Search

The ubiquitous cloud computing services provide a new paradigm to the work-from-home environment adopted by the enterprise in the unprecedented crisis of the COVID-19 outbreak. However, the change in work culture would also increase the chances of the cybersecurity attack, MAC spoofing attack, and DDoS/DoS attack due to the divergent incoming traffic from the untrusted network for accessing the enterprise’s resources. Networks are usually unable to detect spoofing if the intruder already forges the host’s MAC address. However, the techniques used in the existing researches mistakenly classify the malicious host as the legitimate one. This paper proposes a novel access control policy based on a zero-trust network by explicitly restricting the incoming network traffic to substantiate MAC spoofing attacks in the software-defined network (SDN) paradigm of cloud computing. The multiplicative increase and additive decrease algorithm helps to detect the advanced MAC spoofing attack before penetrating the SDN-based cloud resources. Based on the proposed approach, a dynamic threshold is assigned to the incoming port number. The self-learning feature of the threshold stamping helps to rectify a legitimate user’s traffic before classifying it to the attacker. Finally, the mathematical and experimental results exhibit high accuracy and detection rate than the existing methodologies. The novelty of this approach strengthens the security of the SDN paradigm of cloud resources by redefining conventional access control policy.

Software-Defined Network (SDN) segregates the control plane and the data plane to bring about a programmable network. The controller at the control plane runs network modules and sets rules for forwarding the packets in the switches that resides at the data plane. Though advantageous in several ways, SDN can fail when the controller is saturated by a flood of TCP SYN packets. SYN flood can be created using malicious spoofing of IP or MAC addresses or flash crowd. The existing solutions to mitigate SYN flood against the controller does not adequately handle MAC spoofing based SYN flood, and these are unable to distinguish between flash crowd and malicious traffic. To overcome some limitations in existing solutions, we propose a novel mechanism called AEGIS , which detect and mitigate SYN flood against the controller in SDN. AEGIS runs in the controller, and it regularly checks if there is a performance lag in the controller due to an ongoing SYN flood. If a performance degradation is detected, then AEGIS takes it an indication of SYN flood and it identifies whether it is due to spoofed addresses or flash crowd. Once the reason is found, the appropriate mitigation procedure is triggered. We evaluate AEGIS in testbed and emulator settings, and we compare the results of the evaluation with state-of-the-art solutions. The performance evaluation of AEGIS shows that it identifies the malicious SYN at an accuracy of 97.78%. Moreover, when there is no SYN flood, AEGIS takes 0.0637s to set up a successful TCP connection, which is 53.81% less than the time taken by the state-of-the-art solution, thus, it proves that AEGIS is lightweight.

Networks are spread all throughout the world, usually found in homes, organizations, governments, etc. Due to the exponential growth in the deployment of networks, this field has become a prime target for attackers. A spoofing attack is a very common type of attack on a network. It may sound simple, but it is a complex technique involving impersonation and gaining access to restricted information. Some spoofing attacks complicate scenarios by launching other attackers using spoofed computers. Networks are usually unable to identify spoofing attacks since the hackers who attack can forge the MAC address of their device to impersonate another device on the network resulting in an advanced level of ARP spoofing thereby exposing the vulnerability of the network. This becomes really tricky when the attack is done in the address of a company’s network. Several techniques exist to detect MAC spoofing such as Sequence Number Analysis, Radio Signal strength based detection, and Hop based detection. But all these techniques wrongly classify malicious user to be authenticated ones at times costing the authenticity of the valuable legitimate users. In this paper, a design of an address verification technique to detect threats by using multiplicative increase and additive decrease algorithm based on network localization with the support of Port Scanning, OS fingerprinting and Route Tracing algorithms has been discussed. This eliminates the chance of a legitimate user getting penalized during the traffic restriction resulting in a more trustworthy and a more intelligent network.

While applying the magnificent benefits of storage methods to meet 5G service demands, security, trust issues in Cloud, and fog Computing are essential and exciting topics. There are various types of attacks in different logical planes (i.e. control plane and data plane), for example, the physical is particularly vulnerable to attacks such as spy attacks, scrambling attacks, identity theft attacks, primary user emulation (PUEA) attacks, and threats through wireless channels. The main attacks in the control plane are the attacks of the protocol of the MAC layer (Media Access Control) and common threats from control channels such as MAC spoofing, attack by extended denial of service, attack by jamming, etc. The 5G Service-Based Architecture (SBA) undergoes a lot of processing because of its importance, which is to make it the most targeted by attacks. Among the attacks that can be found in SBA: virtualization attacks, threats to user privacy, and other security threats.

With the development of wireless networks and mobile devices, interest on indoor localization systems (ILSs) has increased. In particular, Wi-Fi-based ILSs are widely used because of the good prediction accuracy without additional hardware. However, as the prediction accuracy decreases in environments with natural noise, some studies were conducted to remove it. So far, two representative methods, i.e., the filtering-based method and deep learning-based method, have shown a significant effect in removing natural noise. However, the prediction accuracy of these methods severely decreased under artificial noise caused by adversaries. In this paper, we introduce a new media access control (MAC) spoofing attack scenario injecting artificial noise, where the prediction accuracy of Wi-Fi-based indoor localization system significantly decreases. We also propose a new deep learning-based indoor localization method using random forest(RF)-filter to provide the good prediction accuracy under the new MAC spoofing attack scenario. From the experimental results, we show that the proposed indoor localization method provides much higher prediction accuracy than the previous methods in environments with artificial noise.

With the increasing popularity of IoT devices, the vulnerabilities & security issues concerned with these devices are also increasing. The lack of security mechanisms and vulnerable protocols make IoT devices easy targets for hackers, for example, the “Mirai Botnet Attack” in 2016. There is a very critical requirement for security of IoT systems. In this paper, we propose the IDRBT-IoT Secure Router (IISR), which is immune to a large number of cyber attacks. IISR protects the network against malicious activities by providing a one-step solution for securing the IoT ecosystem. It consists of a Raspberry Pi 3 Model B+, five IoT devices, and an attacker machine. The router has been tested by conducting ten attacks namely: Deauthentication, Fake-Authentication, MAC Spoofing, Denial of Service, Port Scanning, WiFi Cracking, ARP Poisoning, DNS Spoofing, Malware Injection, and Firmware Exploitation. We developed security mechanisms for detection and mitigation of these attacks. They consist of Snort IDS rules, Arduino programming, Packet Sniffer, and configuration of connection methods. The test results show that IISR can detect and mitigate seven out of ten attacks. Thus, the initial results are encouraging.

In this paper, we focus on detecting the MAC spoofing attack in physical-layer (PHY-layer) by using a centralized cooperative detection algorithm in multi-user networks. Specifically, we propose an attack detection approach that exploits channel fingerprints power (CFPP) in a slow time-varying fading channel and derive the CFPP estimation approach with the consideration of estimation error. As it is challenging for the suspect factor function design, we design it and discuss its properties. Then, the cooperative spoofing attack detection algorithm is proposed. Simulations validate that the proposed cooperative detection algorithm can achieve a better performance.

Since end-to-end encryption is now a prevalent in text based communication, it has become necessary to explore its flip side as well. This paper studies and analyses the working and security mechanisms of one such application, WhatsApp messenger. It also discusses the pitfalls of perfect forward secrecy and its consequences for law enforcement, which essentially hold true for any end-to-end encryption system. Lastly, a model is proposed using key escrow that tries to provide selective access to law enforcement under justified conditions. This model can be generalized to extend to other WhatsApp-like applications and implemented or enforced in the form of a guideline or regulation respectively.

Physical-layer security has drawn ever-increasing attention in the next generation wireless communications. In this paper, we focus on studying the secure communication in an HPN-to-devices (HTD) network, in which a new type of MAC spoofing attack is considered. To detect the malicious attack, we propose a novel algorithm, namely, eigenvalue test using random matrix theory (ETRMT) algorithm, which needs no prior information about the channel. In particular, when the number of samples is finite at the receiver or the number of devices is large, the sampled signal is the biased estimation of the actual signal, which inspires us to use the random matrix theory to analyze the spoofing attack detection. The closed-form expressions of the detection probability, the false alarm probability, and the Neyman-Pearson threshold are derived based on eigenvalue distribution of the spiked population model. In addition, taking the channel time-varying into consideration, we provide an adaptive threshold tracking method by using Bayesian forecasting. Finally, the simulations are conducted to validate our proposed method and some insightful conclusions are obtained.

The main goal of this project is to improve intrusion detection process in IEEE 802.11 based networks in order to provide conditions for further interaction between attackers and honeypot. In order to gather metadata from clients’ devices, part of Wi-Fi Honeypot as a Service model was applied in the experiment, and for the first time ever. MAC addresses of access points and clients’ devices, probe requests, beacons and power of signal were used as basic data for further processing. Gathered metadata was used to detect malicious activities against network which is under defense and its clients. Several modifications of MAC spoofing attack were provided by authors in order to find attacks’ fingerprints in Wi-Fi ether. Besides base MAC spoofing attack authors suggested a method which allows to identify modification of MAC spoofing where attacker uses power antenna. Also, the new synchronization method for external elements of honeypot was proposed. It is based on centralized random message generation and allows to avoid detection from attackers’ side.

Identity-based attacks such as MAC spoofing are common in wireless networks. The recently developed virtualization technologies bring a new type of MAC spoofing attack, virtual MAC spoofing. This makes it even more challenging to detect such attacks, especially in a tight environment with spatial similarities. In this paper, we design, implement and evaluate a system to effectively detect virtual MAC spoofing attacks via deep learning. A deep convolutional neural network is constructed to extract physical features from CSI obtained from packet transmissions, to detect virtual MAC spoofing attacks. An important merit of the proposed detection system is that this system can distinguish two devices even at the same location, which was not well addressed by previous approaches. Our extensive experimental results demonstrate the effectiveness of the system with an average detection accuracy of 95%, even when devices are co-located.

With the emergency of Bring Your Own Device (BOYD) and Internet of Things (IoT) in enterprises, there has been an increase in the use of wireless networks through mobile devices and tablet computers. However, as a negative effect, such increase has also led to increased security threat in wireless networks and thus, the importance of wireless network security has increased. As a way to cope with such threat, many enterprises have introduced wireless intrusion prevention system (WIPS) solution, which consists of WIPS sensors and a centralized WIPS server. By monitoring the radio signal in wireless local area networks (LAN), WIPS solution shuts off access by an unauthorized wireless device and prevents an rogue Access Point (AP). In this paper, we propose an implementation framework for WIPS solution that ananlzes the received signal strength (RSS) values collected from multiple WIPS sensors. By overcoming the performance (including accuracy and F-measure) decrease in the wireless environment with much noise, the proposed WIPS solution shows the high performance even under the wireless environment with low signal-to-noise ratio (SNR). For this purpose, the proposed WIPS solution analyzes the RSS values collected from multiple WIPS sensors by using a dynamic random forest (DRF) algorithm. By adding trees that are the most suitable to forest, the DRF algorithm can improve the performance of the WIPS solution. From the experimental results, it is observed that the proposed WIPS solution combined with the DRF algorithm shows the good-enough performance under various SNR and attack distance.

Generally Malicious users make use of different attacks at different levels to steal different level of data. Some of the sniffing attacks that can be used in different levels of networking/transmission are Media Access Control (MAC) Flooding, Dynamic Host Configuration Protocol (DHCP) Attacks, DHCP Starvation Attack, Rogue DHCP Server Attack, Address Resolution Protocol (ARP) Spoofing, MAC spoofing and Domain Name Server (DNS) Poisoning. In this paper, a comparative study has been done with the above mentioned sniffing attacks and the level of recovery that can be done with each sniffing attack.

This paper proposed to give in depth survey on types of spoofing attacks. Spoofing is a way of masquerading identity of a person or a computer by providing fake data. In this paper huge variety of spoofing methods which includes brief introduction of Dns, Ip, Email, Arp, Web, Wireless, Mac spoofing. The intention of spoofing is to manipulate, steal data which in turn results in data loss and loss on millions of dollars.

In this paper, we analyze manipulation methods of the MAC address and consequent security threats. The Ethernet MAC address is known to be unchanged, and so is highly considered as platform-unique information. For this reason, various services are researched using the MAC address. These kinds of services are organized with MAC address as plat- form identifier or a password, and such a diverse range of security threats are caused when the MAC address is manipulated. Therefore, here we research on manipulation methods for MAC address at different levels on a computing platform and highlight the security threats resulted from modification of the MAC address. In this paper, we introduce manipulation methods on the original MAC address stored in the EEPROM on NIC (Network Interface Card) as hardware- based MAC spoofing attack, which are unknown to be general approaches. This means that the related services should struggle to detect the falsification and the results of this paper have deep significance in most MAC address-based services.

Nowadays security is a major concern. Address resolution Protocol (ARP) is a most popular communication protocol in the LAN. ARP is mapping from IP address (32 bits) into MAC address (48 bits). ARP has some limitations like lack of states and authentication. So attacker can exploit these vulnerabilities and gain unauthorized access to one's sensitive data. There are some attacks against ARP like MAC Spoofing, MAC duplicating, Man-in-the-middle (MITM) and denial of services (DOS). So efficient and secure scheme is provided which prevents ARP attacks. This paper demonstrates a utility which gives users the authentication as well as detection and prevention of ARP poisoning in dynamic IP configuration. Utility provides a mechanism which is based on internet control management protocol (ICMP) which uses secondary cache for checking pair entry of IP-MAC respective the system in the network.

In recent trends, wireless networks have emerged as one of the choicest forms of data communication. Wireless networks provide an array of benefits like, easy installation, flexibility, mobility, scalability and reduced cost of ownership. In spite of several advantages, there are some serious issues, which pose security risks when confidentiality, integrity and authenticity issues are concerned. In infrastructure wireless networks, providing access only to legitimate users is a challenge to most network administrators. Attackers are equipped with various tools and techniques to break the security and gain illegitimate access to the organization's data and other such secured entities. Some of the wireless networks employ MAC filtering techniques for providing network access to hosts. In order to gain unauthorized access to such networks spoofing- attack with false IP-MAC pair is the first step in most of the LAN based attacks. Address Resolution Protocol (ARP) is the main cause of spoofing attack. Many network and host level mechanisms have been proposed to counter such attacks. However, they have their own sets of drawbacks. In our proposed work, we have configured an open source network security tool for the detection of various attacks or spoofed MAC attack exploited in IEEE 802.11 wireless networks. In this work, we have tried to differentiate between the genuine station and the attacker station by 3-phase authentication method. In our proposed work the algorithms are developed upon three phase i.e. probe request frame, authentication frame and association frame. This scheme has been tested under all possible spoofing cases and yielded favorable results.

In 802.11, all devices are uniquely identified by a Media Access Control (MAC) address. However, legitimate MAC addresses can be easily spoofed to launch various forms of attacks, such as Denial of Service attacks. Impersonating the MAC address of a legitimate user poses a big challenge for cyber crime investigators. Indeed, MAC spoofing makes the task of identifying the source of the attack very difficult. Sequence number analysis is a common technique used to detect MAC spoofing attack. Existing solutions relying on sequence number analysis, adopt a threshold-based approach where the gap between consecutive sequence numbers is compared to a threshold to decide the presence of a MAC spoofing attack. Nevertheless, threshold-based approach may lead to a high rate of false alerts due to lost or duplicated frames.To overcome the limitations of threshold-based approach, this paper proposes a detection method that relies on a machine learning approach, namely Artificial Neural Network (ANN). ANNs provide the potential to identify and classify network behavior from limited, noisy, incomplete and non-linear data sources. The experimentation results showed the effectiveness of the proposed detection technique. Moreover, we proposed a user-friendly graphical representation of information to support the interpretation of quantitative results.

Spoofing makes the task of identification and tracking back of the perpetrator / initiator in Cyber Crimes very difficult, e.g. the attacks by way of changing its network identifiers in WLANs. In such a scenario, spoof detection methods have gain wide attention. One way to prevent from spoofing is to authenticate the frames. However, in 802.11 WLANs, authentication and encryption for management and control frames is not provided. Further, present MAC spoofing detection techniques bring out large number of false positives. This paper discusses the various spoofing detection methods. Each method has its own pros and cons and provides a different level of security ranging from low to high. By analyzing the different detection techniques together, it is brought out in the paper as to which particular method could be more suitable in a particular scenario and how one can easily get the reduced false positives. As a study, performing a Session Containment attack by spoofing the IP address of the access point (AP) is also presented and detection of the attack is done using sequence number analysis method. By way of retrospect, an outline of future work is also suggested in the concluding remarks.

Group communications are becoming popular by explosively increased Internet usage, and there are various group communications on Internet applications such as video conferences, on-line text chatting programs, online games and gambling. However, the conventional group key agreement protocols are only focused on how to minimize the computational overhead by concentrating on generating the common group key efficiently. As a result, the common group key is generated efficiently. However, a failure in user authentication permits unknown attackers to obtain valuable information during the group communication. This paper proposes a Media Access Control (MAC)-based authentication in the group key agreement in order to secure the user authentication process in group communications. Without a preliminary agreement, participants in a group communication cannot trust each other in the beginning of the group setup. Therefore, the group controller, who is randomly selected from the group members, needs a security deposit from all members in case an illegitimate user tries to join the group. The user MAC address proposed in this paper can act as a security deposit to provide a secure communication channel while preventing the MAC spoofing problem.

A major threat in wireless local area infrastructure network is denial-of-service (DoS) attacks. It makes the resources unavailable for its anticipated user which can be accomplished through spoofing legitimate client/AP’s medium access control (MAC) address. Less protection in MAC address led to get easy spoofing. Since the management frame is unencrypted, adversary sends the management frame to the victim using spoofed MAC address. This prerequisite goaded to offer an effective prevention mechanism for DoS attack. Even though several preventing mechanisms are available, no one provides complete solution in preventing MAC layer DoS attack. This paper proposes a theoretical framework of threshold value (ThreV) algorithm, which is based on setting up ThreV for the management frame, to effectively address this issue.

Wireless LANs are quite popular and have found wide spread usage amongst various segments. The issue of spoofing, and its detection, in Wireless LANs has been a matter of serious debate and received wide spread attention in research community as well. Spoofing is a potent weapon in the hands of a Cyber Criminal. The very characteristics of spoofing makes the task of identification and tracking back of the perpetrator / initiator in Cyber Crimes very difficult, e.g. those relating to denial of service, session hijacking, and address masquerading attacks by changing its network identifiers in WLANs. One way to overcome the problem of spoofing is to authenticate the frames. However, in 802.11 WLANs, authentication and encryption for management and control frames is not provided. It is also observed that present MAC spoofing detection techniques bring out large number of false positives. This paper analyses the various spoofing detection methods in WLANs bringing out their pros and cons including the different level of security provided ranging from low to high. The analysis in the paper also brings out as to which particular method could be more suitable in a particular scenario and how one can easily get the reduced false positives, which has been a bane of current detection methods. The paper also presents two case scenarios, particularly highlighting the victim Silent case scenario not discussed much thus far in the current literature on the topic, to validate the results. By way of retrospect, an outline of future work is also suggested in the concluding remarks.

Las redes inalámbricas tienen un papel cada vez más importante en las comunicaciones del mundo de hoy. Debido a su facilidad de instalación y conexión, se han convertido en una excelente alternativa para ofrecer conectividad en lugares donde resulta inconveniente o imposible brindar servicio con una red cableada. Sin embargo, su punto débil reside en la característica que la hace tan popular: la transmisión por un medio público como es el aire. En el presente trabajo se realiza una investigación del estado del arte en la detección de intrusiones en redes inalámbricas. En primer lugar, se presenta un análisis de las características, estándares, arquitectura y dispositivos de las redes 802.11. Para posteriormente identificar los diferentes riesgos y tipos de ataques informáticos a los cuales se encuentran expuestos estas redes. Así también se identifican los diferentes mecanismos de seguridad existentes que introducen niveles básicos y avanzados de seguridad en las redes inalámbricas. Se identifica que una herramienta muy empleada para la detección de intrusiones son los llamados sistemas de detección de intrusos inalámbricos (WIDS)...

Denial of Service (DoS) attacks is a major problem prevalent in Wireless Local Area Network. An attack occurs mainly because of Medium Access Control (MAC) address spoofing. MAC spoofing is a technique where an adversary pretends to be a legitimate client/Access Point (AP) and sends forgery frames to the victim client or AP. Most of existing solutions are prevent DoS attacks after an intruder sending forged frame by spoofing Client or AP's identity. Few solutions are exists to detect an attacker at the time of MAC address spoofing. None of these techniques provides a complete solution. This paper describes the existing solutions and drawbacks of the available solutions and also compares the existing technique with future work based on throughput, packet loss and end to end delay.

This paper demonstrates the effectiveness of DTF method, by simulating a network and testing how it responds to different situations. All the packets injected into the simulator are collected from real computers. The simulator allow to create a virtual network, with as many network stations as desired. The simulation proves that DTF method can quickly determine if a MAC address is or it is not what it claims to be.

Most of the LAN based-attacks involves the spoofing of the victim host with falsified IP-MAC pairs. MAC Spoofing is possible because of the stateless nature of the Address Resolution Protocol (ARP), which is responsible for resolving IP Addresses to MAC Addresses. Several mechanisms have been proposed to detect and mitigate ARP spoofing attempts both at the network level and at the host level, but each of them have their own drawback. In this paper we propose a Host-based Intrusion Detection system for LAN attacks which work without any extra constraint like static IP-MAC, modifying ARP etc. The scheme is successfully validated in a test bed with various attack scenarios and the results show the effectiveness of the proposed technique.

Part 18: The Applications of Soft Computing to Telecommunications (ASCOTE) Workshop; International audience; In Wireless Local Area Networks (WLAN), beacon, probe request and response messages are unprotected, so the information is visible to sniffers. Probe requests can be sent by anyone with a legitimate Media Access Control (MAC) address, as association to the network is not required at this stage. Legitimate MAC addresses can be easily spoofed to bypass Access Point (AP) access lists. Attackers take advantage of these vulnerabilities and send a flood of probe request frames which can lead to a Denial-of-Service (DoS) to legitimate stations. This paper discusses an intelligent approach to recognise probe request attacks in WLANs. The research investigates and analyses WLAN traffic captured on a home wireless network, and uses supervised feedforward neural network with 4 input neurons, 2 hidden layers and an output neuron to determine the results. The computer simulation results demonstrate that this approach improves detection of MAC spoofing and probe request attacks considerably.

IEEE 802.11-based Wireless LANs (WLANs) are deployed in public places, universities, offices and shops. The main reason for the popularity is convenience of internetworking without wires. The increase in WLANs also resulted in increase of security threats. One of these threats is spoofing MAC address. Some WLANs use MAC filtering to allow stations with registered MAC addresses to use the network. The attacker has many tools like AirJack, WireShark to capture the packets in WLAN and find authorized MAC address. The attacker masquerades as an authorized station and can launch denial of service attack. This paper presents a power hopping technique which can be used by Access Points (AP) to discern the authorized packets from the masquerading packets and thus deny the attacker from using the system.

Failure of addressing all IEEE 802.11i Robust Security Networks (RSNs) vulnerabilities enforces many researchers to revise robust and reliable Wireless Intrusion Detection Techniques (WIDTs). In this paper we propose an algorithm to enhance the performance of the correlation of two WIDTs in detecting MAC spoofing Denial of Service (DoS) attacks. The two techniques are the Received Signal Strength Detection Technique (RSSDT) and Round Trip Time Detection Technique (RTTDT). Two sets of experiments were done to evaluate the proposed algorithm. Absence of any false negatives and low number of false positives in all experiments demonstrated the effectiveness of these techniques.

There has been an increased awareness on the importance of a hands-on laboratory component in information security education in recent years. We developed a series of laboratory exercises for wireless network security. These laboratory exercises introduce to the students the following wireless network attacks: Wardriving, Eavesdropping, WEP Key Cracking/Decryption, Man in the Middle, MAC Spoofing, ARP Cache Poisoning, and ARP Request Replay. Open source tools such as Aircrack-ng, Cain and Abel, and Mac Makeup are used in these laboratory exercises to demonstrate how these attacks are conducted. The laboratory exercises were presented to two information security related courses at this university. The student feedback was very positive. Future work will include refining the laboratory design, conducting evaluation of the exercises extensively, developing more laboratory exercises for wireless network security and developing laboratory exercises for the Linux platform.

MAC addresses can be easily spoofed in 802.11 wireless LANs. An adversary can exploit this vulnerability to launch a large number of attacks. For example, an attacker may masquerade as a legitimate access point to disrupt network services or to advertise false services, tricking nearby wireless stations. On the other hand, the received signal strength (RSS) is a measurement that is hard to forge arbitrarily and it is highly correlated to the transmitter's location. Assuming the attacker and the victim are separated by a reasonable distance, RSS can be used to differentiate them to detect MAC spoofing, as recently proposed by several researchers. By analyzing the RSS pattern of typical 802.11 transmitters in a 3-floor building covered by 20 air monitors, we observed that the RSS readings followed a mixture of multiple Gaussian distributions. We discovered that this phenomenon was mainly due to antenna diversity, a widely-adopted technique to improve the stability and robustness of wireless connectivity. This observation renders existing approaches ineffective because they assume a single RSS source. We propose an approach based on Gaussian mixture models, building RSS profiles for spoofing detection. Experiments on the same testbed show that our method is robust against antenna diversity and significantly outperforms existing approaches. At a 3% false positive rate, we detect 73.4%, 89.6% and 97.8% of attacks using the three proposed algorithms, based on local statistics of a single AM, combining local results from AMs, and global multi-AM detection, respectively.

A great variety of well-known attacks exist for the IEEE 802.11 protocol. The lack of mechanisms for management frame authentication and the complexity of the protocol itself have derived into a considerable number of denial of service and identity spoofing attacks. As most denial of service attacks are based on spoofing of MAC addresses, spoofed frame detection schemes have gained attentions. Currently the most efficient techniques to detect this kind of attacks are based on the creation of profiles for the wireless nodes and behavior based protocol anomaly detection. However, these techniques tend to generate too many of false positives. This is caused by the unstable nature of the wireless medium and also because of the difficulty to model the behaviour of the diverse implementations from different manufacturers. One way to reduce false positives is to combine different techniques to carry out the analysis. We propose a novel method that identifies the impersonation of certain management frames, which helps to reduce the number of false positives within other existing MAC spoofing detection techniques.

This paper proposes WIDS, a wireless intrusion detection system, which applies data mining clustering technique to wireless network data captured through hardware sensors for purposes of real time detection of anomalous behavior in wireless packets. Using hardware sensors to capture network packets enables detection of attacks before they reach access points and ensures all packets transmitted in the networks are analyzed for a more complete attack detection. The proposed mining based technique for wireless network intrusion detection contributes by reducing the need for training data, reducing false positives and increasing the effectiveness of attack detection on networks with few (one to twenty) connections. The proposed WIDS design approach involves real time pre-processing of sensor data using a density-based, Local Sparsity Coefficient (LSC) outlier detection algorithm to assign anomaly scores to the connection records. Connection records with low anomaly scores are used as initial starting cluster centre positions for building clusters. The algorithm continuously derives minimum deviation as the maximum of distances between all pairs of cluster centre positions. New records which have their distances from the closest cluster more than the minimum deviation, are tagged as anomaly and moved to alert cluster. One major result of this paper is detection of MAC spoofing attacks by tracking sequence numbers, which ensures duplicate or spoofed (stolen) MAC addresses are not used in the network.

We automate live and dead forensic evidence gathering for MAC spoofer investigations and formalize its encoding in Forensic Lucid for subsequent reasoning. The monitoring covers a Faculty's network focusing on 1000 analyst-managed clients. We describe initial operational deployment of the MAC Spoofer Analyzer's evidence gathering components. We also highlight immediate and future concerns regarding the automation of the reasoning aspects behind the analyzer to aid network system administrators in their daily network security monitoring, management, and maintenance activities.

The immense growth of wireless network makes it prone to number of security threats. Most prevalent among them are spoof threats, in which one network device changes its network identifiers to that of another network device. One of the possible reasons of spoofing in wireless network is that per-frame source authentication is not provided. Full scale authentication can be provided, but it is not always desirable as it requires reliable key management. The attacker can further launch Denial of Service attacks by spoofing deauthentication/disassociation or power saving frames, can bypass the access control list or can falsely advertise services to wireless clients. This paper discusses some of the non cryptographic techniques to detect MAC spoofing along with their pros and cons and the network scenarios in which they can be used. Analysis of these techniques is done on data captured from live test bed. The information in this paper can help the wireless equipment manufacturers to implement intrusion detection systems capable of detecting MAC address spoofing efficiently with least number of false alarms.

Wireless Local Area Network (WLAN) is susceptible to security provisioning in spite of the solutions such as the Wired Equivalent Protocol (WEP) or IEEE 802.1x This paper proposes an integrated scheme for intrusion detection in WLAN systems The proposed scheme operates with one or more Gathering Agents (GAs) and a Master Server (MS) Each GA is used to get security information by collecting the frame packets in WLAN, whereas the MS is purposed to detect and prevent the various attacks by analyzing the packets in the WLAN systems A detection engine contained in the MS employs OUI list matching for detection of MAC spoofing attacks, sequence number analysis for man-in-the-middle attacks, and Finite State Machine (FSM) analysis for Denial-of-Service (DoS) attacks By experiments, it is shown that the proposed scheme could effectively detect and prevent the various attacks that could possibly be done in the WLAN systems.

The exponential growth in the deployment of IEEE 802.11-based wireless LAN (WLAN) in enterprises and homes makes WLAN an attractive target for attackers. Attacks that exploit vulnerabilities at the IP layer or above can be readily addressed by intrusion detection systems designed for wired networks. However, attacks exploiting link-layer protocol vulnerabilities require a different set of intrusion detection mechanism. Most link-layer attacks in WLANs are denial of service attacks and work by spoofing either access points (APs) or wireless stations. Spoofing is possible because the IEEE 802.11 standard does not provide per-frame source authentication, but can be effectively prevented if a proper authentication is added into the standard. Unfortunately, it is unlikely that commercial WLANs will support link-layer source authentication that covers both management and control frames in the near future. Even if it is available in next-generation WLANs equipments, it cannot protect the large installed base of legacy WLAN devices. This paper proposes an algorithm to detect spoofing by leveraging the sequence number field in the link-layer header of IEEE 802.11 frames, and demonstrates how it can detect various spoofing without modifying the APs or wireless stations. The false positive rate of the proposed algorithm is zero, and the false negative rate is close to zero. In the worst case, the proposed algorithm can detect a spoofing activity, even though it can only detect some but not all spoofed frames.

The sustained growth and innovation of information technologies, combined with the resulting complexity in communication infrastructures, has pushed the network into an increasingly critical role within organizations of all sizes. In order to assure that operations are aligned with the business needs, monitoring and management practices are gaining importance across all network domains. As a result, network managers need the best possible tools for managing the network infrastructure and assuring that it will play its essential part in supporting the organization in a reliable, predictable, efficient and cost-effective manner. This paper proposes several algorithms that will be used on an integrated network monitoring open-source tool: an algorithm for network topology discovery and two algorithms for the detection and blocking of MAC and IP spoofing network attacks. The proposed approaches are based on the SNMP protocol, which is currently supported by most network devices, and the performance tests that were made show that they are effective, reliable and very easy to deploy in real operating scenarios.