단말기반 무선 랜 Rogue AP 탐지 기법
A Scheme of Mobile User-centric Rogue AP Detection in WLAN
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 논문에서는 무선랜 환경에서 모바일 단말중심의 로그 AP(Access Point) 탐지 기법을 제안한다. 제안된 기법은 로그 AP 공격 형태 중 사용자에게 가장 취약하며, 발생 가능성이 높은 Evil Twin AP 탐지를 위한 무선 홉 수 탐지기법이다. 단말은 특정 AP 접속 시 무선 홉 수를 검사하여 로그 AP에 대한 보안 위협을 탐지하고, 정상 AP와 로그 AP의 IP 주소 및 무선 홉 수를 비교하여 정확하게 정상 AP와 로그 AP를 구분한다. 기존에 제안된 로그 AP 탐지 기법은 탐지를 위해 주기적인 무선구간 모니터링이 요구되어 모바일 단말에 적용이 어려운 단점이 있으며, 탐지 임계값 결정을 위해 추가적인 네트워크 인프라가 요구되어 실제 Public 무선랜 환경에 사용이 적합하지 않다. 제안 기법은 이러한 문제를 해결하기 위한 모바일 단말 및 실제 무선랜 환경에서 적용 가능한 효율적인 로그 AP 탐지 기법이며, 실제 무선랜 환경에서 실험을 통해 성능 검증을 하였다.
Abstract
This paper proposes a method of Rogue AP(Access Point) detection on mobile user-centric in wireless LAN environment. By checking a number of wireless hops, this method can detect Evil Twin AP which is easy and the most common Rogue AP attacks. To detect a Rogue AP, when an user connects to an AP, our scheme will check a number of wireless hops, and then comparing the number of wireless hops and IP address of real AP and Evil Twin AP to distinguish them. Existing Rogue AP detection techniques require client to monitor regularly wireless packet and need additional network infrastructure to specify a detection threshold value. Therefore, it is not suit for applying these techniques to the real public wireless LAN. The proposed Rogue AP detection scheme can be applied to mobile devices (e.g. Smartphone) to solve effectively this problem. In addition, we verify the effectiveness of our scheme through the experiments in actual wireless LAN environment.
참고문헌 (20)
- Hao Han, "A Timing-Based Scheme for Rogue AP Detection", IEEE Transactions on Parallel and Distributed Systems, 22(11), pp.1912~1925 (2011)
- Chao Yang, "Active User-side Evil Twin Access Point Detection Using Statistical Techniques", IEEE Transactions on Information Forensics and Security, 7(5), pp.1638~1651 (2009)
- Suman Jana, "On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews", IEEE Transactions on Mobile Computing, 9(3), pp.449~462 (2010)
- Franco Callegati, "Man-in-the-Middle Attack to the HTTPS Protocol", IEEE Security & Privacy, 7(1), pp.78~81 (2009)
- Hyunuk Hwang, "A Study on MITM (Man in the Middle) Vulnerability in Wireless Network Using 802.1x and EAP", proc. IEEE ICISS 2008, pp.164~170 (2008)
- Ke Gao, "A Passive Approach to Wireless Device Fingerprinting", proc. IEEE, 2010, 383~392
- "Nmap: Free security scanner for network exploration & security audits"[URL]
- "A versatile passive os fingerprinting tool"[URL]
- "Active os fingerprinting tool"[URL]
- Sachin Shetty, "Rogue Access Point Detection by Analyzing Network Traffic Characteristics", proc. IEEE MILCOM 2007, pp.1~7 (2007)
- Kuo-Fong Kao, "Detecting Rogue Access Points Using Client-side Bottleneck Bandwidth Analysis", IEEE Computers & Security, 28(3), pp.144~152 (2009)
- "Tired of Rogues: Solutions for Detecting and Eliminating Rogue Wireless Networks" (2009), AirDefense
- "Best Practices for Securing Your Wireless LAN" (2004), AirMagnet
- "AirWave Wireless Management Suite" (2006), AirWave
- Desmond C.C. Loh, "Identifying Unique Devices Through Wireless Fingerprinting", proc. ACM WiSec 2008, pp.46~55 (2008)
- Oktay Ureten, "Wireless Security through RF Fingerprinting", IEEE Canadian Journal of Electrical and Computer Engineering, 32(1), pp.27~33 (2007)
- Jeyanthi Hall, "Radio Frequency Fingerprinting for Intrusion Detection in Wireless Networks", IEEE Transactions on dependable and secure computing (2005)
- Payal Bhatia, "Solution to the Wireless evil-twin Transmitter Attack", proc. IEEE CRiSIS 2010, pp.1~7 (2010)
- Fanglu Guo, "Sequence numberbased MAC address spoof detection", proc. RAID 2005, pp.309~329 (2005)
- Diogo Monica, "WiFiHop - Mitigating the Evil Twin Attack through Multi-hop Detection", proc. ESORICS 2011, pp.21~39 (2011)