Wireless Intrusion Detection Using Device Location Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection and prevention systems face challenges in wireless networks due to the mobile nature of wireless devices and varying connection methods, which traditional systems deployed in wired networks are not equipped to handle effectively.
Innovation Solution
A wireless network security system that utilizes a database of historical location information and MAC addresses to identify rogue devices and detect potential attacks by determining the location of wireless devices through probe signals, employing trilateration techniques and smart beamforming to mitigate threats such as flood attacks and evil twin attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection systems are deployed in wireless networks, then network security monitoring is enabled, but the systems fail to effectively handle mobile devices and varying connection methods
Solution Approach 1:
The system dynamically tracks wireless devices by continuously monitoring their location information across multiple access points and updating their state in real-time as they move through the network, enabling effective intrusion detection despite device mobility
Solution Approach 2:
The system adds the spatial dimension to intrusion detection by incorporating location information from multiple access points, enabling differentiation between legitimate mobile devices and rogue devices based on their physical positions and movement patterns
2Measurement precision
If location information tracking is implemented, then rogue devices can be identified, but system complexity increases
Solution Approach 1:
The system uses a centralized database that serves multiple functions: storing historical location information, tracking current device positions, identifying rogue devices, and supporting intrusion detection queries, thereby reducing overall system complexity through consolidation
Solution Approach 2:
The system introduces a centralized database as an intermediary between access points and the intrusion detection logic, simplifying the architecture by centralizing data management and decoupling the complex tracking algorithms from individual access points
Data Source
AI summary
Systems and methods for detecting and/or preventing intrusions in a wireless network based on location information of wireless devices are provided. According to one embodiment, a database is maintained by a wireless network security system that includes historical location information and a media access control (MAC) address for multiple wireless devices observed by wireless access points (APs) of a wireless network of an enterprise. Information regarding one or more probe signals originated by a wireless device of the multiple wireless devices is received by the wireless network security system from the multiple APs. A location of the wireless device is determined by the wireless network security system based on the information. A potential attack being conducted by the wireless device or in which the wireless device is involved is identified based on one or more of behavior exhibited by the wireless device, the location and the database.