IoT Analytics Poisoning Detection in WLANs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Wi-Fi network technologies are vulnerable to analytics poisoning attacks, where malicious devices can emulate multiple stations by manipulating RSSI values, leading to false data injection and compromised analytics integrity.
Innovation Solution
An analytics containment system that tracks RSSI values and time stamps of connected stations, applies heuristics to identify emulated stations by monitoring RSSI changes and handoffs between access points, and flags suspicious data injection patterns to prevent contamination of analytics data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If multiple virtual Wi-Fi network interface cards are emulated to appear as separate devices, then the quantity of analytics data collected increases, but the reliability of analytics data deteriorates due to false data injection
Solution Approach 1:
The system performs preliminary tracking of RSSI values and time stamps for each station before analytics processing. By establishing baseline RSSI patterns and temporal relationships in advance, the system can identify emulated stations proactively rather than reactively, preventing false data from contaminating the analytics pool.
Solution Approach 2:
The system implements continuous feedback loops where RSSI measurements from multiple access points are constantly monitored and compared. When anomalies are detected in RSSI patterns or when multiple stations show identical RSSI values across different access points, the system feeds this information back to flag potential emulated stations, creating a self-correcting mechanism that maintains data reliability.
2Reliability
If RSSI values are tracked across multiple access points to identify emulated stations, then the reliability of analytics data improves, but the device complexity increases due to centralized tracking requirements
Solution Approach 1:
The centralized Wi-Fi controller is designed to perform multiple functions: it manages access point operations, tracks RSSI values across all access points, identifies emulated stations, and maintains analytics integrity. By consolidating these diverse functions into a single multi-functional controller, the system avoids the complexity of distributed tracking infrastructure while achieving reliable emulated station detection.
Solution Approach 2:
The centralized Wi-Fi controller acts as an intermediary between multiple access points and the analytics processing system. It collects and normalizes RSSI data from various access points, processes this information to identify emulated stations, and then provides cleaned analytics data to downstream systems. This intermediary role simplifies the overall architecture by centralizing complex tracking logic in one location rather than distributing it across multiple devices.
3Measurement precision
If heuristics are applied to detect suspicious data injection patterns, then the measurement precision of analytics improves, but the difficulty of detecting and measuring increases due to complex pattern analysis
Solution Approach 1:
The system transforms the detection problem by changing parameters from analyzing complex data content patterns to monitoring physical layer characteristics such as RSSI values and time stamps. By focusing on these fundamental parameters that are difficult to manipulate, the system achieves high measurement precision in detecting emulated stations without requiring complex heuristics for content analysis.
Solution Approach 2:
The system replaces complex mechanical or algorithmic analysis of data content with a simpler electronic measurement approach based on RSSI tracking. Instead of using sophisticated heuristics to analyze data patterns, the system substitutes this with direct measurement of radio signal strength characteristics, which are inherently difficult for emulated stations to fake and can be detected through straightforward comparison across multiple access points.
Data Source
AI summary
An analytics containment system store RSSI values of connected stations and corresponding time stamps. If two or more stations have RSSI values within a certain proximity within a certain time period, a first condition for identifying analytics poisoning has been satisfied. Additionally, if RSSI values for the two or more stations changes at similar rate, the stations have satisfied a second optional condition.