Rogue Access Point Detection Using Segmental TCP Jitter
Rogue Access Points (RAPs) pose serious security threats to local networks. An analytic model of prior probability distribution of Segmental TCP Jitter (STJ) is deduced from the mechanism of IEEE 802.11 MAC Distributed Coordinated Function (DCF) and used to differentiate the types of wire and WLAN connections which is the crucial step for RAPs detecting. STJ as the detecting metric can reflect more the characteristic of 802.11 MAC than ACK-Pair since it can eliminate the delay caused by packet transmission. The experiment on an operated network shows the average detection ratio of the algorithm with STJ is more than 92.8％ and the average detection time is less than 1s with improvement of 20％ and 60％ over the detecting approach of ACK-Pair respectively. Farther more no WLAN training trace is needed in the detecting algorithm.
Rogue AP Segmental TCP Jitter Analytic Model Sequential Hypothesis Testing
Gaogang XIE Tingting HE Guangxing ZHANG
Institute Of Computing Technology,CAS, 100080 Beijing Institute of Computing Technology,CAS, 100080，Beijing Institute of Computing Technology,CAS, 100080, Beijing
国际会议
第十七届国际万维网大会(the 17th International World Wide Web Conference)(WWW08)
北京
英文
2008-04-21（万方平台首次上网日期，不代表论文的发表时间）