Detecting and Localizing Wireless Spoofing Attacks

Abstract

Abstract-Wireless networks are vulnerable to spoofing attacks, which allows for many other forms of attacks on the networks. Although the identity of a node can be verified through cryptographic authentication, authentication is not always possible because it requires key management and additional infrastructural overhead. In this paper we propose a method for both detecting spoofing attacks, as well as locating the positions of adversaries performing the attacks. We first propose an attack detector for wireless spoofing that utilizes K-means cluster analysis. Next, we describe how we integrated our attack detector into a realtime indoor localization system, which is also capable of localizing the positions of the attackers. We then show that the positions of the attackers can be localized using either area-based or point-based localization algorithms with the same relative errors as in the normal case. We have evaluated our methods through experimentation using both an 802.11 (WiFi) network as well as an 802.15.4 (ZigBee) network. Our results show that it is possible to detect wireless spoofing with both a high detection rate and a low false positive rate, thereby providing strong evidence of the effectiveness of the K-means spoofing detector as well as the attack localizer.

A data clustering approach to discriminating impersonating devices in Wi‐Fi networks

“…Faria and Cheriton [6] proposed 'signalprints', which are tags for signal patterns correlated to physical locations. Both Chen et al [27] and Sheng et al [13] proposed per-frame RSS analysis based on multiple sensor monitoring, which is similar to our previous work. These works assumed that RSS values of one transmitter would follow a Gaussian distribution and thereafter used N sensors' observations as N-dimensional vectors to profile their testing environments.…”

Application of wavelet denoising to improve OFDM‐based signal detection and classification

“…Considerable research has been conducted on detecting and/or mitigating spoofing within the medium access control (MAC) layer of the open systems interconnection (OSI) stack [1,2]. There has been a recent shift toward providing added security at the OSI Physical (PHY) layer by exploiting RF features 72 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL RF fingerprinting is one alternative PHY layer approach that is readily dismissed in Reference [2] for 'scale' reasons.…”

Experimental performance evaluation of location distinction for MIMO links

“…Much of the discussed work has suggested using channel measurements gathered at multiple receivers in order to perform location distinction [5], [1], [7], [4], [18]. However, in typical WiFi networks, adjacent access points are set to operate on different channels in order to reduce interference and clients operate on a single channel.…”