METHOD AND SYSTEM FOR DETECTING CHARACTERISTICS OF A WIRELESS NETWORK

• US 20090296598A1
• Filed: 05/21/2009
• Published: 12/03/2009
• Est. Priority Date: 04/03/2003
• Status: Active Grant

• Current Assignee: Ozmo Licensing LLC
• Original Assignee: Network Security Technologies, Inc. (Verizon Communications Inc.)
• Inventors: WALNOCK, Matthew, HARVEY, Elaine
• Granted Patent: US 8,122,506 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

Characteristics about one or more wireless access devices in a wireless network, whether known or unknown entities, can be determined using a system and method according to the present invention. An observation is made of the activity over a Wireless Area Network (WLAN). Based on this activity, changes in state of wireless access devices within the WLAN can be observed and monitored. These changes in state could be indicative of normal operation of the WLAN, or they may indicate the presence of an unauthorized user. In the latter case, an alert can be sent so that appropriate action may be taken. Additionally, ad hoc networks can be detected that may be connected to a wireless access point.

Claims

1-22. -22. (canceled)

23. A method, performed by one or more components of a node in a wireless network, comprising:

detecting, by the one or more components, a first packet associated with a wireless access device and transmitted via the wireless network;

determining, by the one or more components, a type of the first packet;

determining, by the one or more components, an identity of at least one device in communication with the wireless access device;

defining, by the one or more components, a first state of operation of the wireless access device corresponding to the type of the first packet and the identity of the at least one device;

detecting, by the one or more components, a second packet associated with the wireless access device and transmitted via the wireless network;

determining, by the one or more components, a type of the second packet;

determining, by the one or more components, one or more source and/or destination devices of the second packet;

defining, by the one or more components, a current state of operation of the wireless access device corresponding to the type of the second packet and the one or more source and/or destination devices;

identifying, by the one or more components and when the first state differs from the current state, a state change for the wireless access device; and

generating, by the one or more components, an event notification indicating the identified state change.

24. The method of claim 23, further comprising:

creating a first entry, corresponding to the first state, in a state transition table for the wireless access device.

25. The method of claim 24, where the identifying the state change comprises:

comparing the first state with the current state, and

creating, when a result of the comparing determines that the current state differs from first state, a new entry in the state transition table that differs from the first entry.

26. The method of claim 24, further comprising:

checking, responsive to the event notification and using at least one security policy element, whether the identified state change corresponds to a prohibited activity; and

sending, only when a result of the checking indicates that the prohibited activity has occurred, an alert indicating that the state change has occurred in the wireless network.

27. The method of claim 26, where checking whether the identified state change corresponds to a prohibited activity comprises:

determining that an unauthorized communication has occurred by the one or more source devices or the one or more destination devices using illegitimate credentials, and

sending a notification upon the determination that the unauthorized communication has occurred.

28. The method of claim 26, where checking whether the identified state change corresponds to a prohibited activity comprises:

comparing the current state of the wireless access device with the first entry in the state transition table;

determining, when a result of the comparing indicates that the current state differs from the first state, that an illegal state change has occurred; and

sending a notification upon a determination that the illegal state change has occurred.

29. The method of claim 28, where determining that an illegal state change has occurred comprises:

determining, based on the current state of operation of the wireless access device, a group of possible prior state values of the wireless access device,

determining whether an actual prior state of the wireless access device matches one of the group of possible prior states, and

generating an alert upon a determination that the actual prior state is not among the group of possible prior states.

30. The method of claim 23, where the type of the first packet or the type of the second packet comprises at least one of a generic packet type, a diagnostic packet type, an event packet type, or a configuration packet type.

31. The method of claim 23, where the prohibited activity comprises at least one of a security violation, a communication with an intruder, or an anomalous behavior of the wireless access device.

32. A system comprising:

means for detecting a first packet identifying a wireless access device;

means for determining a type of the first packet;

means for determining at least one device in communication with the wireless access device via a wireless network;

means for defining, based on the at least one device and the type of the first packet, a first state of a session between the wireless access device and the at least one device;

means for detecting a plurality of packets associated with the wireless access device;

means for determining types of the plurality of packets;

means for determining sources and/or destinations of the plurality of packets;

means for determining that a state change has occurred, from the first state, when at least one of the types of detected packets differs from the type of the first packet or the detected packets have sources or destinations other than the at least one device; and

means for generating an event notification of the state change.

33. The system of claim 32, further comprising:

means for creating a state transition table for the wireless access device, the state transition table including a first entry indicative of the first state; and

means for identifying the state change in the state transition table when the state change has occurred.

34. The system of claim 32, further comprising:

means for checking, using at least one security policy element, whether a prohibited activity or a permitted activity has occurred in the wireless network based on the event notification; and

means for sending, based on a result from the means for checking, an alert indicating that the prohibited activity has occurred.

35. The system of claim 34, where the prohibited activity comprises at least one of a security violation, a communication with an intruder, or an anomalous behavior of the wireless access device.

36. The system of claim 32, where the type of the first packet or the type of the detected packets comprises at least one of a generic packet type, a diagnostic packet type, an event packet type, or a configuration packet type.

37. A computer-readable storage medium containing computer program comprising:

instructions to define a first operational state associated with a wireless access device based on a first type of the packet detected via wireless network and at least one destination and/or source network device for the packet;

instructions to monitor a plurality of packets transmitted by and/or received at the wireless access device;

instructions to determine that a state change from the first operational state has occurred when a destination network device and/or source device other than the at least one destination and/or source network device is identified based on the observation;

instructions to determine that a state change from the first operational state has occurred when a second type of packet that differs from the first type of packet is identified based on the observation;

instructions to define, using information indicative of the state change, a second operational state; and

instructions to generate an event notification indicating the state change.

38. The computer-readable storage medium of claim 37, further comprising:

instructions to create a state transition table for a wireless access device in a wireless network; and

instructions to store the first operational state in the state transition table.

39. The computer-readable storage medium of claim 38, further comprising:

instructions to store the second operational state in the state transition table; and

instructions to check, using at least one security policy element, whether the state change corresponds to a permitted activity or a prohibited activity in the wireless network.

40. The computer-readable storage medium of claim 39, further comprising:

instructions to send, based on a result of the checking, an alert indicating that the prohibited activity has occurred only when the result indicates a violation of the at least one security policy element.

41. The computer-readable storage medium of claim 37, where the prohibited activity comprises at least one of a security violation, a communication with an intruder, or an anomalous behavior of the wireless access device.

42. The computer-readable storage medium of claim 37, where the first and the second types of packets comprise at least one of a generic packet type, a diagnostic packet type, an event packet type, or a configuration packet type.