Automated sniffer apparatus and method for monitoring computer systems for unauthorized access

Abstract

An apparatus for wireless communication including an automated intrusion detection process is provided. The apparatus has a portable housing, which may have a length no greater than 1 meter, a width no greater than 1 meter, and a height of no greater than 1 meter. A processing unit (e.g., CPU) is within the housing. One or more wireless network interface devices are within the housing and are coupled to the processing unit. The apparatus has an Ethernet (or like) network interface device within the housing and coupled to the processing unit. A network connector is coupled to the Ethernet network device. One or more memories are coupled to the processing unit. A code is directed to perform a process for detection of a wireless activity within a selected local geographic region. According to a specific embodiment, the wireless activity is derived from at least one authorized device or at least an other device. A code is directed to receiving at least identity information associated with the wireless activity from the detection process in a classification process. A code is directed to labeling the identity information into at least one of a plurality of categories in the classification process. Depending upon the embodiment, other codes may exist to carry out the functionality described herein.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS [0001] This present application claims priority to U.S. Provisional Application No. 60 / 543,632, titled “An Automated Method and an RF Sensor System for Wireless Unauthorized Transmission, Intrusion Detection and Prevention,” filed Feb. 10, 2004, commonly assigned, and hereby incorporated by reference for all purposes. [0002] This present application is also related to U.S. Ser. No. ______ (Attorney Docket Number 022384-000610US______) filed on the same date, commonly assigned, and hereby incorporated by reference for all purposes, which claims priority to U.S. Provisional Application No. 60 / 543,632, titled “An Automated Method and an RF Sensor System for Wireless Unauthorized Transmission, Intrusion Detection and Prevention,” filed Feb. 10, 2004, commonly assigned, and hereby incorporated by reference for all purposes.BACKGROUND OF THE INVENTION [0003] The present invention relates generally to wireless computer networking techniques. More par...

AI Technical Summary

Benefits of technology

[0016] Certain advantages and / or benefits may be achieved using the present invention. For example, the present technique provides an easy to use process that relies upon conventional computer hardware and software technologies. In some embodiments, the method and system are fully automated and can be used to prevent unauthorized wireless access of local area computer networks. The automated operation minimizes the human effort required during the system operation and improves the system response time and accuracy. In some embodiments, the method and system advantageously reduce or eliminate the false positives on intrusion events thereby eliminating the nuisance factor during the system operation. This is because the technique of the invention intelligently distinguishes between unauthorized APs and external APs, the latter usually being the source of false positives. According to specific embodiment, the invention provides for standalone appliance implementation of intrusion detection system thereby providing intrusion detection solution at a low cost and at a low or no other network management infrastructure requirement. This is particularly advantageous for smaller network installations such as those in small offices, coffee shops, house, apartment, etc. Additionally, the invention is compatible with conventional wireless and wired networking technologies without substantial modifications to conventional equipment and processes according to a specific embodiment. Depending upon the embodiment, one or more of these benefits may be achieved. These and other benefits will be described in more throughout the present specification and more particularly below.

Problems solved by technology

Although much progress occurred with computers and networking, we now face a variety of security threats on many computing environments from the hackers connected to the computer network.

Unfortunately, certain limitations still exist with WiFi.

That is, the radio waves often cannot be contained in the physical space bounded by physical structures such as the walls of a building.

Hence, wireless signals often spill outside the area of interest.

Consequently, the conventional security measure of controlling access to the physical space where the LAN connection ports are located is now inadequate.

Despite these measures, many limitations still exist.

The unauthorized AP creates a security vulnerability.

The unauthorized AP allows wireless intruders to connect to the LAN through itself.

Soft APs, ad hoc networks, and misconfigured APs connected to the LAN also pose similar threats.

Images