A novel classification scheme for 802.11 WLAN active attacking traffic patterns

In 802.11 WLANs, active intrusion attacks on the MAC layer causes changes in the management frame distributions. This paper focuses on detecting intrusions by analyzing the management traffic patterns. Experimental results are presented that describe the patterns generated by two well-known active attacks on 802.11 WLANs: deauthentication denial-of service (DoS) and man-in-the-middle (MITM). By clustering the management frame bursts over a certain period of time, we observe that the active attacking traffic patterns can be classified through calculation of a cluster content value (CCV). Our results show that when any station in a WLAN experiences clustering in its management traffic distribution, the CCV can be used to detect and classify the attacks the station is experiencing