Association attacks: Identifying association protocols

Tingting Sun; Yanyong Zhang; Wade Trappe

doi:https://doi.org/10.1109/WoWMoM.2012.6263766

Association attacks: Identifying association protocols

Tingting Sun, Yanyong Zhang, Wade Trappe

School of Engineering, Electrical & Computer Engineering

Rutgers, The State University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

In this paper, we examine the problem of identifying different association protocols based on client probing patterns. We take the view point of an attacker, who aims to trick certain clients to switch their association to a compromised AP, so that the attacker can easily perform various attacks, such as passing false management frames and stealing client information. In order to do that, the attacker must know what association protocol the client is using since it determines the clients switching criteria. Therefore, the attacker must be able to identify the association protocol by monitoring the network traffic. We investigated methods to identify four association protocols and propose an approach which combines k-means clustering and Gaussian fitting to classify the association protocols based on probing patterns. We tested the designed scheme on traffic traces for a variety of network scenarios. We also designed a method to quantify the likelihood of the identification using confidence intervals. Results show that the proposed method can correctly identify association protocols. Further interpretation of the results also reveals information regarding important metrics of the clients chosen association protocol.

Original language	American English
Title of host publication	2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings
DOIs	https://doi.org/10.1109/WoWMoM.2012.6263766
State	Published - 2012
Event	13th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - San Francisco, CA, United States Duration: Jun 25 2012 → Jun 28 2012

Publication series

Name	2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings

Other

Other	13th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012
Country/Territory	United States
City	San Francisco, CA
Period	6/25/12 → 6/28/12

ASJC Scopus subject areas

Computer Networks and Communications

Access to Document

https://doi.org/10.1109/WoWMoM.2012.6263766

Cite this

Sun, T., Zhang, Y., & Trappe, W. (2012). Association attacks: Identifying association protocols. In 2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings [6263766] (2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings). https://doi.org/10.1109/WoWMoM.2012.6263766

@inproceedings{83e6e388a378453fb33d97e3c3b2d8b7,

title = "Association attacks: Identifying association protocols",

abstract = "In this paper, we examine the problem of identifying different association protocols based on client probing patterns. We take the view point of an attacker, who aims to trick certain clients to switch their association to a compromised AP, so that the attacker can easily perform various attacks, such as passing false management frames and stealing client information. In order to do that, the attacker must know what association protocol the client is using since it determines the clients switching criteria. Therefore, the attacker must be able to identify the association protocol by monitoring the network traffic. We investigated methods to identify four association protocols and propose an approach which combines k-means clustering and Gaussian fitting to classify the association protocols based on probing patterns. We tested the designed scheme on traffic traces for a variety of network scenarios. We also designed a method to quantify the likelihood of the identification using confidence intervals. Results show that the proposed method can correctly identify association protocols. Further interpretation of the results also reveals information regarding important metrics of the clients chosen association protocol.",

author = "Tingting Sun and Yanyong Zhang and Wade Trappe",

year = "2012",

doi = "https://doi.org/10.1109/WoWMoM.2012.6263766",

language = "American English",

isbn = "9781467312394",

series = "2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings",

booktitle = "2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings",

note = "13th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 ; Conference date: 25-06-2012 Through 28-06-2012",

}

Sun, T, Zhang, Y & Trappe, W 2012, Association attacks: Identifying association protocols. in 2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings., 6263766, 2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings, 13th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012, San Francisco, CA, United States, 6/25/12. https://doi.org/10.1109/WoWMoM.2012.6263766

Association attacks: Identifying association protocols. / Sun, Tingting; Zhang, Yanyong; Trappe, Wade.
2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings. 2012. 6263766 (2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Association attacks

T2 - 13th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012

AU - Sun, Tingting

AU - Zhang, Yanyong

AU - Trappe, Wade

PY - 2012

Y1 - 2012

N2 - In this paper, we examine the problem of identifying different association protocols based on client probing patterns. We take the view point of an attacker, who aims to trick certain clients to switch their association to a compromised AP, so that the attacker can easily perform various attacks, such as passing false management frames and stealing client information. In order to do that, the attacker must know what association protocol the client is using since it determines the clients switching criteria. Therefore, the attacker must be able to identify the association protocol by monitoring the network traffic. We investigated methods to identify four association protocols and propose an approach which combines k-means clustering and Gaussian fitting to classify the association protocols based on probing patterns. We tested the designed scheme on traffic traces for a variety of network scenarios. We also designed a method to quantify the likelihood of the identification using confidence intervals. Results show that the proposed method can correctly identify association protocols. Further interpretation of the results also reveals information regarding important metrics of the clients chosen association protocol.

AB - In this paper, we examine the problem of identifying different association protocols based on client probing patterns. We take the view point of an attacker, who aims to trick certain clients to switch their association to a compromised AP, so that the attacker can easily perform various attacks, such as passing false management frames and stealing client information. In order to do that, the attacker must know what association protocol the client is using since it determines the clients switching criteria. Therefore, the attacker must be able to identify the association protocol by monitoring the network traffic. We investigated methods to identify four association protocols and propose an approach which combines k-means clustering and Gaussian fitting to classify the association protocols based on probing patterns. We tested the designed scheme on traffic traces for a variety of network scenarios. We also designed a method to quantify the likelihood of the identification using confidence intervals. Results show that the proposed method can correctly identify association protocols. Further interpretation of the results also reveals information regarding important metrics of the clients chosen association protocol.

UR - http://www.scopus.com/inward/record.url?scp=84866409555&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84866409555&partnerID=8YFLogxK

U2 - https://doi.org/10.1109/WoWMoM.2012.6263766

DO - https://doi.org/10.1109/WoWMoM.2012.6263766

M3 - Conference contribution

SN - 9781467312394

T3 - 2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings

BT - 2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings

Y2 - 25 June 2012 through 28 June 2012

ER -

Sun T, Zhang Y, Trappe W. Association attacks: Identifying association protocols. In 2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings. 2012. 6263766. (2012 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, WoWMoM 2012 - Digital Proceedings). doi: https://doi.org/10.1109/WoWMoM.2012.6263766

Association attacks: Identifying association protocols

Abstract

Publication series

Other

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this