A detection method of wlan spoofing attack based on rss

Abstract

The invention discloses an RSS-based WLAN spoofing attack detection method, comprising: deploying a beacon in the WLAN; the beacon collects the RSS data stream corresponding to each node identity in the WLAN; and the beacon sequentially extracts the same node The RSS data flow corresponding to the identity; performing cluster analysis on the RSS data flow corresponding to the identity of the same node, and judging whether there is a spoofing attack behavior in the WLAN. The present invention utilizes the clustering result evaluation algorithm to effectively overcome various singular cluster distribution conditions, improve the WLAN attack detection rate, effectively detect whether there is a deception attack in the WLAN, and accurately determine the number of attackers.

Description

technical field [0001] The invention relates to the field of WLAN attack detection, in particular to an RSS-based WLAN spoofing attack detection method. Background technique [0002] The wireless local area network (WLAN) based on the IEEE 802.11 protocol has rapidly occupied the market due to its convenient network access, flexible networking, mobile portability, and low deployment cost. However, due to the openness of wireless medium transmission, attackers can monitor any transmission. In addition, attackers can easily purchase low-cost wireless devices and use many wireless tools to launch wireless attacks through war driving. Among most wireless attacks, identity-based spoofing attacks are the most common and serious. For example, in a WLAN, when a wireless node passively monitors the network, an attacker can easily collect useful MAC address and SSID information, and then execute the ifconfig command to modify the attacker’s MAC address, configure the same SSID inform...

AI Technical Summary

Problems solved by technology

However, when there are multiple attackers using the same identity to cooperate with each other to launch a spoofing attack, none of the current methods can determine the number of attackers, and further, they cannot locate the physical location of the attackers.

[0006] 3. RSS data clustering processing technology is related to the detection effect of spoofing attacks. There are still a series of problems in the application of current clustering analysis algorithms to RSS data processing. The reason is that many RSS noise values ​​are generated due to various wireless signal interferences. In the case of some outliers, large and small clusters, slight overlap between clusters, etc., most existing methods cannot produce good clustering results

[0007] Therefore, the complex WLAN application environment brings greater difficulty to WLAN attack detection.

Images