IEEE 802.11 user fingerprinting and its applications for intrusion detection

Daisuke Takahashi, Yang Xiao, Yan Zhang, Periklis Chatzimisios, Hsiao Hwa Chen

Research output: Contribution to journalArticlepeer-review

32 Citations (Scopus)

Abstract

Easy associations with wireless access points (APs) give users temporal and quick access to the Internet. It needs only a few seconds to take their machines to hotspots and do a little configuration in order to have Internet access. However, this portability becomes a double-edged sword for ignorant network users. Network protocol analyzers are typically developed for network performance analysis. Nonetheless, they can also be used to reveal user's privacy by classifying network traffic. Some characteristics in IEEE 802.11 traffic particularly help identify users. Like actual human fingerprints, there are also unique traffic characteristics for each network user. They are called network user fingerprints, by tracking which more than half of network users can be connected to their traffic even with medium access control (MAC) layer pseudonyms. On the other hand, the concept of network user fingerprint is likely to be a powerful tool for intrusion detection and computer/digital forensics. As with actual criminal investigations, comparison of sampling data to training data may increase confidence in criminal specification. This article focuses on a survey on a user fingerprinting technique of IEEE 802.11 wireless LAN traffic. We also summarize some of the researches on IEEE 802.11 network characteristic analysis to figure out rogue APs and MAC protocol misbehaviors.

Original languageEnglish
Pages (from-to)307-318
Number of pages12
JournalComputers and Mathematics with Applications
Volume60
Issue number2
DOIs
Publication statusPublished - 2010 Jul

All Science Journal Classification (ASJC) codes

  • Modelling and Simulation
  • Computational Theory and Mathematics
  • Computational Mathematics

Fingerprint

Dive into the research topics of 'IEEE 802.11 user fingerprinting and its applications for intrusion detection'. Together they form a unique fingerprint.

Cite this