Automated method and system for monitoring local area computer networks for unauthorized wireless access

• US 20100132040A1
• Filed: 04/07/2009
• Published: 05/27/2010
• Est. Priority Date: 02/11/2004
• Status: Abandoned Application

• Current Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Bhagwat, Pravin, Gogate, Shantanu, King, David C.
• Application Number:
  US12/419,300
• Publication Number:
  US 20100132040A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/102 Route integrity, e.g. using trusted paths
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

According to an embodiment of the present invention, the wireless activity in a geographic area containing LAN connection ports is monitored using one or more sensor devices, called sniffers. By analyzing said wireless activity, one or more APs that are operating in said geographic area are identified. The active APs so identified are classified into three categories, namely “authorized” APs (those that are allowed by network administrator), “unauthorized” APs (those that are not allowed by the network administrator, but are still connected to the LAN of interest) and “external” APs (those that are not allowed by network administrator but are not connected to the LAN of interest, for example APs connected to the neighbor'"'"'s LAN) by conducting one or more tests. The sniffers continue to monitor the selected geographic area to detect any wireless station attempting to connect to or communicating with the one or more identified unauthorized APs. Upon identifying unauthorized AP and/or intruding wireless station an indication is transferred to the prevention process.

Claims

1. A method for monitoring a wireless communication space occupied by one or more computer networks, the method comprising:

monitoring a selected local geographic region using one or more sniffer devices, each of the sniffer devices being spatially disposed within the selected local geographic region, the selected local geographic region being occupied by one or more connection points to a local area computer network;

detecting a wireless activity within the selected local geographic region using at least one of the sniffer devices from the one or more sniffer devices, the wireless activity being derived from at least one authorized device, or at least one unauthorized device, or at least one external device;

receiving at least identity information associated with the wireless activity in a classification process;

labeling the identity information into at least one of a plurality of categories; and

transferring at least an indication associated with the identify information to a prevention process.

2-50. -50. (canceled)