A Rogue Access Point Detection System Based on Packet Analysis for Campus Network

• Main Authors: Hsin-Chien Wu, 吳欣蒨
• Other Authors: I-En Liao
• Format: Others
• Language: zh-TW
• Published: 2008
• Online Access: http://ndltd.ncl.edu.tw/handle/39752085289334686914

碩士 === 國立中興大學 === 資訊科學與工程學系 === 96 === With the rapid decline of the cost, wireless network has become more and more popular in the campus; however, this also creates new issues in the network security management, the Rogue AP(Access Point) is the most common among them. A Rogue AP is a wireless access point setup by a network user without authorization, and is usually neglected by most network administrators. It may become a major security leak if not carefully treated. Network administrators can only advise their users, without the capability of enforcement, to have their APs participated in the authentication scheme. As the result, for their conveniences, most users will not register them, and those Rogue APs turn out to be a big problem in the network management. To establish an efficient management system for the Rogue APs, this thesis elaborates a Rogue AP detection system based on the behaviors of sessions. We installed a packet collector in the core switch in the campus network, and analyzed the behavior of each session to identify if it was issued by an AP. This system creates a suspect APs list in real time. By comparing this list with the registered one, an administrator can then take actions. In order to decrease the complexity of analysis and increase the accuracy of the detection to the experimentation of this thesis, the noise information is filtered out by dropping characteristic that has a large variance against the average value, and the effectiveness of the system is verified by implementing it into the campus network in National Chung Hsing University. The experiment results showed that the system could achieve accuracy up to 90.90% in the report of Rogue APs, and also demonstrated that the system could be effectively applied to a large scale campus network in detecting Rogue APs.