SYSTEM AND METHOD FOR WIRELESS LOCAL AREA NETWORK MONITORING AND INTRUSION DETECTION

• US 20070294747A1
• Filed: 08/29/2007
• Published: 12/20/2007
• Est. Priority Date: 09/23/2002
• Status: Active Grant

• Current Assignee: WiMetrics Corporation
• Original Assignee: WiMetrics Corporation
• Inventors: Rosenberger, Joel
• Granted Patent: US 7,448,073 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Systems and methods for managing network traffic from an unknown wireless device on a computer network are presented. A security component residing in a wired area of the computer network is configured to passively monitor network traffic from a wireless area of the computer network for network traffic from an unknown wireless device. Upon detecting network traffic from an unknown wireless device, the security component probes the unknown wireless device to determine at least one characteristic of the wireless device. After probing the device, the security component generates a device profile of the unknown wireless device according to the at least one determined characteristic. Access privileges are determined to give to the unknown wireless device according to the determined profile and activities exhibited by the wireless device. Thereafter, network traffic from the unknown wireless device is permitted to pass to the computer network according to the determined access privileges.

Claims

1. A computer-implemented system for managing network traffic from an unknown wireless device on a computer network, the system comprising:

a security component residing in a wired area of the computer network and configured to;

passively monitor network traffic from a wireless area of the computer network for network traffic from an unknown wireless device; and

upon detecting network traffic from an unknown wireless device;

probe the unknown wireless device to determine at least one characteristic of the wireless device;

generate a device profile of the unknown wireless device according to the at least one determined characteristic;

determine access privileges to give to the unknown wireless device according to the determined profile and activities exhibited by the wireless device; and

permit network traffic from the unknown wireless device to pass to the computer network according to the determined access privileges.

2. A computer-implemented method for detecting managing network traffic from an unknown wireless device on a computer network, comprising:

passively monitoring for network traffic from a wireless area of the computer network for network traffic of an unknown wireless device; and

upon detecting network traffic from the unknown wireless device;

probing the unknown wireless device to determine at least one characteristic of the wireless device;

generate a device profile of the unknown wireless device according to the at least one determined characteristic;

determine access privileges to give to the unknown wireless device according to the determined profile and the activities exhibited by the wireless device; and

permitting the network traffic from the unknown wireless device to pass to the computer network according to the determined access privileges.

3. A tangible computer-readable medium having computer-executable instructions which, when executed, carry out a method for detecting managing network traffic from an unknown wireless device on a computer network, comprising:

passively monitoring for network traffic from a wireless area of the computer network for network traffic of an unknown wireless device; and

upon detecting network traffic from the unknown wireless device;

probing the unknown wireless device to determine at least one characteristic of the wireless device;

generate a device profile of the unknown wireless device according to the at least one determined characteristic;

determine access privileges to give to the unknown wireless device according to the determined profile and the activities exhibited by the wireless device; and

permitting the network traffic from the unknown wireless device to pass to the computer network according to the determined access privileges.