A proactive wireless self-protection system

Abstract

Though mobile computing systems constitute the core of the next generation ubiquitous pervasive services, they still have many flaws in their security. This paper describes a novel framework for wireless anomaly based intrusion detection and response system, which is capable of detecting complex malicious attacks. This framework is based on multi-channel online monitoring and analysis of wireless network features with respect to multiple observation time windows. These features are related to Data Link Layer frame behaviors and the mobility of stations. A general purpose wireless self-protection system (WSPS) is presented. WSPS has the following modules: Wireless network probes, Wireless features filtration and generation module, Wireless network flow generator, behavior analysis module, and action module. WSPS self protects against attacks by online monitoring and analyzing anomalies and misuses in the network features, and utilizes the low false alerts of the analysis module. The validation and effectiveness of this framework is carried out by experimenting with more than 20 different types of wireless attacks using Wireless LANs (WLANs). Our experimental results show that our approach can protect from wireless network attacks with average false-positive rate of 2.234%, and average detection rate of 99.13% for all the experimented attacks.