the 802.11 wireless networks by characterizing and modeling wireless usage patterns in a set of anomalous scenarios that can occur in such networks. We apply time-invariant (Gaussian Mixture Models) and time-variant (Hidden Markov Models) modeling approaches to a dataset generated from a large production network and describe how we use these models for anomaly detection. We then generate several common anomalies on a Testbed network and evaluate the proposed anomaly detection methodologies in a controlled environment. The experimental results of the Testbed show that HMM outperforms GMM and yields a higher anomaly detection ratio and a lower false alarm rate.

802.11 wireless simulation and anomaly detection using HMM and UBM

“…The analysis of the anomaly-related patterns performed in the present research inspired our work to re-generate similar anomalies in network simulator in addition to the real Testbed that was already done in our previous work. 8 The principal goal of the simulation and the real Testbed experiments is to evaluate the HMM anomaly detection methodologies proposed in the current work as well as our former studies. 7,8…”

“…8 The principal goal of the simulation and the real Testbed experiments is to evaluate the HMM anomaly detection methodologies proposed in the current work as well as our former studies. 7,8…”

“…The trace data consisted of the daily summary of the connections between hundreds of APs and their corresponding wireless stations (STAs). In Allahdadi and Morla 8 we deployed a real Testbed in small scale with one AP and six STAs using FreeRADIUS server, and generated a number of anomalies in a controlled environment for experimental purposes. In the current work we simulate a more extended Wireless Local Area Network (WLAN) with five APs and 30 STAs and set up several anomalous cases, including the ones in the previous work 8 and some new anomalies.…”

“…In Allahdadi and Morla 8 we deployed a real Testbed in small scale with one AP and six STAs using FreeRADIUS server, and generated a number of anomalies in a controlled environment for experimental purposes. In the current work we simulate a more extended Wireless Local Area Network (WLAN) with five APs and 30 STAs and set up several anomalous cases, including the ones in the previous work 8 and some new anomalies. We further improve our Hidden Markov Model (HMM) formerly proposed elsewhere 7,8 by integrating it with the concept of the Universal Background Model (UBM).…”

“…In the current work we simulate a more extended Wireless Local Area Network (WLAN) with five APs and 30 STAs and set up several anomalous cases, including the ones in the previous work 8 and some new anomalies. We further improve our Hidden Markov Model (HMM) formerly proposed elsewhere 7,8 by integrating it with the concept of the Universal Background Model (UBM). The simulation data are then utilized to evaluate HMM and HMM-UBM models and compare the anomaly detection results with baseline approaches (RawData and Principal Components Analysis (PCA)).…”