Method and apparatus for abnormal access point detection

Abstract

Disclosed in some examples are methods, systems, devices, and machine-readable media that detect double-sided lovage and other malicious access points in IT infrastructure by detecting access points that are not in their desired locations based on analysis of access point reports from one or more computing devices.

Description

[0001] This application is a divisional application of application number 201980037947.0 filed on May 31, 2019, and invention name “Method and device for abnormal access point detection”. Technical Field

[0002] The present application generally relates to the field of network security, and in particular to a method and apparatus for abnormal access point detection. Background Art

[0003] With the advent of the digital age, billions of dollars in R&D, marketing, and sales are increasingly being recorded and stored as electronic data. Data thieves such as hackers and attackers have devised increasingly sophisticated methods to steal and / or destroy this valuable data. One such exploit is known as an "evil twin," in which an attacker impersonates a legitimate access point by setting up their own access point, which they control, to trick unsuspecting devices into connecting to their access point instead of the legitimate one. Once a device is connected to the evil twin, the device's communications and data may be vulnerable to access by these attackers. Worse still, an attacker may use the evil twin as an attack vector to deliver malicious payloads to unsuspecting devices.

[0004] A twin-demon access point impersonates a legitimate access point by duplicating its identifier. For example, a twin-demon may duplicate and broadcast the MAC address and / or SSID of a legitimate access point on the network. Because twin-demons are designed to blend in with legitimate network infrastructure, they are often difficult for network administrators to detect. Twin-demons may also periodically shift which legitimate access point they impersonate to further frustrate detection attempts. Finally, twin-demons can be temporary - that is, the unscrupulous user behind the twin-demon can leave an area for the twin-demon to avoid detection after securing the information they are looking for. In large enterprise environments, there may be hundreds or thousands of access points to monitor over a large area, making it more difficult to mitigate these attacks. Summary of the invention

[0005] In one aspect, the present application is directed to a method for detecting a rogue network access point, the method comprising: using one or more hardware processors: determining a set of a plurality of network access points currently visible to a first computing device; determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location based on a comparison of the set of network access points currently visible to the first computing device and access point positioning data describing location information of the set of network access points visible to the first computing device, the access point positioning data including, for each access point in the set of a plurality of network access points, a geographic location of the access point or relative location data describing a probability that the access point is visible given a set of other access points that are visible; storing an indication that the first network access point is suspected to be anomalous based on the determination that the first network access point is broadcasting from a location that is not an expected location; and initiating at least one corrective action based on the indication that the first network access point is anomalous. Determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location includes: identifying a location of the first computing device; identifying a measurement report that measures a strength of a signal between the computing device and the first network access point; calculating an observed location of the first network access point based on the measurement report and other measurement reports from computing devices other than the first computing device; and determining that the observed location of the first network access point is not within a threshold distance of a location of the first network access point described by the access point positioning data. Determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location includes: identifying a location of the first computing device; and determining that the first network access point is not within a threshold distance of the desired location of the first network access point based on the access point positioning data. The method further includes: the access point positioning data includes the relative location data; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location includes: determining, based on a probability of the relative location data, that the probability of seeing the first network access point given that the set of network access points is visible to the first computing device is below a threshold probability. The relative position data is a probability model created based on a plurality of sets of network access points reported as visible from a plurality of computing devices. Determining that the first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: identifying a central access point in the set of access points visible to the first computing device; using the access point positioning data to identify a location of the central access point; and determining that the first network access point is not within a threshold distance of the location of the central access point.Determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a measurement report that measures a strength of a signal between the first computing device and the first network access point; using a trilateration algorithm to calculate multiple locations of the computing device based on the measurement report and other measurement reports from other computing devices for changing a combination of three access points in the set of network access points visible to the first computing device; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: determining that at least one of the multiple locations involving the first network access point exceeds an error threshold. Initiating the at least one corrective action includes: sending an indication to the first computing device that the first network access point is anomalous. Initiating the at least one corrective action includes: adding the first network access point to a blacklist.

[0006] In another aspect, the present application is directed to a device for detecting a rogue network access point, the device comprising: a hardware processor; a memory comprising instructions, the instructions, when executed, causing the hardware processor to perform operations comprising: determining a set of a plurality of network access points currently visible to a first computing device; determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location based on a comparison of the set of network access points currently visible to the first computing device and access point positioning data describing location information of the set of network access points visible to the first computing device, the access point positioning data comprising, for each access point in the set of a plurality of network access points, a geographic location of the access point or relative location data describing a probability that the access point is visible given a set of other access points that are visible; storing an indication that the first network access point is suspected to be anomalous based on the determination that the first network access point is broadcasting from a location that is not an expected location; and initiating at least one corrective action based on the indication that the first network access point is anomalous. Determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location includes: identifying a location of the first computing device; identifying a measurement report that measures a strength of a signal between the computing device and the first network access point; calculating an observed location of the first network access point based on the measurement report and other measurement reports from computing devices other than the first computing device; and determining that the observed location of the first network access point is not within a threshold distance of a location of the first network access point described by the access point positioning data. Determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location includes: identifying a location of the first computing device; and determining that the first network access point is not within a threshold distance of the desired location of the first network access point based on the access point positioning data. The operations also include: wherein the access point positioning data includes the relative location data; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location includes: determining, based on a probability of the relative location data, that the probability of seeing the first network access point given that the set of network access points is visible to the first computing device is below a threshold probability. The relative location data is a probabilistic model created based on a plurality of sets of network access points reported as visible from a plurality of computing devices.Determining that the first network access point of the set of network access points is broadcasting from a location that is not an expected location includes: identifying a central access point of the set of access points visible to the first computing device; identifying a location of the central access point using the access point positioning data; and determining that the first network access point is not within a threshold distance of the location of the central access point. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In the accompanying drawings, which are not necessarily drawn to scale, like numbers may describe similar components in different views. Like numbers with different letter suffixes may represent different instances of similar components. The accompanying drawings generally illustrate various embodiments discussed in this document by way of example and not limitation.

[0008] Figure 1 Illustrated are exemplary use cases for fraud detection services according to some examples of the present disclosure.

[0009] Figure 2 A method of detecting abnormal access points according to some examples of the present disclosure is illustrated.

[0010] Figure 3-7 Various flow diagrams of methods of determining that a first network access point in a set of network access points is broadcasting from a location that is not a desired location are illustrated according to some examples of the present disclosure.

[0011] Figure 8 A block diagram of a fraud detection service and computing device according to some examples of the present disclosure is illustrated.

[0012] Fig. 9 A schematic diagram of a fraud detector according to some examples of the present disclosure is illustrated.

[0013] Fig.10 is a block diagram illustrating an example of a machine upon which one or more embodiments may be implemented. DETAILED DESCRIPTION

[0014] In some examples, methods, systems, devices, and machine-readable media are disclosed for detecting two-faced evil and other anomalous access points in an IT infrastructure by detecting access points that are not in their expected locations based on analysis of access point reports from one or more computing devices. The computing devices may be end-user computing devices that send access point reports to a network-accessible fraud detection service as the end-user computing device moves from one place to another or as the end-user computing device scans for access points. The reports may include a list of access points scanned by the computing device and, in some examples, measurements of radio signals broadcast from those access points and / or the location of the computing device.

[0015] The fraud detection service may maintain access point location data that describes location information (such as an expected location) for each access point in the network. The location data for each access point may be a specific location (such as a geographic location) or may be a more general location (such as the probability of observing a specific access point given that one or more other access points are observed). The location data may be entered by an administrator or may be automatically created based on multiple reports from multiple computing devices. Based on the access point reports and the location data, the fraud detection service may determine that the observed location of an access point does not match the expected location of the access point. Access points whose observed locations do not match the expected locations may be marked as potential anomalies (e.g., the identification seen may indicate that a two-faced devil is working on the network). The computing device providing the report may be a wireless base station or other access point.

[0016] In some examples, the report sent by the computing device may include the measurement results of the radio channel between the computing device and the access point and the geographic location of the computing device. Using these measurement reports, the system can calculate the observed locations of the access points visible to the computing device. In order to determine these locations, multiple computing devices can send reports to the fraud detection device. Each report may include the location of the computing device (e.g., a location obtained from a global navigation satellite system (GNSS) such as a global positioning system (GPS) sensor or other location-based technology), a list of access points visible from the computing device, and the measurement results of the signal or channel between the computing device and the access point (e.g., received signal strength-RSSI-round trip time (RTT) etc.). Using these reports, the fraud detection service can use trilateration to determine the observed location of the access point. The observed location of the access point can be compared with the expected location from the access point positioning data. The expected location can be entered by an administrator or determined by reports from users during the initial learning period when the system (or access point) goes online. For each visible access point, the difference between the observed location and the expected location greater than a threshold can be marked as an anomaly.

[0017] In other examples, the report may not include measurements of radio channels between the computing device and visible access points. The location of the computing device in the report can be used to create a set of access points from access point location data that are potentially visible from the location of the computing device. Access points that are visible but not in the set of potentially visible access points can be marked as potential anomalies. The set of potentially visible access points can be created in a variety of ways. For example, by including the access point in a list of access point locations that are within a threshold distance of the computing device.

[0018] In other examples, the report may not include measurement data or the location of the computing device. The access point location data may include data that allows the probability of a given access point being visible to be determined given a set of other visible access points (e.g., access point co-occurrence). The access point location data may be created based on past reports from the computing device. The current set of visible access points may be used with the access point location data to calculate a set of current probabilities. For example, if a computing device reports access points A, B, C, and D as visible from the computing device's current location, the system can calculate the following probabilities: seeing A given B, C, and D (e.g., P(A|B,C,D); seeing B given A, C, and D (e.g., P(B|A,C,D); seeing C given A, B, and D (e.g., P(C|A,B,D); seeing D given A, B, and C (P(D|A,B,C)). Any probability of seeing a particular access point below a threshold probability may cause the particular access point to be marked. Therefore, if P(C|A,B,D)<threshold, then C can be marked as an anomaly.

[0019] In other examples, the report may include the location of the computing device, without the measurement data, and the access point location data may include the geographic location. The fraud detection system may calculate a central access point for the set of visible access points (e.g., the centroid of a cluster of access points reported as visible), and the set of desired access points may include all access points in the set of access points that are within a predetermined threshold distance of the central access point. Access points in the visible set of access points but not in the desired set may be marked as potential anomalies.

[0020] For situations where the computing device is not able to locate itself (e.g., in a building or other structure) but is able to provide measurement data and the access point location data includes a geographic location, the fraud detection system can calculate the location by iteratively using all combinations of three access points in the set of visible access points in a trilateration algorithm. A particular access point that is not where expected can be determined based on errors in the trilateration equation, such as situations where the trilateration does not converge to a solution or the error exceeds a threshold. For example, if A, B, C, and D are visible to the computing device, and the solution for A, B, and C converges (or the error is acceptable), but the solution for any trilateration involving D does not converge or has an error above a threshold, then it may be indicated that D is abnormal.

[0021] In some examples, the error may be based on a trilateration equation, but in other examples, the error may be based on a location calculated by a fraud detection system. For example, if A, B, C, and D are visible, there are four combinations of three access points: (A, B, C); (A, B, D); (A, C, D); (B, C, D). For each combination of three access points, the location may be calculated using trilateration. An average or centroid location may be calculated among the four locations, and the error may be the distance between each location and the average or centroid. If the distance exceeds a threshold, the access point may be marked as an anomaly.

[0022] As previously mentioned, the access point location data may store specific locations (e.g., specific geographic locations, buildings, addresses, etc.), or may store relative locations (e.g., the probability that access points A and B are close to each other, or that access points are co-occurring). The access point locations may be input by an administrator (e.g., a table of access point identifiers and locations), may be determined by crowdsourced scans performed by a computing device, etc. For example, when a computing device (STA or other AP) scans for other access points, it may send a report of a list of access points visible to the fraud detection service. The fraud detection system may use these scans to train a model that determines probabilistic associations or clusters that indicate the probability that an access point will be visible given that other access points are visible.

[0023] Additionally, other indicators of anomalous access points may be monitored, such as multiple access points with the same identifier seen in a scan. For example, if the computing device determines that there are multiple access points with the same identifier in a scan, the fraud detection service may mark both as potential anomalies.

[0024] In some examples, a fraud score can be tabulated for each access point. Each time an access point is marked as an anomaly, the fraud detection system can increase the fraud score of the associated access point identifier. If the fraud score exceeds a certain threshold fraud score, the access point can be marked as compromised and corrective action can be taken.

[0025] In some examples, the fraud detection service may take one or more confirmation actions when determining that an AP is abnormal or damaged. For example, through wired communication with a legitimate access point having the same identifier as the abnormal or damaged AP, the fraud detection service may request the legitimate AP to broadcast a code in its beacon. The computing device that reported the abnormal AP may be requested to scan beacons from potential abnormal APs, and the beacon or code may be passed to the fraud detection service. The code may be a random number, an OAUTH code (a one-time password algorithm based on time (TOPT) or a one-time password algorithm based on HMAC (HOTP)), a digital signature (signed with the private key of the access point), etc. If the code matches the expected code, the access point may be marked as non-abnormal. The access point positioning data may be updated to include the location to prevent future reports from marking the access point as a potential abnormality. If the code does not match the expected code (or does not include the code), the fraud detection service may mark the access point as abnormal.

[0026] An exemplary corrective action includes changing an identifier (SSID, MAC address, or both) on a legitimate access point. This is accomplished by the fraud detection service contacting the legitimate access point using the known internal network address (e.g., wired Internet Protocol (IP) address) of the legitimate access point node. The legitimate access point can then switch to a new SSID and / or MAC address, and a new whitelist with the updated SSID and MAC address can be sent to the computing device to prevent any device from connecting to the malicious access point. In other examples, the access point identifier can be blacklisted until the malicious access point is removed.

[0027] In some examples, the determination of whether an access point is abnormal can be completed on a fraud detection service in the network based on a report from a computing device, such as a mobile device using the access point. In other examples, the computing device can be another access point. In another example, the determination of whether an access point is abnormal can be completed by the computing device itself in a distributed P2P manner. For example, the computing device can receive a periodically updated list of expected access point locations. The computing device can compare its location with the list to determine which access points are expected to be at a specific location. If the computing device detects an access point that is not in the expected location, or detects an access point with a duplicate identifier, it may refuse to connect to those access points and may send a report to a fraud detection service (which may then warn other devices). Reports from the computing device can be sent periodically (e.g., every predetermined amount of time), or reports from the computing device can be sent when a specific percentage of visible access points changes or when a new access point becomes visible.

[0028] In some examples, in addition to updating the whitelist, when an access point is determined to be abnormal or potentially abnormal, if the computing device is connected to an abnormal access point, the fraud detection service may instruct the computing device to disconnect from the abnormal access point. The computing device may be configured to prevent any network access or any access to any unencrypted site until it receives an indication from the fraud detection service that the access point to which it has been connected is not suspected to be abnormal.

[0029] Thus, the present disclosure solves the problem of computer networks where access points are easily impersonated by malicious actors. These malicious actors set up access points with the same identity as legitimate access points in order to steal data from unsuspecting client computing devices. This problem is solved by using a client device as a network scanner, which passes reports of visible access points (and other information) to a fraud detection service, which compares the expected location of the access points with the actual access point locations observed by the computing devices that are utilizing the network. Thus, the fraud detection system improves the security of computing systems by detecting and responding to threats such as evil twin access points without requiring IT support professionals to perform expensive or difficult signal monitoring operations. As previously mentioned, the location of the access point is determined by observation scanning of the computing device and is provided to the network-accessible fraud detection service. Once a threat is discovered, the system can take technical measures to eliminate false alarms and protect network users from those threats. The disclosed technology improves the functionality of computer systems by protecting networks from intrusions. The disclosed technology is fundamentally rooted in computing technology - in particular, the field of network security. As used herein, an access point that potentially has an evil twin access point operating nearby using the same identity is referred to as an anomalous access point.

[0030] Figure 1 An exemplary use case 100 of a fraud detection service 120 according to some examples of the present disclosure is illustrated. A computing device 122, illustrated as a cellular telephone, may move around a corporate or other network provided by various access points, such as network access points (APs) 102, 104, 108, 110, 114, and 116-R. An anomalous access point 116-F may impersonate a legitimate access point 116-R by broadcasting the same identity. For example, by broadcasting the same beacon frame, utilizing the same media access control (MAC) address and / or the same service set identifier (SSD). Although a whitelist of allowable access points may be provided to the computing device 122, which may utilize the identity of the access point, as noted, the identity may be impersonated by 116-F. If the computing device 122 connects to the access point 116-F, data sent over any network connection provided by 116-F may be compromised.

[0031] The computing device 122 may scan for beacons broadcast by the access points. The computing device 122 may then connect to one of the access points through an association and authentication process (e.g., as outlined by the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards). After connecting to the access point, software on the computing device 122 may temporarily restrict network access to applications on the computing device.

[0032] Computing device 122 may establish an encrypted channel and send an access point report with scan results showing nearby access points to fraud detection service 120. In some examples, the access point report may include the geographic location of computing device 122 and / or measurements of radio signals from the access points. The fraud detection service may utilize the information provided by computing device 122 to determine the observed locations of the access points in the report (according to one or more computing devices). The fraud detection service may use this together with access point location data indicating the expected locations of the access points.

[0033] Fraud detection service 120 can store multiple reports from multiple computing devices, including computing device 122 for later use to detect anomalous access points. For example, computing device 122 can provide its geographic location, measurement data, and scan results to fraud detection service 120. Fraud detection service 120 can utilize one or more other previously received reports stored from other computing devices to calculate the location of access points scanned by computing device 122.

[0034] For example, computing device 122 may receive beacon frames from access points 102, 104, 108, and 116-F. Based on measurements made by the computing device on these signals (e.g., RSSI, round trip time, time of flight measurements, etc.) and the geographic location of computing device 122, the fraud detection service may calculate the distance between the computing device and each access point. Using additional reports from additional computing devices, fraud detection service 120 may employ a trilateration algorithm to calculate the observed locations of the access points.

[0035] In some examples, in order to distinguish between the discovery of legitimate access points and anomalous access points by a computing device, the stored reports can be clustered based on the location of the computing device. For example, reports from computing devices that are located close to each other can be clustered. This allows the trilateration algorithm to calculate a solution by preventing reports from legitimate access points and reports from anomalous access points from being used simultaneously in the equation (and thereby preventing the trilateration algorithm from calculating a solution). In other examples, in lieu of a clustering algorithm, the inability to calculate a solution can be used as evidence that the access point is anomalous.

[0036] For example, a report from computing device 122 stored by fraud detection service 120 may be:

[0037] Mobile location clustering Access Point ID Measurement results (RSSI) A 102 30 A 104 50 A 108 75 A 116 47

[0038] Another computing device within the predetermined vicinity of computing device 122 may also be in location cluster A, and measurements of signals acquired by that computing device may be used together with the measurements of computing device 122 to calculate the location of the access point. Another location cluster (location cluster B) is represented by computing device 132, which is shown as a laptop device. Computing device 132 may also provide reports to fraud detection service 120. Computing device 132 may provide its location and a list of access points it sees (access points 110, 114, and 116-R), and in some examples, measurements of signals received from the access points. The fraud detection service may use the location of computing device 132 to determine that computing device 132 is in location cluster B. Reports from computing device 132 may be stored as:

[0039] Mobile location clustering Access Point ID Measurement results (RSSI) B 110 48 B 114 47 B 116 55

[0040] Using reports from other computing devices in cluster A and reports from computing device 122, the fraud detection system may generate access point location information for:

[0041] Access Point ID (Lat,Long) 102 (B,A) 104 (B,B) 108 (B,D) 116 (A,C)

[0042] The fraud detection service may conclude that the location of AP 116 at latitude A and longitude C is inconsistent with the location specified in the access point location data. For example, the access point location data may be:

[0043] Access Point ID Dimensions longitude 102 B A 104 B B 108 B D 110 D D 114 E E 116 C F

[0044] When computing device 122 reports an access point that identifies itself as access point 116, the fraud detection service may determine that its location does not match the expected location for access points with these identifiers and may flag it as a potential anomaly.

[0045] Although the above description uses computing device location and measurement results to determine the access point location, in other examples, other methods may be used. For example, the computing device may not report its location, but may report the identifiers of the access points it sees and the measurement results of the radio signals of these access points. Figure 1 , computing device 122 will report the identifiers of access points 102, 104, 108, and 116-F. Similarly, computing device 132 will report the identifiers of access points 110, 114, and 116-R.

[0046] The fraud detection service may utilize the access points and measurements visible to the computing device to determine which other access points should be visible to the computing device based on the access point location data. For example, the location of the computing device may be confirmed based on the measurements and known locations of the access points from the access point location data. In the case of a spoofed access point, one or more measurements may be incorrect—that is, the distance between the locations of the access points from the access point location data may be different than the measured distance (because it is actually the distance measured to the impostor).

[0047] In some examples, trilateration may be used to calculate each combination of three distances and access point locations for all visible access points. The location of the computing device may be the location that has the smallest amount of error (or that actually produces a location solution). The fraud detection system may identify specific access points that cause high errors or that cause the location in the trilateration equation to not converge by correlating common access points in various high-error or non-convergent solutions. For example, if the access point combination of APs 102, 104, and 108 produces a solution when combined in the trilateration equation, but when utilizing access point 116-F, the system may not be able to produce a solution to the trilateration equation (or may produce a solution with high error). Access points that result in the inability to locate the computing device may be marked as anomalies.

[0048] In other examples, the fraud detection service may use only visible access points communicated by the computing device. The access point location data may be a model that, given a list of one or more visible access points, outputs a probability that another given list of one or more access points will be visible. In this example, the computing device may calculate the probability of each visible access point given all other visible access points, and may then flag those probabilities that are below a predetermined threshold as potential anomalies. The model may be created based on multiple reports from multiple other computing devices.

[0049] For example, in Figure 1, computing device 122 sees access points 102, 104, and 108, as well as 116. These access point identifiers may be reported to the fraud detection service. The fraud detection service may generate a probability list P(x|y) for each access point reported as visible. P(x|y) in probability notation is the probability of x given y. Thus, the calculated probabilities may be P(102|104,108,116), P(104|102,108,116), P(116|102,104,108), P(108|116,104,102). As noted, these probabilities may be calculated using other reports from other computing devices in the same area as computing device 122. P(102|104,108,116), P(104|102,108,116), and P(108|116,104,102) may be greater than the lower threshold because these APs are often reported together, and therefore, APs 102, 104, and 108 may not be marked as anomalous. However, P(116|102,104,108) may be low because AP 116 is not often reported with APs 102, 104, and 108. In fact, AP 116 will likely be reported with AP 110 and AP 114, and AP 116-F may be marked as anomalous.

[0050] In examples where the access point location data is a geographic location, a threshold distance from a central access point reported by a computing device may be utilized. The central access point may be determined by clustering a set of visible access points based on the locations in the access point location data and taking the centroid. For example, in Figure 1 In the example embodiment, a distance threshold from the access point 104 may be utilized. Any access point having a location in the access point location data that exceeds a determined threshold distance from the central access point may be considered a potential anomaly.

[0051] Now go to Figure 2 , illustrates a method 200 for detecting abnormal access points according to some examples of the present disclosure. Method 200 can be performed by a fraud detection service, a computing device, etc. At operation 210, a set of network access points visible to a first computing device can be determined. For example, the computing device can scan one or more frequencies for beacons or other broadcast frames of advertising access points. These beacon frames may include one or more access point identifiers, such as a service set identifier (SSID), a MAC address of an access point, etc. In some examples, in addition to scanning one or more channels for one or more access points, the computing device also measures a metric corresponding to the channel, the metric indicating the distance between the computing device and the access point. For example, received signal strength, round-trip time, flight time measurement results, etc.

[0052] At operation 220, the system may determine that a first network access point in the set of network access points is broadcasting from a location that is not an expected location, and the system may determine that a particular access point is not broadcasting from an expected location. This determination may be based on the set of network access points visible to the first computing device and access point positioning data describing location information of the set of access points visible to the first computing device. For example, this may be accomplished by utilizing one of the previously discussed methods that utilizes the set of access points visible to the computing device. Figure 3-7 Additional methods for performing operation 220 are described. Figure 3-7 Each of the methods may utilize different information available to the system, such as different types of access point location data and whether measurements and / or computing device locations are available. At operation 230, the system may store an indication that the first access point is abnormal. For example, the data structure may store one or more of the following: an access point identifier, the number of times it was reported as abnormal, the time it was reported, and other information about the report, including data used to make a decision (e.g., the content of the report from the computing device), etc.

[0053] At 234, it is determined whether an action threshold is met. For example, the indication may be a fraud score that may be incremented each time an access point is detected as an anomaly. When the fraud score exceeds the determined threshold score, the action threshold may be met. In some examples, the threshold may be a single report, in which case the check at operation 234 may be optional. In other examples, the threshold may be more than one report. At operation 236, the fraud detection system may initiate one or more corrective actions. Examples of corrective actions include adding a particular access point to a blacklist, instructing a legitimate access point to change its identifier, performing a denial of service attack on an illegitimate access point, instructing a computing device to utilize a virtual private network (VPN) when connected to an access point that matches an identifier of a particular access point marked as an anomaly, or any other measure designed to prevent a computing device from connecting to an illegitimate access point or damaging its data.

[0054] Figure 3A flowchart of a method 320 for determining that a first network access point in a set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure is illustrated. Method 320 is an exemplary method of operation 220. At operation 350, the location of the computing device can be identified. For example, the computing device can utilize a global navigation satellite system (GNSS) to determine its geographic location. The geographic location of the computing device can be provided to a fraud detection service in a report along with a set of visible access points. At operation 360, the system can identify measurement reports of access points visible to the computing device. In some examples, the measurements can be collected during an access point scan. In other examples, the computing device can be temporarily connected to an access point to collect the measurements. Exemplary measurements include received signal strength indicator (RSSI), round trip time (RTT), and the like.

[0055] At operation 370, for one or more access points in the set of visible access points, the system may determine an observed position of the access point. For example, using the measurement determined at operation 360 and a plurality of other measurements from other computing devices, a distance between at least three computing devices and each access point may be determined. The distances may be used as inputs to a trilateration algorithm that outputs an observed position of the access point.

[0056] At operation 380, the system may determine whether any observed access point locations differ from the locations of the access point location data. Since the observed locations may not be as accurate as the locations determined and stored in the access point location data, the differences may utilize a threshold to allow for some natural variation. For example, a threshold difference may be employed such that if the difference between the observed location (from the access point location data) and the expected location is greater than a threshold, the access point may be marked as an anomaly. At operation 390, access points whose observed locations differ from the expected location by an amount greater than a threshold may be marked as an anomaly.

[0057] Figure 4 A flow chart of a method 420 for determining that a first network access point in a set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure is illustrated. Method 420 is an exemplary method of operation 220. It may be used in examples where the location of the computing device is known, the access point location data includes the geographic location where the access point is deployed, and the computing device does not provide measurement data. Figure 4At operation 450, the system may identify the location of the computing device. For example, the computing device may calculate its location using GNSS, using cellular positioning methods, inertial navigation, etc. At operation 460, the system may determine a set of one or more access points using access point positioning data within a threshold distance radius from the reported location of the computing device. Any access point reported by the computing device that is not in the set may be marked as an anomaly. The threshold may be set by an administrator, etc. The threshold may be specific to a particular area and may be adjusted up or down based on the detection of a false positive (e.g., through the confirmation process discussed).

[0058] Figure 5 A flow chart of a method 520 for determining that a first network access point in a set of network access points is broadcasting from a location that is not a desired location according to some examples of the present disclosure is illustrated. Method 520 is an exemplary method of operation 220. Figure 5 In an example of , the system does not have or utilize the location of the computing device, the measurement results, or the geographic location of the access point in the access point location data. Figure 5 In an example of , the access point location data includes a probability model that outputs a probability that a computing device sees a particular access point given that other access points are visible. Figure 5 Prior to the operation of the system, the system determines a probability model based on multiple reports from the computing device. For example, whenever a group of access points are visible together, the probability of seeing one access point in the group when another group is visible increases.

[0059] At operation 560, the system may utilize the determined probability of the access point location data to determine the probability that a particular access point will be visible based on the presence of other access points. At operation 570, if the probability is below a defined threshold, the system may mark the particular access point as an anomaly at operation 580. The threshold may be set by an administrator. In some examples, the threshold may be adjusted up or down based on the results of any confirmation method utilized as described above. Thus, for example, if an access point is marked as an anomaly but is confirmed by one of the above confirmation methods, the system may lower the probability threshold. In other examples, if the system does not mark an access point as an anomaly but it proves to be an anomaly, the system may lower the threshold. At 590, if there are additional access points in the list of visible access points, control may be passed to operation 550 to process the next access point in the list of visible access points.

[0060] Figure 6A flow chart of a method 620 of determining that a first network access point in a set of network access points is broadcasting from a location that is not a desired location according to some examples of the present disclosure is illustrated. Method 620 is an exemplary method of operation 220. Figure 6 In an example of , the system may have access to geolocation data of access points, but may not have access to geolocation data or measurement data of computing devices. At operation 650, the system may determine a central access point in the list of visible access points. For example, the access points may be clustered based on location (e.g., using a k-nearest clustering algorithm). The system may determine a centroid of the cluster, and the access point closest to the centroid may be used as the central access point.

[0061] At operation 660, the system may use the access point location data to identify the location of the central access point. At operation 670, the system may determine that access points in the set of visible access points are not within a threshold distance of the central access point location. At operation 680, the system may mark these access points as anomalies.

[0062] Figure 7 A flow chart of a method 720 for determining that a first network access point in a set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure is illustrated. Method 720 is an exemplary method of operation 220. Figure 7 In an example of , the system may access geolocation data and measurement data for access points, but may not access geolocation data for computing devices. At operation 750, the system may identify measurement reports that measure the strength of signals between the computing device and access points in the visible list. At operation 760, the system may utilize the measurement results and the access point location data to attempt to geolocate the computing device using a trilateration algorithm using various combinations of three access point measurements and location data. The trilateration algorithm may not calculate a location when an abnormal node is included in the calculation or the error may be above a predetermined threshold. In these cases, at operation 770, the node causing the failure may be marked as abnormal.

[0063] Figure 8 A block diagram of a fraud detection service 800 and a computing device 850 according to some examples of the present disclosure is illustrated. Fraud detection service 800 may be an example of fraud detection service 120. Computing device 850 may be an example of computing devices 122 and 132. The fraud detection service 800 may be an example of fraud detection service 120. The computing ... Figure 8 and Fig. 9Components shown in . The functions of each component are an exemplary arrangement of functions, and those of ordinary skill in the art who benefit from this disclosure will understand that other organizations are possible. For example, one or more functions of one or more components of fraud detection service 800 may be performed by one or more of the other components. Similarly, one or more functions of one or more components of computing device 850 may be performed by one or more other components. Fraud detection service 800 may be executed on a network accessible computing device, such as a server, desktop, laptop computer, etc. Computing device 850 may be any computing device capable of executing instructions and connected to one or more wireless access points. Exemplary computing devices include desktop computers, laptop computers, tablet computers, smart phones, other access points (e.g., performing the role of a computing device), etc.

[0064] The computing device 850 may include a network interface 860. The network interface 860 may provide one or more software and / or hardware components to enable the computing device to associate, authenticate, and connect to a wireless access point. This includes a network stack, such as the Transmission Control Protocol (TCP), Internet Protocol, Ethernet, one or more protocol layers specified by the 802.11 series of standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE), etc. As used herein, an access point and a computing device may communicate, authenticate, associate, connect, and otherwise operate in accordance with the IEEE 802.11 series of standards (such as 802.11ac).

[0065] The network interface 860 may also include a whitelist 875 that identifies one or more access points to which the computing device is authorized to connect. The whitelist may be a list of access points in a particular network, such as a corporate network. In some examples, the network interface 860 may limit scanning of access point beacon frames to access points identified in the whitelist 875. The whitelist 875 may identify access points by access point identifiers, which may include one or more of the following: SSID, MAC address, etc.

[0066] The network scanner 865 of the network interface 860 can scan one or more access points. For example, by listening to beacon frames sent by the access point at a specified frequency and according to a specified protocol (such as an 802.11 protocol). In some examples, the network scanner 865 can filter out access points that are not in the white list based on the identification of the access points in the white list. In some examples, the network scanner 865 can perform one or more measurements on the radio interface between the scanned access point and the computing device. For example, the received signal strength (which can be described by a received signal strength indicator or RSSI), the round-trip time, etc. In some examples, the network scanner 865 can associate and / or authenticate one or more access points to perform the measurements.

[0067] Once the computing device is connected to (e.g., associated and / or authenticated) an access point, network access limiter 870 can restrict network access of computing device 850 until the fraud detection process has been completed and the access point to which computing device 850 is connected is cleared as non-anomalous, for example, by fraud detection service 800.

[0068] The fraud detection interface 855 may receive the whitelist 875 from the fraud detection service 800 or from another component and store it on the computing device 850. The fraud detection interface 855 may send a report to the fraud detection service 800, including a list of access points detected (e.g., visible) by the computing device 850 (e.g., by the network scanner 865 of the computing device 850), and in some examples, one or more of: a measurement report; a geographic location; or an approximate location of the computing device 850. The fraud detection interface 855 may also receive an indication of whether the access point to which the computing device 850 is currently connected is considered abnormal. If the current access point is not abnormal, the fraud detection interface 855 may instruct the network access limiter 870 to allow full access. Otherwise, the fraud detection interface 855 may connect to a different access point or maintain limited access. The fraud detection interface 855 may also handle any requested verification from the fraud detection service 800. For example, the fraud detection service 800 may request the computing device 850 to verify the access point. The computing device may receive beacon frames from access points and forward them to the fraud detection service 800 for analysis.

[0069] The locator 853 may include hardware and / or software for determining the geographic location of the computing device 850. For example, a GNSS receiver and corresponding software are used to calculate the location of the computing device. Other location calculations may include using a cellular network to triangulate the location of the computing device.

[0070] The fraud detection service 800 may include a fraud detector 815 that can receive reports from computing devices, calculate access point location data (if necessary - e.g., for probabilistic modeling), determine whether an access point is anomalous, calculate a fraud score, etc. For example, the fraud detector 815 may perform Figure 2-7 The fraud verifier 810 can verify whether an access point marked as abnormal by the fraud detector 815 is being impersonated. For example, the fraud verifier 810 can have the network address of a legitimate access point and can send a request to the access point to broadcast a code or other message in its beacon frame. The code can be a cryptographic code, such as an HMAC or other key, which can include a time value or a counter value to prevent duplication. The time value and / or counter can be encrypted to prevent eavesdropping. If the computing device reports the presence of a secret value in the beacon, the access point can be marked as non-anomalous.

[0071] The fraud remediator 820 may take one or more corrective actions to remediate any potential anomalous access points. For example, by commanding the legitimate access point being impersonated to change the identity of the legitimate access point, updating the whitelist with the legitimate access point, and propagating the updated whitelist to computing devices, such as computing device 850. Other corrective actions include notifying an administrator, including the location of the impostor access point, etc. In some examples, the fraud detection service 800 may instruct another device to issue a denial of service attack on the illegal access point in order to exhaust the resources of the illegal access point and prevent legitimate clients from connecting and potentially sending sensitive data that may be intercepted. The database 825 may store access point location data, measurement reports, etc.

[0072] Fig. 9 A more detailed exemplary schematic diagram of a fraud detector 815 according to some examples of the present disclosure is illustrated. In some examples, the components of the fraud detector 815 may vary depending on the implementation. For example, fewer, more, or different components than those illustrated may be utilized. The access point locator 925 may utilize the list of visible access points 905, the location data 910 of the computing device, the measurement data 915 of the visible access points, and the AP location data 920 to calculate visible access points that should not be visible by calculating the observed location of each visible access point and then comparing it to the AP location data 920 indicating the expected location. For example, based on Figure 3 The output is an exception determination 945.

[0073] The probability determiner 930 can utilize the list of visible access points 905 and the access point location data 920 (in the form of a probability model) to determine whether visibility of a particular access point in the list of visible access points is unlikely. If the probability that an access point is visible given other access points is below a threshold probability, the access point can be marked as an anomaly. For example, the probability determiner 930 can implement Figure 5 method.

[0074] The threshold radius determiner 935 can utilize the computing device and the access point location data 920 and the location data 910 of the visible access points to determine a set of access points that should be visible given the current location of the computing device and the AP location data 920 by selecting access points in the visible list that are within a threshold distance of the computing device. APs that are not in the set of access points that should be visible can be marked as anomalies. In some examples, instead of utilizing the location of the computing device, the threshold radius determiner can calculate a central access point and utilize a threshold distance from the location of the access point to determine the set of access points that should be visible to the computing device. For example, the threshold radius determiner 935 can implement Figure 4 In some examples, the threshold radius determiner 935 may also implement Figure 6 , and the location of the computing device may not be taken as input.

[0075] The computing device locator 940 can utilize the AP location data 920, the measurement data 915, and the list of visible access points 905 to attempt to determine the location of the computing device. If an access point in the visible list is not at the location indicated by the data in the AP location data, the trilateration equation used may have an error value or may not converge to a solution. Access points that cause the trilateration equation to fail or have a high error rate may be marked as anomalies. The computing device locator 940 can implement Figure 7 method.

[0076] The AP locator 925, the probability determiner 930, the threshold radius determiner 935, and the computing device locator 940 can return an anomaly determination result 945, which can be used with other components of the fraud detection service to mitigate and / or confirm the designation of the access point as an anomaly. In some examples, one or more of these methods can be run depending on the data available to the fraud detector 815. In some examples, one, more, or all of these methods can be run, and an anomaly determination result from multiple components can be combined. For example, each result can be weighted and summed. The weight can be determined based on an administrator, or can be determined based on a regression machine learning model (e.g., logistic regression) that is trained using historical or determined reports from a computing device and is labeled with an indication of whether the access point is fraudulent.

[0077] Fig.10 The block diagram of an exemplary machine 1000 on which any one or more technologies (e.g., methods) discussed herein can be executed is illustrated. In alternative embodiments, the machine 1000 can be operated as a standalone device, or can be connected (e.g., networked) to other machines. In a network deployment, the machine 1000 can be operated with the capabilities of a server machine, a client machine, or both in a server-client network environment. In an example, the machine 1000 can act as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. The machine 1000 can be a computing device, such as a personal computer (PC), a tablet computer, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a server implementing a fraud detection service, a smart phone, a web device, a network router, an access point, a switch or a bridge, or any machine capable of executing the (sequential or otherwise) instructions for the actions taken by the machine. Additionally, while only a single machine is illustrated, the term “machine” should also be taken to include any collection of machines that individually or collectively execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein, such as cloud computing, software as a service (SaaS), and other computer cluster configurations. The machine 1000 may implement Figure 1-7 method, implementing components of the fraud detection service 800, and Fig. 9 computing device 850 and fraud detector 815 .

[0078] As described herein, examples may include or operate on a logic or multiple components, modules, or mechanisms (hereinafter referred to as "modules"). A module is a tangible entity (e.g., hardware) that is capable of performing a specified operation and may be configured or arranged in some manner. In an example, a circuit may be arranged (e.g., internally or relative to an external entity such as other circuits) as a module in a specified manner. In an example, all or part of one or more computer systems (e.g., independent client or server computer systems) or one or more hardware processors may be configured by firmware or software (e.g., instructions, application parts, or applications) to operate as a module for performing a specified operation. In an example, the software may reside on a machine-readable medium. In an example, the software, when executed by the underlying hardware of the module, causes the hardware to perform a specified operation.

[0079] Thus, the term "module" should be understood to encompass a tangible entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., temporarily) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operations described herein. Considering an example in which a module is temporarily configured, each module need not be instantiated at any time. For example, where a module includes a general-purpose hardware processor configured using software, the general-purpose hardware processor can be configured as a respective different module at different times. The software can thus configure the hardware processor, for example, to constitute a particular module at one time, and to constitute a different module at a different time.

[0080] The machine (e.g., computer system) 1000 may include a hardware processor 1002 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory 1004, and a static memory 1006, some or all of which may communicate with each other via an interconnect (e.g., a bus) 1008. The machine 1000 may also include a display unit 1010, an alphanumeric input device 1012 (e.g., a keyboard), and a user interface (UI) navigation device 1014 (e.g., a mouse). In an example, the display unit 1010, the input device 1012, and the UI navigation device 1014 may be a touch screen display. The machine 1000 may additionally include a storage device (e.g., a drive unit) 1016, a signal generating device 1018 (e.g., a speaker), a network interface device 1020, and one or more sensors 1021, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors. The machine 1000 may include an output controller 1028, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.)) connection to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.).

[0081] The storage device 1016 may include a machine-readable medium 1022 on which is stored one or more sets of data structures or instructions 1024 (e.g., software) embodied or utilized by any one or more of the techniques or functionality described herein. The instructions 1024 may also reside, in whole or in part, within the main memory 1004, within the static memory 1006, or within the hardware processor 1002 during execution of the instructions 1024 by the machine 1000. In an example, one or any combination of the hardware processor 1002, the main memory 1004, the static memory 1006, or the storage device 1016 may constitute a machine-readable medium.

[0082] Although the machine-readable medium 1022 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (eg, a centralized or distributed database and / or associated caches and servers) configured to store one or more instructions 1024 .

[0083] The term "machine-readable medium" may include any medium capable of storing, encoding, or carrying instructions executed by the machine 1000 and causing the machine 1000 to perform any one or more of the techniques of the present disclosure, or any medium capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting examples of machine-readable media may include solid-state memory and optical and magnetic media. Specific examples of machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; disks, such as internal hard disks and removable disks; magneto-optical disks; random access memory (RAM); solid-state drives (SSD); and CD-ROM and DVD-ROM disks. In some examples, the machine-readable medium may include non-transitory machine-readable media. In some examples, the machine-readable medium may include machine-readable media that is not a temporary propagation signal.

[0084] The instructions 1024 may also be sent or received over a communication network 1026 using a transmission medium via the network interface device 1020. The machine 1000 may communicate with one or more other machines using any of a variety of transmission protocols (e.g., frame relay, Internet Protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Exemplary communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile telephone network (e.g., a cellular network), a plain old telephone (POTS) network, and a wireless data network (e.g., a wireless network known as a Wi-Fi network). The Institute of Electrical and Electronics Engineers (IEEE) 802.11 series of standards, known as IEEE 802.16 series of standards), IEEE 802.15.4 series of standards, Long Term Evolution (LTE) series of standards, Universal Mobile Telecommunications System (UMTS) series of standards, peer-to-peer (P2P) networks, etc. In an example, the network interface device 1020 may include one or more physical jacks (e.g., Ethernet, coaxial, or telephone jacks) or one or more antennas to connect to the communication network 1026. In an example, the network interface device 1020 may include multiple antennas to use at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technology for wireless communication. In some examples, the network interface device 1020 may use multi-user MIMO technology for wireless communication.

[0085] Additional Notes and Examples

[0086] Example 1 is a method for detecting a rogue network access point, the method comprising: using one or more hardware processors: determining a set of network access points visible to a first computing device; determining, based on the set of network access points and access point location data describing location information of the set of network access points, that a first network access point in the set of network access points is broadcasting from a location that is not an expected location; storing an indication that the first network access point is suspected of being anomalous based on the determination that the first network access point is broadcasting from a location that is not an expected location; and initiating at least one corrective action based on the indication that the access point is anomalous.

[0087] In Example 2, the subject matter of Example 1 includes: wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a location of the first computing device; identifying a measurement report that measures a strength of a signal between the computing device and the first network access point; calculating an observed location of the first network access point based on the measurement report and other measurement reports from computing devices other than the first computing device; and determining that the observed location of the first network access point is not within a threshold distance of a location of the first network access point described by the access point positioning data.

[0088] In Example 3, the subject matter of Example 2 includes: wherein determining the location of the computing device includes receiving the location from the first computing device.

[0089] In Example 4, the subject matter of Examples 1-3 includes: wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a location of the first computing device; and determining, based on the access point positioning data, that the first network access point is not within a threshold distance of the expected location of the first network access point.

[0090] In Example 5, the subject matter of Examples 1-4 includes: wherein the access point location data includes a probability model including a probability of seeing an access point in the set of network access points visible to the first computing device given that at least one other access point in the set of access points visible to the first computing device is visible; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes determining that the probability of seeing the first network access point given that the set of network access points is visible to the first computing device is below a threshold probability.

[0091] In Example 6, the subject matter of Example 5 includes wherein the probabilistic model is created based on a plurality of sets of network access points reported as visible from a plurality of computing devices.

[0092] In Example 7, the subject matter of Examples 1-6 includes: wherein determining that the first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a central access point in a set of access points visible to the first computing device; identifying a location of the central access point using the access point positioning data; and determining that the first network access point is not within a threshold distance of the location of the central access point.

[0093] In Example 8, the subject matter of Examples 1-7 includes: wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: identifying a measurement report that measures a strength of a signal between the first computing device and the first network access point; calculating a plurality of locations of the computing device using a trilateration algorithm based on the measurement report and other measurement reports from other computing devices for changing a combination of three access points in the set of network access points visible to the first computing device; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: determining that at least one of the plurality of locations involving the first network access point exceeds an error threshold.

[0094] In Example 9, the subject matter of Examples 1-8 includes: wherein storing the indication comprises storing a fraud score corresponding to the first network access point, and wherein initiating at least one corrective action comprises initiating at least one corrective action when the fraud score exceeds a configured threshold.

[0095] In Example 10, the subject matter of Examples 1-9 includes: wherein initiating the at least one corrective action includes sending an indication to the first computing device that the first network access point is abnormal.

[0096] In Example 11, the subject matter of Examples 1-10 includes wherein initiating the at least one corrective action comprises adding the first network access point to a blacklist.

[0097] In Example 12, the subject matter of Examples 1-11 includes wherein initiating the at least one corrective action comprises instructing a legitimate network access point to change its identifier with an identifier that matches an identifier of the first network access point marked as anomalous.

[0098] In Example 13, the subject matter of Examples 1-12 includes wherein the set of network access points visible to the first computing device includes network access points identified from an access point scan that are within a wireless range of the first computing device.

[0099] In Example 14, the subject matter of Examples 1-13 includes wherein the set of network access points visible to the first computing device comprises a set of media access control (MAC) addresses.

[0100] In Example 15, the subject matter of Examples 1-14 includes wherein the set of network access points visible to the first computing device comprises a set of service set identifiers (SSIDs).

[0101] In Example 16, the subject matter of Examples 1-15 includes wherein the set of network access points visible to the first computing device comprises a set of MAC address and SSID pairs.

[0102] Example 17 is a machine-readable medium for detecting a rogue network access point, the machine-readable medium comprising instructions that, when executed by a machine, cause the machine to perform operations comprising: determining a set of network access points visible to a first computing device; determining, based on the set of network access points and access point location data describing location information of the set of network access points, that a first network access point in the set of network access points is broadcasting from a location that is not an expected location; storing an indication that the first network access point is suspected of being anomalous based on the determination that the first network access point is broadcasting from a location that is not an expected location; and initiating at least one corrective action based on the indication that the access point is anomalous.

[0103] In Example 18, the subject matter of Example 17 includes: wherein the operation of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a location of the first computing device; identifying a measurement report that measures a strength of a signal between the computing device and the first network access point; calculating an observed location of the first network access point based on the measurement report and other measurement reports from computing devices other than the first computing device; and determining that the observed location of the first network access point is not within a threshold distance of a location of the first network access point described by the access point positioning data.

[0104] In Example 19, the subject matter of Example 18 includes: wherein the operation of determining the location of the computing device includes receiving the location from the first computing device.

[0105] In Example 20, the subject matter of Examples 17-193 includes: wherein the operation of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a location of the first computing device; and determining that the first network access point is not within a threshold distance of the expected location of the first network access point based on the access point positioning data.

[0106] In Example 21, the subject matter of Examples 17-20 includes: wherein the operations further include: wherein the access point location data includes a probability model, the probability model including a probability of seeing an access point in the set of network access points visible to the first computing device given that at least one other access point in the set of access points visible to the first computing device is visible; and wherein the operation of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: determining that the probability of seeing the first network access point given that the set of network access points is visible to the first computing device is below a threshold probability.

[0107] In Example 22, the subject matter of Example 21 includes: wherein the probabilistic model is created based on multiple sets of network access points reported as visible from multiple computing devices.

[0108] In Example 23, the subject matter of Examples 17-22 includes: wherein determining that the first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a central access point in the set of access points visible to the first computing device; identifying a location of the central access point using the access point positioning data; and determining that the first network access point is not within a threshold distance of the location of the central access point.

[0109] In Example 24, the subject matter of Examples 17-23 includes: wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: identifying a measurement report that measures a strength of a signal between the first computing device and the first network access point; calculating a plurality of locations of the computing device using a trilateration algorithm based on the measurement report and other measurement reports from other computing devices for use in changing a combination of three access points in the set of network access points visible to the first computing device; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: determining that at least one of the plurality of locations involving the first network access point exceeds an error threshold.

[0110] In Example 25, the subject matter of Examples 17-24 includes: wherein the operation of storing the indication includes: storing a fraud score corresponding to the first network access point, and wherein the operation of initiating at least one corrective action includes: initiating at least one corrective action when the fraud score exceeds a configured threshold.

[0111] In Example 26, the subject matter of Examples 17-25 includes: wherein the operation of initiating the at least one corrective action includes: sending an indication to the first computing device that the first network access point is abnormal.

[0112] In Example 27, the subject matter of Examples 17-26 includes: wherein the operation of initiating the at least one corrective action includes adding the first network access point to a blacklist.

[0113] In Example 28, the subject matter of Examples 17-27 includes wherein the operation of initiating the at least one corrective action comprises instructing a legitimate network access point to change its identifier with an identifier that matches an identifier of the first network access point marked as anomalous.

[0114] In Example 29, the subject matter of Examples 17-28 includes wherein the set of network access points visible to the first computing device includes network access points identified from an access point scan that are within a wireless range of the first computing device.

[0115] In Example 30, the subject matter of Examples 17-29 includes: wherein the set of network access points visible to the first computing device includes a set of media access control (MAC) addresses.

[0116] In Example 31, the subject matter of Examples 17-30 includes: wherein the set of network access points visible to the first computing device includes a set of service set identifiers (SSIDs).

[0117] In Example 32, the subject matter of Examples 17-31 includes: wherein the set of network access points visible to the first computing device includes a set of MAC address and SSID pairs.

[0118] Example 33 is a device for detecting a rogue network access point, the device comprising: a hardware processor; a memory comprising instructions that, when executed, cause the hardware processor to perform operations comprising: determining a set of network access points visible to a first computing device; determining, based on the set of network access points and access point location data describing location information of the set of network access points, that a first network access point in the set of network access points is broadcasting from a location that is not an expected location; storing an indication that the first network access point is suspected of being anomalous based on the determination that the first network access point is broadcasting from a location that is not an expected location; and initiating at least one corrective action based on the indication that the access point is anomalous.

[0119] In Example 34, the subject matter of Example 33 includes: wherein the operation of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a location of the first computing device; identifying a measurement report that measures a strength of a signal between the computing device and the first network access point; calculating an observed location of the first network access point based on the measurement report and other measurement reports from computing devices other than the first computing device; and determining that the observed location of the first network access point is not within a threshold distance of a location of the first network access point described by the access point positioning data.

[0120] In Example 35, the subject matter of Example 34 includes: wherein the operation of determining the location of the computing device includes receiving the location from the first computing device.

[0121] In Example 36, the subject matter of Examples 33-35 includes: wherein the operation of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a location of the first computing device; and determining, based on the access point positioning data, that the first network access point is not within a threshold distance of the expected location of the first network access point.

[0122] In Example 37, the subject matter of Examples 33-36 includes: wherein the operations further include: wherein the access point location data includes a probability model, the probability model including a probability of seeing an access point in the set of network access points visible to the first computing device given that at least one other access point in the set of access points visible to the first computing device is visible; and wherein the operation of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: determining that the probability of seeing the first network access point given that the set of network access points is visible to the first computing device is below a threshold probability.

[0123] In Example 38, the subject matter of Example 37 includes: wherein the probabilistic model is created based on multiple sets of network access points reported as visible from multiple computing devices.

[0124] In Example 39, the subject matter of Examples 33-38 includes: wherein determining that the first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: identifying a central access point in the set of access points visible to the first computing device; identifying the location of the central access point using the access point positioning data; and determining that the first network access point is not within a threshold distance of the location of the central access point.

[0125] In Example 40, the subject matter of Examples 33-39 includes: wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: identifying a measurement report that measures a strength of a signal between the first computing device and the first network access point; calculating a plurality of locations of the computing device using a trilateration algorithm based on the measurement report and other measurement reports from other computing devices for use in changing a combination of three access points in the set of network access points visible to the first computing device; and wherein determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: determining that at least one of the plurality of locations involving the first network access point exceeds an error threshold.

[0126] In Example 41, the subject matter of Examples 33-40 includes: wherein the operation of storing the indication includes: storing a fraud score corresponding to the first network access point, and wherein the operation of initiating at least one corrective action includes: initiating at least one corrective action when the fraud score exceeds a configured threshold.

[0127] In Example 42, the subject matter of Examples 33-41 includes: wherein the operation of initiating the at least one corrective action includes: sending an indication to the first computing device that the first network access point is abnormal.

[0128] In Example 43, the subject matter of Examples 33-42 includes: wherein the operation of initiating the at least one corrective action includes adding the first network access point to a blacklist.

[0129] In Example 44, the subject matter of Examples 33-43 includes wherein the operation of initiating the at least one corrective action comprises instructing a legitimate network access point to change its identifier with an identifier that matches an identifier of the first network access point marked as anomalous.

[0130] In Example 45, the subject matter of Examples 33-44 includes wherein the set of network access points visible to the first computing device includes network access points identified from an access point scan that are within a wireless range of the first computing device.

[0131] In Example 46, the subject matter of Examples 33-45 includes: wherein the set of network access points visible to the first computing device includes a set of media access control (MAC) addresses.

[0132] In Example 47, the subject matter of Examples 33-46 includes: wherein the set of network access points visible to the first computing device includes a set of service set identifiers (SSIDs).

[0133] In Example 48, the subject matter of Examples 33-47 includes: wherein the set of network access points visible to the first computing device includes a set of MAC address and SSID pairs.

[0134] Example 49 is an apparatus for detecting a rogue network access point, the apparatus comprising: means for determining a set of network access points visible to a first computing device; means for determining, based on the set of network access points and access point location data describing location information of the set of network access points, that a first network access point in the set of network access points is broadcasting from a location that is not an expected location; means for storing an indication that the first network access point is suspected of being anomalous based on the determination that the first network access point is broadcasting from a location that is not an expected location; and means for initiating at least one corrective action based on the indication that the access point is anomalous.

[0135] In Example 50, the subject matter of Example 49 includes: wherein the means for determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location comprises: means for identifying a location of the first computing device; means for identifying a measurement report that measures a strength of a signal between the computing device and the first network access point; means for calculating an observed location of the first network access point based on the measurement report and other measurement reports from computing devices other than the first computing device; and means for determining that the observed location of the first network access point is not within a threshold distance of a location of the first network access point described by the access point positioning data.

[0136] In Example 51, the subject matter of Example 50 includes: wherein the means for determining the location of the computing device includes receiving the location from the first computing device.

[0137] In Example 52, the subject matter of Examples 49-51 includes: wherein the means for determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes: means for identifying a location of the first computing device; and means for determining, based on the access point positioning data, that the first network access point is not within a threshold distance of the expected location of the first network access point.

[0138] In Example 53, the subject matter of Examples 49-52 includes: wherein the access point location data includes a probability model including a probability of seeing an access point in the set of network access points visible to the first computing device given that at least one other access point in the set of access points visible to the first computing device is visible; and wherein means for determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location includes determining that the probability of seeing the first network access point given that the set of network access points is visible to the first computing device is below a threshold probability.

[0139] In Example 54, the subject matter of Example 53 includes: wherein the probabilistic model is created based on multiple sets of network access points reported as visible from multiple computing devices.

[0140] In Example 55, the subject matter of Examples 49-54 includes: wherein determining that the first network access point in a set of network access points is broadcasting from a location that is not an expected location includes: means for identifying a central access point in the set of access points visible to the first computing device; means for identifying the location of the central access point using the access point positioning data; and means for determining that the first network access point is not within a threshold distance of the location of the central access point.

[0141] In Example 56, the subject matter of Examples 49-55 includes: wherein the means for determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location comprises: means for identifying a measurement report measuring a strength of a signal between the first computing device and the first network access point; means for calculating a plurality of locations of the computing device using a trilateration algorithm based on the measurement report and other measurement reports from other computing devices, means for changing a combination of three access points in the set of network access points visible to the first computing device; and wherein the means for determining that a first network access point in the set of network access points is broadcasting from a location that is not a desired location comprises: determining that at least one of the plurality of locations involving the first network access point exceeds an error threshold.

[0142] In Example 57, the subject matter of Examples 49-56 includes: wherein the means for storing the indication includes: means for storing a fraud score corresponding to the first network access point, and wherein initiating at least one corrective action includes: initiating at least one corrective action when the fraud score exceeds a configured threshold.

[0143] In Example 58, the subject matter of Examples 49-57 includes: wherein the means for initiating at least one corrective action includes: means for sending an indication to the first computing device that the first network access point is abnormal.

[0144] In Example 59, the subject matter of Examples 49-58 includes: wherein the means for initiating the at least one corrective action includes means for adding the first network access point to a blacklist.

[0145] In Example 60, the subject matter of Examples 49-59 includes wherein the means for initiating the at least one corrective action comprises means for instructing a legitimate network access point to change its identifier with an identifier that matches an identifier of the first network access point marked as anomalous.

[0146] In Example 61, the subject matter of Examples 49-60 includes: wherein the set of network access points visible to the first computing device includes network access points identified from an access point scan that are within a wireless range of the first computing device.

[0147] In Example 62, the subject matter of Examples 49-61 includes: wherein the set of network access points visible to the first computing device includes a set of media access control (MAC) addresses.

[0148] In Example 63, the subject matter of Examples 49-62 includes: wherein the set of network access points visible to the first computing device includes a set of service set identifiers (SSIDs).

[0149] In Example 64, the subject matter of Examples 49-63 includes: wherein the set of network access points visible to the first computing device includes a set of MAC address and SSID pairs.

[0150] Example 65 is at least one machine-readable medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform operations to implement any of Examples 1-64.

[0151] Example 66 is an apparatus comprising means for implementing any of Examples 1-64.

[0152] Example 67 is a system implementing any of Examples 1-64.

[0153] Example 68 is a method of implementing any of Examples 1-64.

Claims

1. A first computing device for detecting a fraudulent network access point, the first computing device comprising: Hardware processor; A memory comprising instructions that, when executed, cause the hardware processor to perform operations comprising: receiving identification information about a first set of a plurality of wireless access points from a second computing device, the second computing device currently being within simultaneous wireless range of the first set of the plurality of wireless access points; accessing, from a data store, pre-stored co-occurrence information describing a likelihood that two or more wireless access points in the first set are simultaneously within a same transmission range based on the received identification information regarding the first set of the plurality of wireless access points that are simultaneously within a wireless range of the second computing device; determining, based on the accessed pre-stored co-occurrence information, a likelihood that a first wireless access point in the first set and one or more wireless access points in the first set are simultaneously in the same transmission range; Assess whether the identified likelihood meets threshold safety conditions; In response to the determined likelihood failing to satisfy the threshold security condition, determining that a first wireless access point in the first set of the plurality of wireless access points is suspicious; storing an indication that the first wireless access point is suspicious; and At least one corrective action is initiated based on the indication that the first wireless access point is suspicious.

2. The first computing device according to claim 1, wherein: The operations of initiating at least one corrective action include: causing transmission of a message in a beacon frame of a known legitimate access point corresponding to the first wireless access point, the message comprising a code; receiving the code from the second computing device; and A determination is made based on the received code that the first wireless access point is the known legitimate access point.

3. The first computing device according to claim 2, wherein: The operation of causing the message to be transmitted in the beacon frame of the known legitimate access point corresponding to the first wireless access point includes sending the code to the known legitimate access point through a wired connection with the known legitimate access point.

4. The first computing device according to claim 1, wherein: The operations of initiating at least one corrective action include: A denial of service attack is caused to be performed on the first wireless access point to prevent computing devices from connecting to the first wireless access point.

5. The first computing device according to claim 1, wherein: The pre-stored co-occurrence information is based on other sets of access points visible to other computing devices sent to the first computing device by a plurality of other computing devices.

6. The first computing device of claim 1, wherein: The co-occurrence information includes a set of probabilities.

7. The first computing device of claim 1, wherein: The operation of initiating at least one corrective action includes changing an identifier of a known legitimate access point corresponding to the first wireless access point.

8. The first computing device of claim 1, wherein: The act of initiating at least one corrective action based on the indication that the first wireless access point is suspicious is taken in response to an indication that a fraud score for the first wireless access point has increased above a threshold fraud score.

9. A method for detecting a rogue network access point, the method comprising: At the first computing device: receiving identification information about a first set of a plurality of wireless access points from a second computing device, the second computing device currently being within simultaneous wireless range of the first set of the plurality of wireless access points; accessing, from a data store, pre-stored co-occurrence information describing a likelihood that two or more wireless access points in the first set are simultaneously within a same transmission range based on the received identification information regarding the first set of the plurality of wireless access points that are simultaneously within a wireless range of the second computing device; determining, based on the accessed pre-stored co-occurrence information, a likelihood that a first wireless access point in the first set and one or more wireless access points in the first set are simultaneously within the same transmission range; Assess whether the identified likelihood meets threshold safety conditions; In response to the determined likelihood failing to satisfy the threshold security condition, determining that a first wireless access point in the first set of the plurality of wireless access points is suspicious; storing an indication that the first wireless access point is suspicious; and At least one corrective action is initiated based on the indication that the first wireless access point is suspicious.

10. The method according to claim 9, wherein: Initiating at least one corrective action includes: causing transmission of a message in a beacon frame of a known legitimate access point corresponding to the first wireless access point, the message comprising a code; receiving the code from the second computing device; and A determination is made based on the received code that the first wireless access point is the known legitimate access point.

11. The method according to claim 10, wherein: The operation of causing the message to be transmitted in the beacon frame of the known legitimate access point corresponding to the first wireless access point includes sending the code to the known legitimate access point through a wired connection with the known legitimate access point.

12. The method according to claim 9, wherein: Initiating at least one corrective action includes: A denial of service attack is caused to be performed on the first wireless access point to prevent computing devices from connecting to the first wireless access point.

13. The method according to claim 9, wherein: The pre-stored co-occurrence information is based on other sets of access points visible to other computing devices sent to the first computing device by a plurality of other computing devices.

14. The method according to claim 9, wherein: The co-occurrence information includes a set of probabilities.

15. The method according to claim 9, wherein: The operation of initiating at least one corrective action includes changing an identifier of a known legitimate access point corresponding to the first wireless access point.

16. The method according to claim 9, wherein: The act of initiating at least one corrective action based on the indication that the first wireless access point is suspicious is taken in response to an indication that a fraud score of the first wireless access point increases above a threshold fraud score.

17. A first computing device for detecting a fraudulent network access point, the first computing device comprising: means for receiving identification information about a first set of a plurality of wireless access points from a second computing device, the second computing device currently being within a simultaneous wireless range of the first set of the plurality of wireless access points; means for accessing, from a data storage, pre-stored co-occurrence information based on the received identification information regarding the first set of the plurality of wireless access points that are simultaneously within wireless range of the second computing device, the pre-stored co-occurrence information describing a likelihood that two or more wireless access points in the first set are simultaneously within a same transmission range; means for determining, based on the accessed pre-stored co-occurrence information, a likelihood that a first wireless access point in the first set is simultaneously within the same transmission range as one or more wireless access points in the first set; a unit for evaluating whether the determined likelihood satisfies a threshold safety condition; a unit for determining that a first wireless access point in the first set of the plurality of wireless access points is suspicious in response to the determined likelihood failing to satisfy the threshold security condition; means for storing an indication that the first wireless access point is suspicious; as well as Means for initiating at least one corrective action based on the indication that the first wireless access point is suspicious.

18. The first computing device of claim 17, wherein: Means for initiating at least one corrective action include: means for causing transmission of a message in a beacon frame of a known legitimate access point corresponding to the first wireless access point, the message comprising code; means for receiving the code from the second computing device; and Means for determining, based on the received code, that the first wireless access point is the known legitimate access point.

19. The first computing device of claim 18, wherein: Means for causing transmission of the message in the beacon frame of the known legitimate access point corresponding to the first wireless access point includes means for sending the code to the known legitimate access point via a wired connection to the known legitimate access point.

20. The first computing device of claim 17, wherein: Means for initiating at least one corrective action include: Means for causing a denial of service attack on the first wireless access point to prevent computing devices from connecting to the first wireless access point.

21. A computing device for detecting a fraudulent network access point, the computing device comprising: Hardware processor; A memory comprising instructions that, when executed, cause the hardware processor to perform operations comprising: identifying a set of wireless access points from which the transceiver has received wireless messages within a specified time period, the set comprising at least four wireless access points; identifying, for each access point in the set of wireless access points, a signal measurement corresponding to the received wireless message; identifying, using a database, previously saved geographic location coordinates for each access point in the set of wireless access points; performing a plurality of trilateration calculations to locate the transceiver, each trilateration calculation of the plurality of trilateration calculations using: a unique combination of three wireless access points in the set of wireless access points, corresponding signal measurements, and corresponding geographic location coordinates; Determining, based on results of the plurality of trilateration calculations, that a first access point in the set of access points comprises causing the trilateration calculation to fail to produce a geographic location or to have an error above a threshold in the trilateration calculation; as well as In response to determining that the first access point is included in the trilateration calculation so that the trilateration calculation cannot converge or has an error value above the threshold, marking the first access point as abnormal, and one or more of the following: causing the connection between the transceiver and the first access point to be terminated; notifying an administrator; causing a denial of service attack on the first access point; changing the identification of a second access point; or causing a code to be broadcast on a broadcast message of the second access point.

22. The computing device of claim 21, further comprising the transceiver.

23. The computing device of claim 21, wherein: The operation of identifying the set of wireless access points includes: Scanning for beacons broadcast by access points in the set of wireless access points.

24. The computing device of claim 21, wherein: The operations also include: The set of wireless access points and the signal measurements are received over a network and from a second computing device that physically includes the transceiver.

25. The computing device of claim 24, wherein: Receiving the set of wireless access points and the signal measurements over the network includes communicating with the transceiver through the first access point using an encrypted channel.

26. The computing device of claim 21, wherein: The signal measurement result is one of: received signal strength, round trip time or time of flight measurement result.

27. The computing device of claim 21, wherein: The operations also include: receiving a plurality of geographic location reports of the set of access points from a plurality of computing devices; and The geographic location coordinates are saved in the database for each access point in the set of wireless access points based on the plurality of geographic location reports.

28. A method for detecting a rogue network access point, the method comprising: Using one or more processors of a computing device: identifying a set of wireless access points from which the transceiver has received wireless messages within a specified time period, the set comprising at least four wireless access points; identifying, for each access point in the set of wireless access points, a signal measurement corresponding to the received wireless message; identifying, using a database, previously saved geographic location coordinates for each access point in the set of wireless access points; performing a plurality of trilateration calculations to locate the transceiver, each trilateration calculation of the plurality of trilateration calculations using: a unique combination of three wireless access points in the set of wireless access points, corresponding signal measurements, and corresponding geographic location coordinates; Determining, based on results of the plurality of trilateration calculations, that a first access point in the set of access points comprises causing the trilateration calculation to fail to produce a geographic location or to have an error above a threshold in the trilateration calculation; as well as In response to determining that the first access point is included in the trilateration calculation so that the trilateration calculation cannot converge or has an error value above the threshold, marking the first access point as abnormal, and one or more of the following: causing the connection between the transceiver and the first access point to be terminated; notifying an administrator; causing a denial of service attack on the first access point; changing the identification of a second access point; or causing a code to be broadcast on a broadcast message of the second access point.

29. The method according to claim 28, wherein: The transceiver is connected to the one or more processors using a hardware bus, and wherein identifying the set of wireless access points from which the transceiver has received wireless messages within the specified time period includes wirelessly receiving the wireless messages from the transceiver.

30. The method of claim 28, wherein: Identifying the set of wireless access points includes: Scanning for beacons broadcast by access points in the set of wireless access points.

31. The method of claim 28, further comprising: The set of wireless access points and the signal measurements are received over a network and from a second computing device that physically includes the transceiver.

32. The method according to claim 31, wherein: Receiving the set of wireless access points and the signal measurements over the network includes communicating with the transceiver through the first access point using an encrypted channel.

33. The method of claim 28, wherein: The signal measurement result is one of: received signal strength, round trip time or time of flight measurement result.

34. The method of claim 28, wherein: The method further comprises: receiving a plurality of geographic location reports of the set of access points from a plurality of computing devices; and The geographic location coordinates are saved in the database for each access point in the set of wireless access points based on the plurality of geographic location reports.

35. A machine-readable storage device storing instructions for detecting a rogue network access point, the instructions, when executed by a machine, causing the machine to perform operations comprising: identifying a set of wireless access points from which the transceiver has received wireless messages within a specified time period, the set comprising at least four wireless access points; identifying, for each access point in the set of wireless access points, a signal measurement corresponding to the received wireless message; identifying, using a database, previously saved geographic location coordinates for each access point in the set of wireless access points; performing a plurality of trilateration calculations to locate the transceiver, each trilateration calculation of the plurality of trilateration calculations using: a unique combination of three wireless access points in the set of wireless access points, corresponding signal measurements, and corresponding geographic location coordinates; determining, based on results of the plurality of trilateration calculations, that a first access point in the set of access points is included in the trilateration calculation such that the trilateration calculation fails to produce a geographic location or has an error above a threshold; as well as In response to determining that the first access point is included in the trilateration calculation so that the trilateration calculation cannot converge or has an error value above the threshold, marking the first access point as abnormal, and one or more of the following: causing the connection between the transceiver and the first access point to be terminated; notifying an administrator; causing a denial of service attack on the first access point; changing the identification of a second access point; or causing a code to be broadcast on a broadcast message of the second access point.

36. The machine-readable storage device of claim 35, wherein: The transceiver is connected to the machine using a hardware bus, and wherein identifying the set of wireless access points from which the transceiver has received wireless messages within the specified time period includes wirelessly receiving the wireless messages from the transceiver.

37. The machine-readable storage device of claim 35, wherein: The operation of identifying the set of wireless access points includes: Scanning for beacons broadcast by access points in the set of wireless access points.

38. The machine-readable storage device of claim 35, wherein: The operations also include: The set of wireless access points and the signal measurements are received over a network and from a second computing device that physically includes the transceiver.

39. The machine-readable storage device of claim 38, wherein: Receiving the set of wireless access points and the signal measurements over the network includes communicating with the transceiver through the first access point using an encrypted channel.

40. The machine-readable storage device of claim 35, wherein: The signal measurement result is one of: received signal strength, round trip time or time of flight measurement result.

Images