Systems and methods for wireless intrusion detection using spectral analysis

• US 7,715,800 B2
• Filed: 01/13/2006
• Issued: 05/11/2010
• Est. Priority Date: 01/13/2006
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Sinha, Amit
• Primary Examiner(s): Le; Lana N
• Assistant Examiner(s): Hsieh; Ping Y
• Application Number:
  US11/332,065
• Publication Number:
  US 20070173199A1
• Time in Patent Office: 1,579 Days
• Field of Search: 455/67.13, 455/67.14, 455/67.11, 455/63.1, 455/62, 455/115.1, 455/115.3, 455/525, 455/452.2, 455/435.2
• US Class Current: 455/67.11
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 16/10 Dynamic resource partitioning

Abstract

Systems and methods for using wireless radios for spectral analysis. Systems and methods include using wireless radios that are included in wireless devices communicating on the wireless network to perform a spectral scan of frequencies on a wireless network.

Claims

1. A method for using a plurality of wireless radios in a wireless network for spectral analysis, the method comprising the steps of:

connecting to a plurality of wireless radios in wireless devices operable to perform as wireless communications devices within a wireless network operating as a WLAN;

setting a center frequency and bandwidth on the wireless radios, wherein the center frequency and bandwidth comprise a range of frequencies over which the wireless radios are operable to receive signals, and wherein the center frequency is located anywhere between 2.4-2.5 GHz and 4.9-5.9 GHz with frequency steps of less than 5 MHz;

receiving spectral power measurements from the wireless radios, the spectral power measurements being based upon signals received by the wireless radios based upon the set center frequency and bandwidth, and wherein the spectral power measurements comprising signal strength at the set center frequency and bandwidth; and

repeating the connecting, setting and receiving steps using the wireless radios such that a plurality of frequencies used by the wireless network are analyzed for spectral activity, wherein at least one of the plurality of frequencies are offset from WLAN channels such that the spectral power measurements provide measurements across a frequency band wider than a single WLAN channel.

2. The method of claim 1, wherein the wireless radios comprise any of WLAN cards, WLAN access points, or bluetooth cards, and wherein the method uses existing WLAN infrastructure as spectrum analyzers to scan for wireless spectral power measurements without requiring separate stand-alone spectrum analyzers or additional equipment from the existing WLAN infrastructure.

3. The method of claim 1, further comprising the step of determining bandwidth on one of the wireless radios, wherein the bandwidth ranges from 1 MHz to 40 MHz, and setting the center frequency and the bandwidth on the one of the wireless radios based on the determined bandwidth.

4. The method of claim 3, further comprising the step of displaying a spectrogram comprising a frequency and time plot of spectral power measured for a plurality of channels.

5. The method of claim 3, further comprising the step of storing the spectral power measurements in a computer readable medium.

6. The method of claim 3, further comprising the step of storing the spectral power measurements according to the locations of the wireless devices taking the spectral power measurements such that locations of interference can be identified.

7. The method of claim 1, wherein the plurality of wireless radios are set at a channel for a user programmable duration of time.

8. The method of claim 7, wherein the user programmable duration of time is less than a time required to decode packets.

9. The method of claim 1, wherein the wireless radios comprise different types of wireless devices used to communicate data among wireless users or between wireless users and a wired network.

10. The method of claim 1, wherein the bandwidth of the wireless devices is settable to obtain greater resolution, thereby allowing the user to differentiate wireless devices emitting signals on frequencies in close proximity to one another, and wherein the wireless devices comprise WLAN devices without separate stand-alone spectrum analyzers.

11. The method of claim 1, wherein the wireless radios are configured to capture the spectral power measurement in any of an average power over a period of time, a minimum power over a period of time, a maximum power over a period of time, or combinations thereof, wherein the wireless radios are further configured to transmit the spectral power measurement to a wireless intrusion prevention system, and wherein the wireless radios are utilized as spectrum analyzers without separate stand-alone spectrum analyzers.

12. The method of claim 1, further comprising the step of utilizing the spectral activity by a wireless intrusion prevention system to determine a wireless channel monitoring pattern, wherein the wireless channel monitoring pattern is based upon past history and current usage based on the spectral activity.

13. The method of claim 1, further comprising the steps of determining a plurality of known spectrogram signatures each corresponding to a known class of devices;

and responsive to interference in the wireless network, identifying a potential class of an interfering wireless device by comparing a spectrogram formed by the spectral power measurements of the interfering wireless device to the plurality of known spectrogram signatures.

14. A method for identifying interference in a wireless network based on spectral analysis, the method comprising the steps of:

scanning with existing WLAN equipment a plurality of channels associated with the wireless network to measure the spectral power of the signals transmitting on the channels, wherein the existing WLAN equipment provides functionality of spectrum analyzers without requiring separate spectrum analyzers or equipment other than the existing WLAN equipment, and wherein the existing WLAN equipment is configured to not decode WLAN packets while scanning;

receiving the measured spectral power associated with various center frequencies from a plurality of wireless radios, wherein the various center frequencies are located anywhere between 2.4-2.5 GHz and 4.9-5.9 GHz with frequency steps of less than 5 MHz;

repeating the scanning and receiving steps until either a predetermined time has elapsed, or substantially all channels have been measured; and

constructing a spectrogram, wherein the spectrogram comprises a frequency and time plot of the measured spectral power for each channel.

15. The method of claim 14, further comprising the steps of determining a plurality of known spectrogram signatures each corresponding to a known class of devices;

and responsive to interference in the wireless network, identifying potential classes of devices causing the interference by comparing the spectrogram to the plurality of known spectrogram signatures.

16. The method of claim 14, further comprising the step of physically locating an interference source with radio frequency triangulation based on power levels measured simultaneously by a plurality of radios.

17. The method of claim 16, further comprising the step of analyzing performance degradation of the wireless network by correlating performance degradation with the interference.

18. A wireless intrusion prevention system comprising a plurality of wireless radios and at least one of a server, computer, and Internet appliance is configured to scan a plurality of channels of a wireless network for spectral power measurements on a plurality of channels, wherein the wireless radios comprise wireless devices operable to communicate on the wireless network, the scan being responsive to at least one of a wireless attack, performance degradation, and an unauthorized device accessing the wireless network, wherein the wireless intrusion prevention system uses existing WLAN infrastructure as spectrum analyzers to scan for spectral power measurements without requiring separate stand-alone spectrum analyzers, wherein the wireless intrusion prevention system is configured to utilize WLAN compliant radios to scan the plurality of channels over a frequency band in excess of any one WLAN channel, and updating of channel monitoring patterns based upon past history and current usage based on the spectral power measurement.

19. A method for using spectral analysis to determine which channels to monitor for detecting attacks and unauthorized activity on a wireless network, the method comprising the steps of:

scanning with existing WLAN equipment a plurality of channels associated with a wireless network to measure the spectral power of the signals transmitting on the channels, wherein the existing WLAN equipment does not include separate stand-alone spectrum analyzers;

identifying which of the channels are in use based upon the spectral power measurements associated with the channels, wherein the channels in use comprise channels with high signal spectral power measurements; and

updating channel monitoring patterns for detecting attacks and unauthorized activity on the wireless network based upon the identification of channel usage, wherein the channel monitoring patterns comprise dwell time per channel and a sequence of channel monitoring, and wherein the updating of the channel monitoring patterns is based upon past history and current usage based on the spectral power measurements.

20. The method of claim 19, wherein the scanning, identifying, and updating steps are performed by a wireless intrusion prevention system comprising a plurality of wireless radios and at least one of a server, computer, and Internet appliance.

21. The method of claim 19, wherein the channels determined to be in use are monitored for unauthorized activity.

22. The method of claim 21, wherein the plurality of wireless radios are configured to measure the spectral power on each channel over a period of time less than 10 ms.

23. The method of claim 19, wherein the scanning of substantially all channels is performed by the plurality of wireless radios, the wireless radios comprising any of a WLAN card, a WLAN access point, or a Bluetooth device, and wherein the scanning is performed at a center frequency located anywhere between 2.4-2.5 GHz and 4.9-5.9 GHz with frequency steps of less than 5 MHz.

24. The method of claim 19, wherein the WIPS stores historical channel usage, wherein historical channel usage comprises data illustrating which channels are in use during at least one previous scan performed by the WIPS.

25. The method of claim 24, wherein the channel monitoring patterns are updated responsive to historical channel usage.