Detection of intrusion in a wireless network

• US 9,544,320 B2
• Filed: 06/16/2015
• Issued: 01/10/2017
• Est. Priority Date: 06/19/2002
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Denton, Guy S., Lackey, Joshua
• Primary Examiner(s): Rashid, Harunur
• Application Number:
  US14/740,589
• Publication Number:
  US 20150358339A1
• Time in Patent Office: 574 Days
• Field of Search: 726/23, 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

A method and associated system for detecting intrusion of a wireless network. A determination is made that a first data stream received by the wireless network does not include N1 communication protocols included in a second data stream previously determined to be valid, N1 being a positive integer. A determination is made that N1 exceeds a predetermined first tolerance, and in response, that the first data stream does not include N2 communication protocols included in a third data stream previously determined to be intrusive to the wireless network, N2 being an integer equal to or greater than zero. A determination is made that N2 is less than a predetermined second tolerance, and in response, an alert that the received data stream is potentially intrusive to the wireless network is generated.

Claims

1. A method for detecting intrusion of a wireless network, the method comprising:

determining, by one or more processors, that a first data stream received by the wireless network does not include N1 communication protocols included in a second data stream previously determined to be valid, N1 being a positive integer;

determining, by the one or more processors, that N1 exceeds a predetermined first tolerance, and in response, the one or more processors determining that the first data stream does not include N2 communication protocols included in a third data stream previously determined to be intrusive to the wireless network, N2 being an integer equal to or greater than zero;

determining, by the one or more processors, that N2 is less than a predetermined second tolerance, and in response, generating, by the one or more processors, an alert that the received first data stream is potentially intrusive to the wireless network;

determining, by the one or more processors, that the first data stream does not include N3 communication protocols included in a fourth data stream previously determined to be intrusive to the wireless network, in response to the determining that N1 exceeds the predetermined first tolerance and prior to the determining that the first data stream does not include the N2 communication protocols included in a third data stream, wherein N3 is an integer equal to or greater than one; and

determining, by the one or more processors, that N3 is equal to or greater than the predetermined second tolerance,

wherein N1 is 2, the predetermined first tolerance is 1, N2 is 1 and the predetermined second tolerance is 2.

2. The method of claim 1, wherein the second data stream is in a first library of data streams previously determined to be valid, the first library being stored in a first storage device, and wherein the third data stream is in a second library of data streams previously determined to be intrusive to the wireless network, the second library being stored in a second storage device.

3. The method of claim 1, wherein the data stream consists of one data packet.

4. The method of claim 1, wherein the data stream comprises a plurality of data packets.

5. The method of claim 1, further comprising:

determining, by the one or more processors, that a condition is satisfied, and in response, generating, by the one or more processors, the alert, wherein the condition is selected from the group consisting of the data stream matches a predefined traffic pattern, the data stream has an invalid service set identifier, the data stream has an older service set identifier, the data stream has an invalid media access control, the data stream occurs outside of normal working hours, and the data stream includes too many queries transmitted at a same time from a same sender.

6. A computer program product for detecting intrusion of a wireless network, the computer program product comprising one or more computer-readable storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions comprising:

program instructions to determine that a first data stream received by the wireless network does not include N1 communication protocols included in a second data stream previously determined to be valid, N1 being a positive integer;

program instructions to determine that N1 exceeds a predetermined first tolerance, and in response, to determine that the first data stream does not include N2 communication protocols included in a third data stream previously determined to be intrusive to the wireless network, N2 being an integer equal to or greater than zero;

program instructions to determine that N2 is less than a predetermined second tolerance, and in response, to generate an alert that the received first data stream is potentially intrusive to the wireless network;

program instructions to determine that the first data stream does not include N3 communication protocols included in a fourth data stream previously determined to be intrusive to the wireless network, in response to a determination that N1 exceeds the predetermined first tolerance and prior to a determination that the first data stream does not include the N2 communication protocols included in a third data stream, wherein N3 is an integer equal to or greater than one; and

program instructions to determine that N3 is equal to or greater than the predetermined second tolerance,

wherein N1 is 2, the predetermined first tolerance is 1, N2 is 1 and the predetermined second tolerance is 2.

7. The computer program product of claim 6, wherein the second data stream is in a first library of data streams previously determined to be valid, the first library being stored in a first storage device, and wherein the third data stream is in a second library of data streams previously determined to be intrusive to the wireless network, the second library being stored in a second storage device.

8. The computer program product of claim 6, wherein the data stream consists of one data packet.

9. The computer program product of claim 6, wherein the data stream comprises a plurality of data packets.

10. The computer program product of claim 6, further comprising:

program instructions to determine that a condition is satisfied, and in response, to generate the alert, wherein the condition is selected from the group consisting of the data stream matches a predefined traffic pattern, the data stream has an invalid service set identifier, the data stream has an older service set identifier, the data stream has an invalid media access control, the data stream occurs outside of normal working hours, and the data stream includes too many queries transmitted at a same time from a same sender.

11. A computer system for detecting intrusion of a wireless network, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising;

program instructions to determine that a first data stream received by the wireless network does not include N1 communication protocols included in a second data stream previously determined to be valid, N1 being a positive integer;

program instructions to determine that N1 exceeds a predetermined first tolerance, and in response, to determine that the first data stream does not include N2 communication protocols included in a third data stream previously determined to be intrusive to the wireless network, N2 being an integer equal to or greater than zero;

program instructions to determine that N2 is less than a predetermined second tolerance, and in response, to generate an alert that the received first data stream is potentially intrusive to the wireless network;

program instructions to determine that the first data stream does not include N3 communication protocols included in a fourth data stream previously determined to be intrusive to the wireless network, in response to a determination that N1 exceeds the predetermined first tolerance and prior to a determination that the first data stream does not include the N2 communication protocols included in a third data stream, wherein N3 is an integer equal to or greater than one; and

program instructions to determine that N3 is equal to or greater than the predetermined second tolerance,

wherein N1 is 2, the predetermined first tolerance is 1, N2 is 1 and the predetermined second tolerance is 2.

12. The computer system of claim 11, wherein the second data stream is in a first library of data streams previously determined to be valid, the first library being stored in a first storage device, and wherein the third data stream is in a second library of data streams previously determined to be intrusive to the wireless network, the second library being stored in a second storage device.

13. The computer system of claim 11, wherein the data stream consists of one data packet.

14. The computer system of claim 11, further comprising:

program instructions to determine that a condition is satisfied, and in response, to generate the alert, wherein the condition is selected from the group consisting of the data stream matches a predefined traffic pattern, the data stream has an invalid service set identifier, the data stream has an older service set identifier, the data stream has an invalid media access control, the data stream occurs outside of normal working hours, and the data stream includes too many queries transmitted at a same time from a same sender.