Systems and methods for adaptively scanning for wireless communications

• US 7,359,676 B2
• Filed: 11/04/2003
• Issued: 04/15/2008
• Est. Priority Date: 04/21/2003
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott E.
• Primary Examiner(s): Tran; Tuan
• Application Number:
  US10/700,844
• Publication Number:
  US 20040209634A1
• Time in Patent Office: 1,624 Days
• Field of Search: 4551611- 3, 455 411- 2, 455/67.11, 455/13, 455507-516, 455 631- 3, 370/342, 370/441, 370/474, 370/480, 370444-445, 370319-320, 370/468, 370/250, 370/252, 370/254, 370/343, 709223-226, 726 22- 25
• US Class Current: 455/67.11
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

This application is directed to systems and methods for adaptively scanning for wireless communications. Scan data associated with scanning one or more wireless network channels based upon a scan pattern is received. Each wireless channel has a designation of primary or secondary with at least one channel having the secondary designation. A determination is made as to whether anomalous activity is present on a selected wireless channel designated as secondary. If anomalous activity is determined to be present, at least one scanning parameter of the selected channel is altered.

Claims

1. A method for adaptively scanning wireless network channels, the method comprising the steps of:

(a) receiving scan data based upon a scan of a plurality of wireless network channels according to a scanning pattern, wherein each wireless network channel in the plurality of wireless network channels has a designation of primary or secondary, wherein at least one channel of the plurality of wireless network channels is designated as a secondary channel and wherein the scanning pattern is determined based upon the designation associated with each wireless network channel in the plurality of wireless network channels;

(b) determining whether anomalous activity is present on a selected wireless network channel designated as secondary based upon the received scan data; and

(c) if anomalous activity is determined to be present on the selected wireless network channel, adapting the scanning pattern by altering at least one monitoring parameter associated with the selected wireless network channel.

2. The method of claim 1, wherein the determining step comprises the step of comparing actual activity level from the received scan data with an activity level threshold.

3. The method of claim 2, and further comprising the step of determining the activity level threshold.

4. The method of claim 3, wherein the step of determining the activity level threshold comprises the step of determining the activity level threshold based upon configuration data, historical data regarding channel activity or combinations thereof.

5. The method of claim 1, wherein the adapting step comprises the step of altering the monitoring time amount for the selected wireless network channel.

6. The method of claim 5, wherein the adapting step further comprises generating a change amount based upon the received scan data, wherein the change amount is used to perform the step of altering the monitoring time amount for the selected wireless channel.

7. The method of claim 1, and further comprising the step of initiating a defensive action, if anomalous activity is determined to be present.

8. The method of claim 7, wherein the step of initiating a defensive action comprises the step of transmitting a notification to a user, to a computer system or to both.

9. The method of claim 7, wherein the step of initiating a defensive action comprises the step of initiating at least one defensive action selected from the group consisting of:

(i) jamming wireless transmissions;

(ii) CRC errors;

(iii) transmitting frames comprising random data;

(iv) locking-down the wireless computer network;

(v) activating a honeypot defense;

(vi) de-authorizing a wireless station or access point;

(vii) initiating dynamic location tracking with respect to a wireless station or access point;

(viii) disabling a selected access point'"'"'s wireless transceiver; and

(ix) alerting external a network management system or an associated network component.

10. The method of claim 9, wherein the initiated defensive action is alerting an associated network component and wherein the associated network component is a router, a bridge or a switch.

11. The method of claim 1, and further comprising transmitting a notification to a user, to a computer system or to both.

12. The method of claim 1, and further comprising the step of scanning the plurality of wireless network channels according to the scanning pattern one or more times to generate scan data.

13. The method of claim 12, and further comprising the step of repeating the scanning, receiving, determining, and adapting steps a plurality of times.

14. The method of claim 13, wherein the repeating step occurs periodically over time based upon length of scan time, time period configuration data, historical network activity data, current network activity data, security threat level data or combinations thereof.

15. The method of claim 12, wherein the scanning of the plurality of wireless network channels is performed in parallel with respect to at least two channels in the plurality of wireless network channels.

16. The method of claim 12, wherein the scanning step occurs a plurality of times to generate the scan data.

17. The method of claim 1, and further comprising the step of repeating the receiving, determining, and adapting steps a plurality of times.

18. The method of claim 1, wherein the adapting step is based upon time, traffic activity or threat level.

19. The method of claim 1, wherein and at least one channel of the plurality of wireless network channels is designated as a primary channel.

20. A system for adaptively scanning wireless network channels, the system comprising:

(a) a system data store capable of storing information relating to a plurality of wireless network channels and a scanning pattern; and

(b) a system processor comprising one or more processing elements, wherein the system process is in communication with the system data store, and wherein the one or more processing elements are programmed or adapted to perform steps comprising;

(i) receiving scan data based upon a scan of a plurality of wireless network channels according to a scanning pattern, wherein each wireless network channel in the plurality of wireless network channels has a designation of primary or secondary, wherein at least one channel of the plurality of wireless network channels is designated as a secondary channel and at least one other channel of the plurality of wireless network channels is designated as a primary channel and wherein the scanning pattern is determined based upon the designation associated with each wireless network channel in the plurality of wireless network channels;

(ii) determining whether anomalous activity is present on a selected wireless network channel designated as secondary based upon the received scan data; and

(iii) if anomalous activity is determined to be present on the selected wireless network channel, adapting the scanning pattern by altering at least one monitoring parameter associated with the selected wireless network channel based upon time, traffic activity, threat level or combinations thereof and initiating at least one defensive action selected from the group consisting of;

(A) jamming wireless transmissions;

(B) CRC errors;

(C) transmitting frames comprising random data;

(D) locking-down the wireless computer network;

(E) activating a honeypot defense;

(F) initiating dynamic location tracking with respect to a wireless station or access point;

(G) de-authorizing a wireless station or access point;

(H) disabling a selected access point'"'"'s wireless transceiver; and

(I) alerting an external network management system or an associated network component; and

(iv) repeating steps (i) through (iii) a plurality of times.

21. The system of claim 20, and further compromising a wireless receiver from which the system processor receives the scan data, and wherein one or more processing elements of the system processor are further programmed or adapted to perform the-step comprising of initiating a scan of the wireless network channels according to the scanning pattern using the wireless receiver one or more times to generate the scan data.

22. The system of claim 21, wherein the one or more processing elements programmed or adapted to initiate the scan are programmed or adapted to initiate the scan a plurality of times in order to generate the scan data.

23. The system of claim 20, and further comprising a plurality of wireless receivers from which the system processor receives the scan data, wherein each of each of the plurality of wireless receivers is capable of scanning a different wireless network channel simultaneously.

24. One or more computer readable media that store instructions that upon execution by a system processor cause the system processor to adaptively scan wireless network channel by performing steps comprising of:

(a) receiving scan data based upon a scan of a plurality of wireless network channels according to a scanning pattern, wherein each wireless network channel in the plurality of wireless network channels has a designation of primary or secondary, wherein at least one channel of the plurality of wireless network channels is designated as a secondary channel and at least one other channel of the plurality of wireless network channels is designated as a primary channel and wherein the scanning pattern is determined based upon the designation associated with each wireless network channel in the plurality of wireless network channels;

(b) determining whether anomalous activity is present on a selected wireless network channel designated as secondary based upon the received scan data; and

(c) if anomalous activity is determined to be present on the selected wireless network channel, adapting the scanning pattern by altering at least one monitoring parameter associated with the selected wireless network channel based upon time, traffic activity, threat level or combinations thereof and initiating at least one defensive action selected from the group consisting of;

(i) jamming wireless transmissions;

(ii) CRC errors;

(iii) transmitting frames comprising random data;

(iv) locking-down the wireless computer network;

(v) activating a honeypot defense;

(vi) de-authorizing a wireless station or access point;

(vii) initiating dynamic location tracking with respect to a wireless station or access point;

(viii) disabling a selected access point'"'"'s wireless transceiver; and

(ix) alerting external a network management system or an associated network component; and

(d) repeating steps (a) through (c) a plurality of times.

25. A system for adaptively scanning wireless network channels, the system comprising:

(a) storing means for storing information relating to a plurality of wireless network channels and a scanning pattern;

(b) receiving means for receiving scan data based upon a scan of a plurality of wireless network channels according to a scanning pattern, wherein each wireless network channel in the plurality of wireless network channels has a designation of primary or secondary, wherein at least one channel of the plurality of wireless network channels is designated as a secondary channel and at least one other channel of the plurality of wireless network channels is designated as a primary channel and wherein the scanning pattern is determined based upon the designation associated with each wireless network channel in the plurality of wireless network channels;

(c) anomalous activity detecting means for determining whether anomalous activity is present on a selected wireless network channel designated as secondary based upon received scan data from the receiving means; and

(d) anomalous activity response means for responsive to the anomalous activity detecting means adapting the scanning pattern by altering at least one monitoring parameter associated with the selected wireless network channel based upon time, traffic activity, threat level or combinations thereof, for notifying a user or a computer system of anomalous activity determined by the anomalous activity detecting means, and for initiating at least one defensive action selected from the group consisting of;

(i) jamming wireless transmissions;

(ii) CRC errors;

(iii) transmitting frames comprising random data;

(iv) locking-down the wireless computer network;

(v) activating a honeypot defense;

(vi) de-authorizing a wireless station or access point;

(vii) initiating dynamic location tracking with respect to a wireless station or access point;

(viii) disabling a selected access point'"'"'s wireless transceiver; and

(ix) alerting external a network management system or an associated network component.