Systems and methods for detecting illegitimate devices on wireless networks

• US 9,781,604 B1
• Filed: 02/09/2015
• Issued: 10/03/2017
• Est. Priority Date: 02/09/2015
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Shavell, Michael, Boucher, Matt, Robichaud, Christopher
• Primary Examiner(s): Siddiqui, Kashif
• Application Number:
  US14/616,761
• Time in Patent Office: 967 Days
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

The disclosed computer-implemented method for detecting illegitimate devices on wireless networks may include (1) identifying a baseline signal strength for a wireless network, (2) monitoring a signal strength of the wireless network to obtain at least one additional signal strength measurement, (3) determining that the additional signal strength measurement varies from the baseline signal strength beyond a threshold, (4) determining, in response to determining that the additional signal strength measurement varies from the baseline signal strength, that an illegitimate device is present on the wireless network, and (5) initiating, in response to determining that the illegitimate device is present on the wireless network, a security action. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for detecting illegitimate devices on wireless networks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

Identifying, at the computing device, a baseline signal strength for a wireless network;

detecting, at the computing device, that the computing device has moved;

identifying, at the computing device, a new baseline signal strength for the wireless network in response to detecting that the computing device has moved;

monitoring, at the computing device, a signal strength of the wireless network to obtain at least one additional signal strength measurement;

determining, at the computing device, that the additional signal strength measurement varies from the new baseline signal strength beyond a threshold;

determining, at the computing device, in response to determining that the additional signal strength measurement varies from the new baseline signal strength, that an illegitimate device is present on the wireless network;

in response to determining that the illegitimate device is present on the wireless network, initiating, at the computing device, a security action.

2. The computer-implemented method of claim 1, wherein identifying the baseline signal strength comprises:

identifying a set of signal strength measurements for the wireless network;

calculating a central tendency for the set of signal strength measurements.

3. The computer-implemented method of claim 2, wherein the central tendency comprises at least one of:

a mean value;

a median value;

a mode value.

4. The computer-implemented method of claim 1, wherein the threshold comprises a percentage of the baseline signal strength.

5. The computer-implemented method of claim 1, wherein the signal strength comprises a Received Signal Strength Indication.

6. The computer-implemented method of claim 1, wherein monitoring the signal strength comprises obtaining the additional signal strength measurement periodically at a predetermined interval.

7. The computer-implemented method of claim 1, wherein:

the wireless network comprises a public wireless network to which the computing device is connected;

the illegitimate device comprises a malicious device that represents itself as a wireless access point and intercepts network traffic intended for a legitimate wireless access point.

8. The computer-implemented method of claim 1, wherein the security action comprises at least one of:

alerting a user of the computing device that the illegitimate device is present on the wireless network;

disconnecting the computing device from the wireless network;

preventing the computing device from connecting to the wireless network;

disabling wireless networking on the computing device.

9. A system for detecting illegitimate devices on wireless networks, the system comprising:

a baseline module, stored in memory, that;

identifies, at a computing device, a baseline signal strength for a wireless network;

detects, at the computing device, that the computing device has moved;

identifies, at the computing device, a new baseline signal strength for the wireless network in response to detecting that the computing device has moved;

a monitoring module, stored in memory, that monitors, at the computing device, a signal strength of the wireless network to obtain at least one additional signal strength measurement;

an analysis module, stored in memory, that;

determines, at the computing device, that the additional signal strength measurement varies from the new baseline signal strength beyond a threshold;

determines, at the computing device, in response to determining that the additional signal strength measurement varies from the new baseline signal strength, that an illegitimate device is present on the wireless network;

a security module, stored in memory, that, in response to determining that the illegitimate device is present on the wireless network, initiates, at the computing device, a security action;

at least one physical processor configured to execute the baseline module, the monitoring module, the analysis module, and the security module.

10. The system of claim 9, wherein the baseline module identifies the baseline signal strength by:

identifying a set of signal strength measurements for the wireless network;

calculating a central tendency for the set of signal strength measurements.

11. The system of claim 10, wherein the central tendency comprises at least one of:

a mean value;

a median value;

a mode value.

12. The system of claim 9, wherein the threshold comprises a percentage of the baseline signal strength.

13. The system of claim 9, wherein the signal strength comprises a Received Signal Strength Indication.

14. The system of claim 9, wherein the monitoring module monitors the signal strength by obtaining the additional signal strength measurement periodically at a predetermined interval.

15. The system of claim 9, wherein:

the wireless network comprises a public wireless network to which the computing device is connected;

the illegitimate device comprises a malicious device that represents itself as a wireless access point and intercepts network traffic intended for a legitimate wireless access point.

16. The system of claim 9, wherein the security action comprises at least one of:

alerting a user of the computing device that the illegitimate device is present on the wireless network;

disconnecting the computing device from the wireless network;

preventing the computing device from connecting to the wireless network;

disabling wireless networking on the computing device.

17. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, at the computing device, a baseline signal strength for a wireless network;

detect, at the computing device, that the computing device has moved;

identify, at the computing device, a new baseline signal strength for the wireless network in response to detecting that the computing device has moved;

monitor, at the computing device, a signal strength of the wireless network to obtain at least one additional signal strength measurement;

determine, at the computing device, that the additional signal strength measurement varies from the baseline signal strength beyond a threshold;

determine, at the computing device, in response to determining that the additional signal strength measurement varies from the baseline signal strength, that an illegitimate device is present on the wireless network;

in response to determining that the illegitimate device is present on the wireless network, initiate, at the computing device, a security action.

18. The non-transitory computer-readable medium of claim 17, wherein the one or more computer-readable instructions cause the computing device to identify the baseline signal strength by:

identifying a set of signal strength measurements for the wireless network;

calculating a central tendency for the set of signal strength measurements.

19. The non-transitory computer-readable medium of claim 18, wherein the central tendency comprises at least one of:

a mean value;

a median value;

a mode value.

20. The non-transitory computer-readable medium of claim 17, wherein the threshold comprises a percentage of the baseline signal strength.