Systems and methods for detecting illegitimate devices on wireless networks

• US 9,730,075 B1
• Filed: 02/09/2015
• Issued: 08/08/2017
• Est. Priority Date: 02/09/2015
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Shavell, Michael, Boucher, Matt, Robichaud, Christopher, Jiang, Kevin
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US14/617,245
• Time in Patent Office: 911 Days
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The disclosed computer-implemented method for detecting illegitimate devices on wireless networks may include (1) generating a fake network identification string that uniquely identifies a fake wireless network, (2) transmitting a request to connect to the fake wireless network, (3) receiving, in response to the request, a response from a network device that indicates the fake wireless network is available, and (4) determining, based on receiving the response that indicates the fake wireless network is available, that the network device is illegitimate. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for detecting illegitimate devices on wireless networks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

generating, by a computing device configured to detect illegitimate network devices, a fake network identification string that uniquely identifies a fake wireless network;

transmitting, from the computing device, a request to connect to the fake wireless network;

receiving, by the computing device in response to the request, a response from a network device that indicates the fake wireless network is available; and

determining, by the computing device, based on receiving the response that indicates the fake wireless network is available, that the network device is illegitimate.

2. The method of claim 1, wherein generating the fake network identification string comprises generating a fake service set identifier.

3. The method of claim 2, wherein:

transmitting the request to connect to the fake wireless network comprises transmitting a probe request that contains a request to access a wireless network identified by the fake service set identifier; and

receiving the response that indicates the fake wireless network is available comprises receiving a probe response that indicates the wireless network identified by the fake service set identifier is available.

4. The method of claim 1, wherein transmitting the request to connect to the fake wireless network comprises transmitting the request in response to determining that the computing device configured to detect illegitimate network devices is outside of a predetermined geographic region.

5. The method of claim 1, wherein transmitting the request to connect to the fake wireless network comprises transmitting the request periodically at a predetermined interval.

6. The method of claim 1, wherein receiving the response that indicates the fake wireless network is available comprises receiving the response within a predetermined amount of time after transmitting the request to connect to the fake wireless network.

7. The method of claim 1, wherein determining that the network device is illegitimate comprises determining that the network device is spoofing the fake wireless network.

8. The method of claim 1, further comprising in response to determining that the network device is illegitimate, performing at least one of:

alerting a user of the computing device configured to detect illegitimate network devices that the network device is illegitimate; and

preventing the computing device from connecting to at least one wireless network within a predetermined range of the network device.

9. A system for detecting illegitimate devices on wireless networks, the system comprising:

a generation module, stored in memory, that generates, on a computing device configured to detect illegitimate network devices, a fake network identification string that uniquely identifies a fake wireless network;

a transmission module, stored in memory, that transmits, from the computing device, a request to connect to the fake wireless network;

a reception module, stored in memory, that receives, at the computing device in response to the request, a response from a network device that indicates the fake wireless network is available;

a determination module, stored in memory, that determines, on the computing device, based on receiving the response that indicates the fake wireless network is available, that the network device is illegitimate; and

at least one physical processor configured to execute the generation module, the transmission module, the reception module, and the determination module.

10. The system of claim 9, wherein the generation module generates the fake network identification string by generating a fake service set identifier.

11. The system of claim 10, wherein:

the transmission module transmits the request to connect to the fake wireless network by transmitting a probe request that contains a request to access a wireless network identified by the fake service set identifier; and

the reception module receives the response that indicates the fake wireless network is available by receiving a probe response that indicates the wireless network identified by the fake service set identifier is available.

12. The system of claim 9, wherein the transmission module transmits the request to connect to the fake wireless network by transmitting the request in response to determining that the computing device configured to detect illegitimate network devices is outside of a predetermined geographic region.

13. The system of claim 9, wherein the transmission module transmits the request to connect to the fake wireless network by transmitting the request periodically at a predetermined interval.

14. The system of claim 9, wherein the reception module receives the response that indicates the fake wireless network is available by receiving the response within a predetermined amount of time after the request to connect to the fake wireless network is transmitted.

15. The system of claim 9, wherein the determination module determines that the network device is illegitimate by determining that the network device is spoofing the fake wireless network.

16. The system of claim 9, further comprising a security module that, in response to the determination that the network device is illegitimate, performs at least one of:

alerting a user of the computing device configured to detect illegitimate network devices that the network device is illegitimate; and

preventing the computing device from connecting to at least one wireless network within a predetermined range of the network device.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device configured to detect illegitimate network devices, cause the computing device to:

generate, by the computing device, a fake network identification string that uniquely identifies a fake wireless network;

transmit, from the computing device, a request to connect to the fake wireless network;

receive, by the computing device in response to the request, a response from a network device that indicates the fake wireless network is available; and

determine, by the computing device, based on receiving the response that indicates the fake wireless network is available, that the network device is illegitimate.

18. The computer-readable medium of claim 17, wherein the one or more computer-executable instructions cause the computing device to generate the fake network identification string by generating a fake service set identifier.

19. The computer-readable medium of claim 18, wherein the one or more computer-executable instructions cause the computing device to:

transmit the request to connect to the fake wireless network by transmitting a probe request that contains a request to access a wireless network identified by the fake service set identifier; and

receive the response that indicates the fake wireless network is available by receiving a probe response that indicates the wireless network identified by the fake service set identifier is available.

20. The computer-readable medium of claim 17, wherein the one or more computer-executable instructions cause the computing device to transmit the request to connect to the fake wireless network by transmitting the request in response to determining that the computing device is outside of a predetermined geographic region.