MAP: A scalable infrastructure for securing 802.11 wireless networks

Guanling Chen
UMass Lowell

Friday 19th January 2007
11:00 a.m. - 12:00 p.m.
Fuller Labs 320

The shared medium of 802.11 wireless networks means that they are susceptible to many MAC-layer attacks, such as denial of service, reduction of quality or eavesdropping. To detect such attacks it is necessary to monitor the wireless channel itself---to "sniff" the air---to examine the timing and content of the 802.11 frames. This is a difficult problem: sniffers may not hear every frame, co-located sniffers may hear identical frames at different or unsynchronized times, or a sniffer may have its radio listening to a different channel to that on which an attack is occurring. Accurate detection of attacks is therefore a difficult challenge.
      This talk will present MAP (Measure, Analyze, Protect), a scalable monitoring and detection framework that addresses these problems. Using 20 sniffers placed over a 3-floor building, we evaluate various channel-sampling strategies using metrics for capture quality and detection accuracy, and a method for merging frames from multiple sniffers that reduces both bandwidth requirements for wireless monitoring and detection errors. We also describe our detection techniques and demonstrate that our channel-sampling and merging techniques are sufficient for detecting attacks on a live wireless network. Finally, we evaluate the performance of the various MAP components in the current deployment (in terms of CPU load, bandwidth, and other resources) and demonstrate that our infrastructure is effective and efficient at scale.

______

Guanling Chen is an Assistant Professor of Computer Science at the University of Massachusetts Lowell. He has a PhD in Computer Science from Dartmouth College. His general interests are in wireless networks, mobile systems, and pervasive computing. His current research involves Cybersecurity through measurement for wireless LANs. He has also worked on a scalable data-fusion system for distributed Internet worm detection.

Host: Craig Wills

Refreshments will be served.