Systems and methods for wireless intrusion detection using spectral analysis

• US 20070173199A1
• Filed: 01/13/2006
• Published: 07/26/2007
• Est. Priority Date: 01/13/2006
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Sinha, Amit
• Granted Patent: US 7,715,800 B2
• Time in Patent Office: Days
• US Class Current: 455/67.110
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 16/10 Dynamic resource partitioning

Abstract

Systems and methods for using wireless radios for spectral analysis. Systems and methods include using wireless radios that are included in wireless devices communicating on the wireless network to perform a spectral scan of frequencies on a wireless network.

Claims

1. A method for using a plurality of wireless radios in a wireless network for spectral analysis, the method comprising the steps of:

connecting to a plurality of wireless radios, wherein the wireless radios comprise wireless devices operable to perform as wireless communications devices within a wireless network;

setting a center frequency and bandwidth on the wireless radios, wherein the center frequency and bandwidth comprise a range of frequencies over which the wireless radios are operable to receive signals;

receiving power measurements from the wireless radios, the power measurements being based upon signals received by the wireless radios based upon the set center frequency and bandwidth; and

repeating the connecting, setting and receiving steps using the wireless radios such that a plurality of frequencies used by the wireless network are analyzed for spectral activity.

2. The method of claim 1, wherein the wireless radios comprise any of WLAN cards, WLAN access points, or bluetooth cards.

3. The method of claim 1, further comprising the step of storing the power measurements according to channel and time.

4. The method of claim 3, further comprising the step of displaying a spectrogram comprising a plot of power measured for a plurality of channels.

5. The method of claim 3, further comprising the step of storing the power measurements in a computer readable medium.

6. The method of claim 3, further comprising the step of storing the power measurements according to the locations of the wireless devices taking the power measurements such that locations of interference can be identified.

7. The method of claim 1, wherein the plurality of wireless radios are set at a channel for a user programmable duration of time.

8. The method of claim 7, wherein the user programmable duration of time is less than a time required to decode packets.

9. The method of claim 1, wherein the wireless radios comprise different types of wireless devices used to communicate data among wireless users or between wireless users and a wired network.

10. The method of claim 1, wherein the bandwidth of the wireless devices is settable to obtain greater resolution, thereby allowing the user to differentiate wireless devices emitting signals on frequencies in close proximity to one another.

11. The method of claim 1, wherein the wireless radios are configured to capture the power measurement in any of an average power over a period of time, a minimum power over a period of time, a maximum power over a period of time, or combinations thereof, wherein the wireless radios are further configured to transmit the power measurement to a wireless intrusion prevention system.

12. The method of claim 1, wherein the spectral analysis is used by a wireless intrusion prevention system to detect unauthorized wireless use and perform an active defense of the wireless network.

13. The method of claim 1, further comprising the step of identifying a potential class of an interfering wireless device by comparing a power envelope of the interfering wireless device to stored power envelopes known to originate from a class of wireless devices.

14. A method for identifying interference in a wireless network based on spectral analysis, the method comprising the steps of:

scanning a plurality of channels associated with the wireless network to measure the power of the signals transmitting on the channels;

receiving power measurements associated with the channels from a plurality of wireless radios;

repeating the scanning and receiving steps until either a predetermined time has elapsed, or substantially all channels have been measured; and

constructing a spectrogram, wherein the spectrogram comprises a plot of power measurements for each channel.

15. The method of claim 14, further comprising the step of identifying potential classes of devices causing the interference by comparing the spectrogram to stored spectrograms known to originate from specific types of devices.

16. The method of claim 14, further comprising the step of physically locating an interference source with radio frequency triangulation based on power levels measured simultaneously by a plurality of radios.

17. The method of claim 16, further comprising the step of analyzing performance degradation of the wireless network by correlating performance degradation with the interference.

18. A wireless intrusion prevention system comprising a plurality of wireless radios and at least one of a server, computer, and Internet appliance is configured to scan a plurality of channels of a wireless network for power measurements on a plurality of channels, wherein the wireless radios comprise wireless devices operable to communicate on the wireless network, the scan being responsive to at least one of a wireless attack, performance degradation, and an unauthorized device accessing the wireless network.

19. A method for using spectral analysis to determine which channels to monitor for detecting attacks and unauthorized activity on a wireless network, the method comprising the steps of:

scanning a plurality of channels associated with a wireless network to measure the power of the signals transmitting on the channels;

identifying which of the channels are in use based upon the power measurements associated with the channels, wherein the channels in use comprise channels with high signal power measurements; and

updating channel monitoring patterns based upon the identification of channel usage.

20. A wireless intrusion prevention system comprising a plurality of wireless radios and at least one of a server, computer, and Internet appliance, the wireless intrusion protection system being configured to perform the method of claim 19.

21. The method of claim 19, wherein the channels determined to be in use are monitored for unauthorized activity.

22. The method of claim 21, wherein the plurality of wireless radios are configured to measure the signal power on each channel over a period of time less than 10 ms.

23. The method of claim 19, wherein the scanning of substantially all channels is performed by the plurality of wireless radios, the wireless radios comprising any of a WLAN card, a WLAN access point, or a Bluetooth device.

24. The method of claim 19, wherein the WIPS stores historical channel usage, wherein historical channel usage comprises data illustrating which channels are in use during at least one previous scan performed by the WIPS.

25. The method of claim 24, wherein the channel monitoring patterns are updated responsive to historical channel usage.