Title :
A passive approach to wireless device fingerprinting
Author :
Gao, Ke ; Corbett, Cherita ; Beyah, Raheem
Author_Institution :
Dept. of Comput. Sci., Georgia State Univ., Atlanta, GA, USA
fDate :
June 28 2010-July 1 2010
Abstract :
We propose a passive blackbox-based technique for determining the type of access point (AP) connected to a network. Essentially, a stimulant (i.e., packet train) that emulates normal data transmission is sent through the access point. Since access points from different vendors are architecturally heterogeneous (e.g., chipset, firmware, driver), each AP will act upon the packet train differently. By applying wavelet analysis to the resultant packet train, a distinct but reproducible pattern is extracted allowing a clear classification of different AP types. This has two important applications: (1) as a system administrator, this technique can be used to determine if a rogue access point has connected to the network; and (2) as an attacker, fingerprinting the access point is necessary to launch driver/firmware specific attacks. Extensive experiments were conducted (over 60GB of data was collected) to differentiate 6 APs. We show that this technique can classify APs with a high accuracy (in some cases, we can classify successfully 100% of the time) with as little as 100000 packets. Further, we illustrate that this technique is independent of the stimulant traffic type (e.g., TCP or UDP). Finally, we show that the AP profile is stable across multiple models of the same AP.
Keywords :
authorisation; feature extraction; fingerprint identification; firmware; wavelet transforms; access point; firmware specific attacks; launch driver; packet train; passive blackbox-based technique; system administrator; wavelet analysis; wireless device fingerprinting; Computer science; Data analysis; Data communication; Data mining; Fingerprint recognition; Microprogramming; Pattern analysis; Traffic control; Wavelet analysis; Wavelet packets;
Conference_Titel :
Dependable Systems and Networks (DSN), 2010 IEEE/IFIP International Conference on
Conference_Location :
Chicago, IL
Print_ISBN :
978-1-4244-7500-1
Electronic_ISBN :
978-1-4244-7499-8
DOI :
10.1109/DSN.2010.5544294