Detection and Elimination of Fake Access Points in WLAN using Multi Agents Sourcing Methodology

Transcription

1 Detectio ad Elimiatio of Fake Access Poits i WLAN usig Multi Agets Sourcig Methodology Priyaka G. Sasae Dept. of Computer Egi. SKNCOE, Vadgao Uiversity of Pue, Idia pdpatil.sae@sihgad.edu Prof. S. K. Patha Dept. of Computer Egi. SKNCOE, Vadgao Uiversity of Pue, Idia Abstract The major security issue i the Wireless LAN is, the presece of access poits which are ot approved by the admiistrator. If this issue is ot detected o time, them it may lead to serious etwork damage ad may result ito major data loss or data impact. May researchers have already proposed various solutios to overcome the above metioed situatio, but either most of them are limited i techiques or they are ot automated to absorb the frequecy alteratios i WLAN. This is the proposed research paper i which the ew approach is preseted which is based o Master ad Slave Topology. This is specially desiged approach which is ot oly workig o Fast Detectio of Rough Access Poits (FDRAP) but also icludes the solutios of mitigatig these Rough Access Poits. I the overview, this ew framework will be hadlig the Detectio as well Elimiatio of Rough Access Poits i the etwork. This Master ad Slave agets will automatically sca the etwork ad detect the uauthorized access poits usig various skew itervals. We have attempted to focus o followig methodologies for makig it successful 1) this specially desiged approach does ot require ay special hardware 2) Algorithm is desiged to work o both Detectio as well as Elimiatio 3) As o special hardware is ivolved, it becomes a very cost effective solutio 4) Due to multiple Master agets i actio, possibility of etwork cogestio or delay i packet sigalig is also reduced. This algorithm is proposed to block the RAPs ad also to remove them from the etwork with coverig both aspects like uauthorized APs or Rough Cliets actig as Ap s. Keywords- Itrusio Detectio System; Maet; Master; Rogue/Fake Access Poit; Slave; WLAN ***** I. INTRODUCTION Wireless LAN System (WLANs) is oe of the fastest growig techologies i the Commuicatio world. With the fastest growig & commuicatig world, the demad of devices which ca work or commuicate without cables are icreasig day by day. Primarily Wireless etworks are predomiatly used by mobile or omadic computig devices to provide them the etwork access without cables. It serves its ow attractive purposes likes mobility, greater flexibility i device hadlig ad operatig, portability, ad more importatly freedom of access with sigificat security. There is possibility that soopig of the wireless commuicatio, because the sigals from wireless etworks are usually uidirectioal ad due to its variety i rage projectios it may get reach beyod the iteded coverage area. Here this situatio it becomes primary alert to secure the etwork physically because eve ayoe with wireless receiver ca attempt to soop the etwork ad may times this type of itrusio is virtually udetectable. To overcome this type of security threat, may researchers have proposed various papers, discussig about most commo security protocols; also it has bee observed that Wired Equivalet Privacy (WEP) also faces breakdows if it is cofigured improperly. Oe of the most impressive security challeges for the etwork admiistrator amog rest all is the, desigig prevetive majors to block the Rough Access Poits (RAPs) [10-12]. This attack of RAP is cosidered as Serious Threat to the etwork because, may other threats are either based o very high-level of techical kowledge represetatios or to breakdow the security very sophisticated & costly istrumets are required, but this type of RAPs could be easily accomplished eve by people with limited kowledge related with etwork security. I the literature the Rough Access Poits are referred as Uauthorized AP. I descriptio, it ca be described as, a wireless poit which is either istalled o secure etwork without takig ito cosideratio the explicit authorizatio from local admiistrator [15], or maybe it has bee falsely cofigured which may allow cracker to coduct a ma-imiddle attack, or i worst situatio, it ca be used by adversaries for committig soopig ad executig various attacks. The Rough APs ca be classified broadly ito various categories based o levels like Uauthorized Rough APs, Improperly Cofigured Rough APs, ad Compromised Rough APs ad used for Phishig Rough APs. To get more iformatio about them alog with possible scearios, readers are advised to refer [5] for i-depth taxoomy of all metioed categories. Cosiderig the fact that may commercial products are available readily i the market for detectig the RAPs [10-12], ad also studies proved that extesive research work has ot bee carried out, here i this area ad moreover may are performig oly RAP detectio ad very few amog them are focusig o elimiatig / blockig of these RAPs. So to fill this gap, this paper we are proposig a completely ew & ovel approach with Multi Aget Sourcig Methodology for detectio ad elimiatio of RAPs. The project flow of this paper will be like Sectio (II) will discuss the related work ad Curret Approaches. Ad 1673

2 i ext Sectio (III) we are discussig about the System Architecture. Mathematical model at sectio (IV) followed by result at (V). At the coclusio portio the Sectio (VI) is dedicated followed by Refereces i Sectio (VII). II. RELATED WORK Mobile Ad-hoc Networks abbreviated as MANETs are ifamous for their ifrastructural support ad trasiet or short-lived ature. These characteristics of MANETs are really providig challegig platform for IDS executios. The major fact of MANETs is, eve frequet chages i topology ad commuicatio patters requires the use of specialized protocols ad specially desiged strategies for successful routig, trasportig ad securities. The researches i MANET are majorly focused o Private Public Key Maagemet, Routig Protocols ad Itrusio Detectio Systems, but past experimets ad researches have proved that the desiged itrusio prevetio algorithms ad ecryptio techiques are ot sufficiet, ad if we attempt to complex it, it will lead to more complex security problems. O the cotrary, the itrusio techiques used i wired etworks are caot be directly applied as it is to Mobile Ad Hoc Networks, based o special characteristics possessed by this type of etworks. To take research oe step ahead, most curret MANET IDS are still i pre-mature stage, which directly implies huge scope ad aggressive developmet i the program of makig Ad Hoc Network more secure which ca be achieved by desigig more advaced ad itelliget itrusio detectio systems. Whe we make compariso with wired etworks ad wireless ad hoc etworks, we eed to cosider the importat differeces while desigig a itelliget itrusio detectio system. To summarize, we are suggestig few major differeces betwee wired ad wireless etworks wired etworks are usig variety of devices like gateways, routers, ad switches for traffic moitorig purposes, but wireless ad hoc etworks are purely lackig traffic maagemet aspect. I result the IDS i wireless etworks are based o local security audit data. We ca suggest to take followig aspect ito cosideratio i usig IDS i wireless etworks because of limited resources, oe should emphasis o securig it with keepig i mid the resource cosumptio characteristics, which meas it is most preferred to use periodic itrusio detectio system istead of a Always ON prevetive cofiguratios. A. Itroductio to Mobile Agets Mobile Agets (MA) is basically software etities which ca physically travel across the etwork ad perform various assiged tasks o targeted machies which provide the hostig capacity for this aget. This allows processes to migrate from oe computer to other, or sometimes base o requiremets processes gets spilt ito multiple istaces that will get executed o differet machies ad will retur to their poit of origis. Here term migratios of mobile agets essetially implies that, some code with required set of data i trasferred to aother ode for remote executio of that code. B. Rogue Access Poit The Rogue Access Poit ca be defied as: Fig 1. System Architecture [6] Rough Access Poits are usually istalled over the etwork without autheticatig itself ad also it will violate the security policies. Basically these Rough Access Poits are istalled to the etwork with the major itetio to attack o the cofidetial iformatio. Based o above two defiitios we ca easily idetify the Rough Access Poits. I above figure we have attempted to show the approaches we have take for this paper. While desigig this proposed approach, we have take ito cosideratio followig elemets which will be the limitatio for this work - Due to use of Multi-Aget System, the performace of this proposed system alog with overall etwork may get impacted like overall throughput or wireless etwork, packet drop ratio, ed to ed delay etc. - While autheticatig the ew the access poit for its validity, Heavy load o oe Master Aget may ivolve uecessarily extra time, which will result ito icremet i extra etwork overhead ad may decrease the overall etwork throughput. III. ADVANCEMENT IN THE PROJECT There are few researches that have already performed i the field of detectig ad blockig these Rough Access Poits, but oe of them is able to provide the really fruitful solutio o this. Most of the developmets are doe o the base of eed of dedicated piece of software ad hardware, or eve some special qualified employees for performig differet types of etwork scas also sometimes it is like usig curret employees for regular scaig of their viciity for cross checkig ay uauthorized access poits active aroud them. To overcome this type of depedecies o specially customized hardware or depedecies o maual efforts which are most of the time subjected to be error proe, here we are proposig the fully automated cocept of detectig the elimiatig RAPs by applyig the Mobile Multi-Agets effectively o to the etwork. Here we are usig ew approach with usig two differet levels of Mobile Agets uder ew classificatios Master & Slave Mobile Agets. To achieve this we exteded the system architecture with additio of skew itervals to periodically sca the etworks 1674

3 istead of scaig i a Always ON mode. The executios 6. If ew Access Poit is detected, the cloed aget will build process will be like the INFO Packet automatically cotaiig importat - Iitially a master aget is geerated o the DHCP-M Server, iformatio about ewly detected Access Poit. which will be resposible for all regulatig all the 7. This INFO packet is haded over to the related Slave Aget authorizatio procedures for the wireless etwork. 8. Now, Slave Aget will had over this INFO packet to the - I later stages, the Master Aget will geerate the Slave Master Aget ad the Master Aget will trasfer this etire Aget based o umber of Active Access Poit coected packet to the DHCP Server for testig Autheticity of the to the server at that momet of time. Iformatio cotaied i the INFO Packet - Based o the supplied data, these Slave Agets are 9. If the DHCP server does NOT foud ay match of ew dispatched to the respective APs coected. iformatio i the firstly created Geuie Database, the it - Now, all these Slave Agets will be cloed o every Access will declare it as Rough Access Poit. Poit ad beig dispatched to the every coected cliets 10. Now to block or deactivate this Rough Access Poit, over that Access Poit. followig steps are performed, esurig o mistakes - Now this ewly Cloed Slave Agets will costatly a. First to get highest accuracy, the INFO packet is moitor the cliet systems ad detects ew Access Poits if extracted properly to get the correct MAC address ay b. Based o this MAC address, the exact Network - If these ewly Cloe Slave Agets detect ew Access Poit, Switch Address is idetified. it will automatically build iformatio packets INFO c. After successfully idetifyig the Network Switch, cotaiig followig iformatio about detected the ext target is to locate the exact port umber. Uauthorized APs SSID of Uauthorized APs, MAC- d. Oce the accurate port umber is calculated, the the Address of Uauthorized APs, Vedors Name used for fial task will be blockig it from ay other wireless Uauthorized APs, Chael Used by Uauthorized APs, etc etwork traffic. - This INFO packets are the trasferred to mai Slave Aget ad this Slave Aget will deliver this packet safely to the B. Clock Skew Master Aget o the sever. The Clock Skew ca be defied as the variaces betwee - At server, this ewly arrived iformatio is compared with the times publicized by the clocks at various odes at the same the stored repositories of all valid Access Poits. time iterval. As this Clock Skew idicatig the time - If foud that AP is authorized, the ew Slave Aget will be differeces betwee odes, so we ca use it to idetify ad geerated ad set over the respective AP to moitor it categories various etwork devices fallig ito similar or agai for ext attempt of itrusios. differet time itervals.studies have show that we ca implemet the usability of these clock skews to isolate more - But if AP is foud uauthorized, the Disassociatio Frame tha 512 uique access poits. is set to all APs iformig them ot to coect with this uauthorized AP a. Liear Programmig Method (LPM) - Else if details does t match with the repository, the the I this LP Method, first we eed to miimize or reduce MAC- Address of the AP will be fetched from the INFO, followig fuctio carefully by eterig appropriate values i ad the port at which the MAC-Address is coected will be the fuctio. get searched ad the it will be blocked for ay sort of LAN Traffic. - This will automatically deactivate the RAP ad also 1 prevets cliets (if ay) from droppig the active coectio (δ xi φ oi) ad allows cliets to get associate with the earest AP i=1 which is authorized. - This is a very simple ad most effective techique for The major drawback of this method is it idicates High completely routig out the RAP from the etwork [1]. tolerace icliig towards the outliers. Please fid the ext steps from algorithm desiged for the Skew Itervals A. Steps to implemet 1. First create Master Aget o the DHCP server 2 From Master Aget Geerate the Slave Aget based o umber of access poits 3. Oce Slave Agets are geerated, trasfer them to all access poits 4. Whe Slave Agets are arrived at all the Access Poits, cloe all the Slave Agets agai. 5. Now, by geeratig Clock Skews at each Slave Aget, sca all the Access Poits. Ad it will create first Geuie Database. b. Least Square Fit (LSF) I this method, we have to focus o miimizig the followig equatio, by submittig the exact figures from the calculated iputs. [oi (δxi + φ)] 2 i=1 The master advatage of this methodology is, it allows low tolerace towards outliers which is really importat elemet i this proposed architecture. As a outcome, we ca distiguish betwee two Access Poits, eve if their Clock Skew values are very closely located alogside each other s. Idicatig, we ca use this methodology to idetify the Fake Access Poits, by takig 1675

4 accurate judgmet o the Access Poits which are egieered IV. UML DIAGRAMS very close to the Clock Skew of the Authorized Access Poits. 1. USE case diagram c. Implemetatio of LSF: We have already defied a fuctio f = [yi δxi + φ ] 2 i=1 Applyig stadard procedure to fid miima, we differetiate it partially with respect to δ ad equate it to zero. A. f/ δ = 0 ad f / = 0 Solvig them simultaeously, we get estimated value of δ as δ = xy x y x 2 x 2 C. Major Compoets of System: DHCP-M: This is cetral repository resposible for moitorig autheticatio process of active wireless etworks. Master Aget: Geerated at DHCP Server. Slave Aget: Geerated at every access poit i etwork Cloe Aget: Resided at cliet side. Access Poit: Coected with DHCP sever Cliet: Coected with AP. Fig 3. USE case Diagram 2. Sequece diagram Fig 2. RAP Detectio ad Elimiatio System architecture Fig 4. Sequece Diagram 1676

5 3. Flowchart Rogue Access Poits. (The port umber is calculated from the MAC Address) To evaluate the performace we ca produce the graphs like Time Graph ad Chael Graph ad also we ca provide filterig mechaisms for filterig the Access Poits based o APs Age, Chael Number etc. Please see followig represetatio for the results acquired Fig 5 RAP Detectio Algorithm V. RESULT As described, the practical evaluatios ca be expressed by cosiderig followig while developig this applicatio, we have developed a small desktop applicatio usig C#.et ad makig this code act like a Rogue Access Poit. Also similarly we will develop aother applicatio which will check the data provided by the Access Poits. The mai achievable from all this is to detect the Rogue Access Poits preset i the etwork. I the simulatio we will activate both above metioed modules ad o executio we will check for Origial ad Rogue Access Poits, ad if we locate the Rogue Access Poits, the block that port from trasferrig data usig our applicatio. The major modules of this applicatio ca be summarized as 1. Detectio of access poits. 2. Checkig of access poit. Rogue (Fake)/origial 3. Blockig the access poit from trasferrig data. The first module will eed Wi-Fi coectio ad some access poits which we will be detectig. (Laptop devices have the Wi-Fi hardware ibuilt, so we ca use laptop here). Now oce the secod module gets iitiated, it will collect the valuable data about access poits like MAC Address, SSID, RSI etc. ad this data will be reported to the server. Now at server level, this data is processed o the skew itervals alog with estimatig secod skew itervals for some equatio ad will be checked for equality if both the results are idicatig idetical iformatio, if they are same, the we ca declare that the metioed Access Poit is Origial, otherwise if results are ot similar we ca declare that Access Poit as Fake. Oce this Access Poit judgmet is doe, the fial module will get ivolved ad it will block the data commuicatio from the Fake Access Poits, by blockig the port umbers of those Fig. 3 Mai scree of proposed architecture Above figure showig that access poit scaig widows is ready to capture all the available access poits i etworks i your area. VI. CONCLUSION AND FUTURE SCOPE I this paper, we proposed a ew methodology of usig Multi- Aget as a itegrated solutio for both detectig ad elimiatig the Rogue Access Poits from the etwork. Clear ad easy to implemet algorithm makes this architecture robust. This multi aget based architecture proved to ot oly idetify but also elimiate the rogue access poits completely. Our proposed techique is very reliable ad cost effective, as it deals with multiple level of detectio ad does t require ay specialized hardware device; implemetatio performed also supports our belief ad results i a very effective methodology of complete removal of RAPs. ACKNOWLEDGMENT I feel happiess i forwardig this paper as a image of sicere efforts. The successful project desig reflects my work, effort of my guide i givig me good iformatio. My sicere thaks to my guide Prof. S.K. Patha who has bee a costat source of ispiratio ad guidig star i achievig my goal. I express my deep gratitude to all staff members who led me their valuable support ad cooperatio to eable me to complete my project desig paper successfully. REFERENCES [1] V. S. Shakar Sriram, G. Sahoo, Ashish P. Sigh, Abhishek Kumar Maurya Securig IEEE Wireless LANs - A Mobile Aget Based Architecture 2009 IEEE Iteratioal Advace Computig Coferece (IACC 2009) Patiala, Idia, 6-7 March [2] Prof.S.B.Vajale (Ph.D Studet), J.A.Dave(M.Tech. Studet), Uapproved Access Poit Elimiatio I 1677

6 Wla Usig Multiple Agets Ad Skew Itervals, Departmet of Computer Egg Bharati Vidyapeeth Deemed Uiversity College of Egieerig Pue, Iteratioal Joural of Egieerig Sciece ad Techology (IJEST), Feb [3] V. S. Shakar Sriram, G. Sahoo A Mobile Aget Based Architecture for Securig WLANs Iteratioal Joural of Recet Treds i Egieerig, Vol 1, No. 1, May [4] Sogrit Srilasak, Kitti Wogthavarawat ad Aa Phophoem, Itelliget Wireless Network Group (IWING) Itegrated Wireless Rogue Access Poit Detectio ad Couterattack System published i 2008 Iteratioal Coferece o Iformatio Security ad Assurace. [5] Lira Ma, Ami Y. Teymoria, Xiuzhe Cheg A Hybrid Rogue Access Poit Protectio Framework for Commodity Wi-Fi Networks published i the IEEE INFOCOM [6] Ahmed Ayad Abdalhameed, Detectig ad Elimiatig Rogue Access Poits i IEEE WLAN Based o Agets Termiology ad Skew Itervals: A Proposal, Iteratioal Joural of Egieerig ad Advaced Techology (IJEAT) ISSN: , Volume-2, Issue-4, April 2013 [7] Laier Watkis, Raheem Beyah, Cherita Corbett A Passive Approach to Rogue Access Poit Detectio X/07/$ IEEE. [8] Sogrit Srilasak, Kitti Wogthavarawat, Aa Phophoem Itegrated Wireless Rogue Access Poit Detectio ad Couterattack System 2008 Iteratioal Coferece 1678