Document Type
Conference Paper
Publication Date
4-2008
Publication Title
Proceedings of the 27th Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM)
Department
Department of Computer Science
Abstract
MAC addresses can be easily spoofed in 802.11 wireless LANs. An adversary can exploit this vulnerability to launch a large number of attacks. For example, an attacker may masquerade as a legitimate access point to disrupt network services or to advertise false services, tricking nearby wireless stations. On the other hand, the received signal strength (RSS) is a measurement that is hard to forge arbitrarily and it is highly correlated to the transmitter's location. Assuming the attacker and the victim are separated by a reasonable distance, RSS can be used to differentiate them to detect MAC spoofing, as recently proposed by several researchers. \par By analyzing the RSS pattern of typical 802.11 transmitters in a 3-floor building covered by 20 air monitors, we observed that the RSS readings followed a mixture of multiple Gaussian distributions. We discovered that this phenomenon was mainly due to \em antenna diversity, a widely-adopted technique to improve the stability and robustness of wireless connectivity. This observation renders existing approaches ineffective because they assume a single RSS source. We propose an approach based on Gaussian mixture models, building RSS profiles for spoofing detection. Experiments on the same testbed show that our method is robust against antenna diversity and significantly outperforms existing approaches. At a 3% false positive rate, we detect 73.4%, 89.6% and 97.8% of attacks using the three proposed algorithms, based on local statistics of a single AM, combining local results from AMs, and global multi-AM detection, respectively.
DOI
10.1109/INFOCOM.2007.239
Original Citation
Yong Sheng, Keren Tan, Guanling Chen, David Kotz, and Andrew Campbell. Detecting 802.11 MAC Layer Spoofing Using Received Signal Strength. In Proceedings of the 27th Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM), April 2008. 10.1109/INFOCOM.2007.239
Dartmouth Digital Commons Citation
Sheng, Yong; Tan, Keren; Chen, Guanling; Kotz, David; and Campbell, Andrew T., "Detecting 802.11 Mac Layer Spoofing Using Received Signal Strength" (2008). Dartmouth Scholarship. 3326.
https://digitalcommons.dartmouth.edu/facoa/3326
