MAP (Measure, Analyze, Protect) project (2005-2008)

MAP logo

This project is no longer active; this page is no longer updated.

Related projects: [DIST], [NetSANI], [Wi-Fi-measurement]

Related keywords: [security], [wifi]


Overview: Security through measurement for wireless LANs

Wireless networks are pervasive, but concerns remain about their security. In the MAP (Measure, Analyze, Protect) project we developed methods for large-scale monitoring and real-time analysis of Wi-Fi network traffic to identify attacks on the network. Specifically, the MAP effort focused on attacks that disable the network, denying access to legitimate clients or reducing the quality of their network performance. The MAP papers provide effective mechanisms for sampling network traffic using sniffers placed throughout the enterprise, a new way to detect whether a given client MAC address is being "spoofed" by an attacker node, and new methods for active fingerprinting of wireless devices.

The following was written during the project in 2005-07.

With the rise of Voice over wireless LAN (VoWLAN), any complete WiFi security solution must address denial of service attacks, such as kicking off other clients, consuming excessive bandwidth, or spoofing access points, to the detriment of legitimate clients. Even an authorized client may be able to sufficiently disrupt service quality to make the network ineffective for legitimate clients.

We take a three-point, MAP (Measure, Analyze, Protect) approach to develop an integrated and extensible framework to address existing and future attacks on WiFi networks. Specifically, we focus our efforts on an integrated set of new components that allow a WiFi network operator to measure and analyze WiFi and VoWLAN activity, and in real-time to identify and defend against MAC-layer attacks on that infrastructure. Our plan includes three overlapping phases: research, prototype development, and deployment on a large portion of Dartmouth's campus-wide wireless network.

Measurement: we have developed novel and scalable techniques to collect multi-channel MAC-layer traces of the environment, building on our wireless-measurement infrastructure. Our independant and coordinated channel sampling strategies dynamically adapt to current channel conditions. These are augmented by our refocusing mechanism which takes input from the analysis engines to further improve relevant frame capture.

Analysis: We have developed novel anomaly and signature detection techniques. Our MAC spoofing detection algorithm is based on RSSI observed at the air monitors.

Protection: we aim to develop a policy-driven protection engine that leverages existing defense mechanisms; the R&D challenge here is to integrate them into our analysis framework and to evaluate the impact of automated defenses on well-behaved users in a network.

Deployment:

With our partner, Aruba Networks, we will develop and deploy prototypes for testing in Phase 1-2, and in the third phase we are deploying our prototypes across Dartmouth' next-generation campus-wide WiFi network; this testbed provides valuable data for the research team and valuable input into Aruba's product pipeline.

Novelty:

We plan significant, novel extensions to existing technology; these techniques have never been applied to WiFi networks, to VoWLAN applications, or at the scale necessary for large deployment. Our integrated end-to-end MAP approach is new, and our proposed campus-wide deployment is unprecedented in scope and scale.

Our MAP approach provides a new foundation for wireless network security, able to dynamically measure, analyze and protect a WiFi network against existing and novel threats, including rogue clients and access points, with a focus on VoWLAN use cases.


People

Andrew Campbell, Guanling Chen, Udayan Deshpande, Tristan Henderson, David Kotz, Michael Locasto, Chris McDonald, Yong Sheng, Keren Tan, Bennet Vance, Joshua Wright, Bo Yan, Hongda Yin.

the MAP group

Funding

This research program is a part of the Institute for Security Technology Studies (ISTS), primarily supported by the US Department of Homeland Security (Science and Technology directorate) under award number NBCH2050002.

Aspects of this project were also supported by the Cisco Systems University Research Program, the US National Science Foundation under Infrastructure Award EIA-9802068, and the US Department of Justice (Bureau of Justice Assistance) under award 2005-DD-BX-1091

The views and conclusions contained on this site and in its documents are those of the authors and should not be interpreted as necessarily representing the official position or policies, either expressed or implied, of the sponsor(s). Any mention of specific companies or products does not imply any endorsement by the authors or by the sponsor(s).


Papers

For MAP papers involving David Kotz as co-author, see the list below.

Papers with Kotz as co-author (tagged 'map')

[Also available in BibTeX]

For MAP papers not involving David Kotz as co-author, see the list above.

Papers are listed in reverse-chronological order; click an entry to pop up the abstract. For full information and pdf, please click Details link. Follow updates with RSS.

2008:
Yong Sheng, Guanling Chen, Hongda Yin, Keren Tan, Udayan Deshpande, Bennet Vance, David Kotz, Andrew Campbell, Chris McDonald, Tristan Henderson, and Joshua Wright. MAP: A scalable monitoring system for dependable 802.11 wireless networks. IEEE Wireless Communications. October 2008. [Details]

Many enterprises have deployed 802.11 wireless networks for mission-critical operations; these networks must be protected for dependable access. This paper introduces project MAP, which includes a scalable 802.11 measurement system that can provide continuous monitoring of wireless traffic to quickly identify threats and attacks. We discuss the MAP system architecture, design decisions, and evaluation results from a real testbed.

Sergey Bratus, Joshua Brody, David Kotz, and Anna Shubina. Streaming Estimation of Information-theoretic Metrics for Anomaly Detection (Extended Abstract). Proceedings of the International Symposium on Recent Advances in Intrusion Detection--- Posters. September 2008. [Details]

Information-theoretic metrics hold great promise for modeling traffic and detecting anomalies if only they could be computed in an efficient, scalable ways. Recent advances in streaming estimation algorithms give hope that such computations can be made practical. We describe our work in progress that aims to use streaming algorithms on 802.11a/b/g link layer (and above) features and feature pairs to detect anomalies.

Udayan Deshpande. A Dynamically Refocusable Sampling Infrastructure for 802.11 Networks. PhD thesis, May 2008. Available as Dartmouth Computer Science Technical Report TR2008-620. [Details]

The edge of the Internet is increasingly wireless. Enterprises large and small, homeowners, and even whole cities have deployed Wi-Fi networks for their users, and many users never need to— or never bother to— use the wired network. With the advent of high-throughput wireless networks (such as 802.11n) some new construction, even of large enterprise buildings, may no longer be wired for Ethernet. To understand Internet traffic, then, we need to understand the wireless edge. Measuring Wi-Fi traffic, however, is challenging. It is insufficient to capture traffic in the access points, or upstream of the access points, because the activity of neighboring networks, ad hoc networks, and physical interference cannot be seen at that level. To truly understand the MAC-layer behavior, we need to capture frames from the air using Air Monitors (AMs) placed in the vicinity of the network. Such a capture is always a sample of the network activity, since it is physically impossible to capture a full trace: all frames from all channels at all times in all places. We have built a monitoring infrastructure that captures frames from the 802.11 network. This infrastructure includes several “channel sampling” strategies that will capture representative traffic from the network. Further, the monitoring infrastructure needs to modify its behavior according to feedback received from the downstream consumers of the captured traffic in case the analysis needs traffic of a certain type. We call this technique “refocusing”. The “coordinated sampling” technique improves the efficiency of the monitoring by utilizing the AMs intelligently. Finally, we deployed this measurement infrastructure within our Computer Science building to study the performance of the system with real network traffic.

Udayan Deshpande, Chris McDonald, and David Kotz. Refocusing in 802.11 Wireless Measurement. Proceedings of the Passive and Active Measurement Conference (PAM 2008). April 2008. [Details]

The edge of the Internet is increasingly wireless. To understand the Internet, one must understand the edge, and yet the measurement of wireless networks poses many new challenges. IEEE 802.11 networks support multiple wireless channels and any monitoring technique involves capturing traffic on each of these channels to gather a representative sample of frames from the network. We call this procedure channel sampling, in which each sniffer visits each channel periodically, resulting in a sample of the traffic on each of the channels.

This sampling approach may be sufficient, for example, for a system administrator or anomaly detection module to observe some unusual behavior in the network. Once an anomaly is detected, however, the administrator may require a more extensive traffic sample, or need to identify the location of an offending device.

We propose a method to allow measurement applications to dynamically modify the sampling strategy, refocusing the monitoring system to pay more attention to certain types of traffic than others. In this paper we show that refocusing is a necessary and promising new technique for wireless measurement.


Yong Sheng, Keren Tan, Guanling Chen, David Kotz, and Andrew Campbell. Detecting 802.11 MAC Layer Spoofing Using Received Signal Strength. Proceedings of the Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM). April 2008. [Details]

MAC addresses can be easily spoofed in 802.11 wireless LANs. An adversary can exploit this vulnerability to launch a large number of attacks. For example, an attacker may masquerade as a legitimate access point to disrupt network services or to advertise false services, tricking nearby wireless stations. On the other hand, the received signal strength (RSS) is a measurement that is hard to forge arbitrarily and it is highly correlated to the transmitter’s location. Assuming the attacker and the victim are separated by a reasonable distance, RSS can be used to differentiate them to detect MAC spoofing, as recently proposed by several researchers.

By analyzing the RSS pattern of typical 802.11 transmitters in a 3-floor building covered by 20 air monitors, we observed that the RSS readings followed a mixture of multiple Gaussian distributions. We discovered that this phenomenon was mainly due to antenna diversity, a widely-adopted technique to improve the stability and robustness of wireless connectivity. This observation renders existing approaches ineffective because they assume a single RSS source. We propose an approach based on Gaussian mixture models, building RSS profiles for spoofing detection. Experiments on the same testbed show that our method is robust against antenna diversity and significantly outperforms existing approaches. At a 3% false positive rate, we detect 73.4%, 89.6% and 97.8% of attacks using the three proposed algorithms, based on local statistics of a single AM, combining local results from AMs, and global multi-AM detection, respectively.


Sergey Bratus, Cory Cornelius, Daniel Peebles, and David Kotz. Active Behavioral Fingerprinting of Wireless Devices. Technical Report, March 2008. [Details]

We propose a simple active method for discovering facts about the chipset, the firmware or the driver of an 802.11 wireless device by observing its responses (or lack thereof) to a series of crafted non-standard or malformed 802.11 frames. We demonstrate that such responses can differ significantly enough to distinguish between a number of popular chipsets and drivers. We expect to significantly expand the number of recognized device types through community contributions of signature data for the proposed open fingerprinting framework. Our method complements known fingerprinting approaches, and can be used to interrogate and spot devices that may be spoofing their MAC addresses in order to conceal their true architecture from other stations, such as a fake AP seeking to engage clients in complex protocol frame exchange (e.g., in order to exploit a driver vulnerability). In particular, it can be used to distinguish rogue APs from legitimate APs before association.

Sergey Bratus, Cory Cornelius, David Kotz, and Dan Peebles. Active Behavioral Fingerprinting of Wireless Devices. Proceedings of the ACM Conference on Wireless Network Security (WiSec). March 2008. [Details]

We propose a simple active method for discovering facts about the chipset, the firmware or the driver of an 802.11 wireless device by observing its responses (or lack thereof) to a series of crafted non-standard or malformed 802.11 frames. We demonstrate that such responses can differ significantly enough to distinguish between a number of popular chipsets and drivers. We expect to significantly expand the number of recognized device types through community contributions of signature data for the proposed open fingerprinting framework. Our method complements known fingerprinting approaches, and can be used to interrogate and spot devices that may be spoofing their MAC addresses in order to conceal their true architecture from other stations, such as a fake AP seeking to engage clients in complex protocol frame exchange (e.g., in order to exploit a driver vulnerability). In particular, it can be used to distinguish rogue APs from legitimate APs before association.

2007:
Udayan Deshpande, Chris McDonald, and David Kotz. Coordinated Sampling to Improve the Efficiency of Wireless Network Monitoring. Proceedings of the IEEE International Conference on Networks (ICON). November 2007. [Details]

Wireless networks are deployed in home, university, business, military and hospital environments, and are increasingly used for mission-critical applications like VoIP or financial applications. Monitoring the health of these networks, whether it is for failure, coverage or attacks, is important in terms of security, connectivity, cost, and performance.

Effective monitoring of wireless network traffic, using commodity hardware, is a challenging task due to the limitations of the hardware. IEEE 802.11 networks support multiple channels, and a wireless interface can monitor only a single channel at one time. Thus, capturing all frames passing an interface on all channels is an impossible task, and we need strategies to capture the most representative sample.

When a large geographic area is to be monitored, several monitoring stations must be deployed, and these will typically overlap in their area of coverage. The competing goals of effective wireless monitoring are to capture as many frames as possible, while minimizing the number of those frames that are captured redundantly by more than one monitoring station. Both goals may be addressed with a sampling strategy that directs neighboring monitoring stations to different channels during any period. To be effective, such a strategy requires timely access to the nature of all recent traffic.

We propose a coordinated sampling strategy that meets these goals. Our implemented solution involves a central controller considering traffic characteristics from many monitoring stations to periodically develop specific sampling policies for each station. We demonstrate the effectiveness of our coordinated sampling strategy by comparing it with existing independent strategies. Our coordinated strategy enabled more distinct frames to be captured, providing a solid foundation for focused sampling and intrusion detection.


2006:
Udayan Deshpande, Tristan Henderson, and David Kotz. Channel Sampling Strategies for Monitoring Wireless Networks. Proceedings of the International Workshop on Wireless Network Measurement (WiNMee). April 2006. [Details]

Monitoring the activity on an IEEE 802.11 network is useful for many applications, such as network management, optimizing deployment, or detecting network attacks. Deploying wireless sniffers to monitor every access point in an enterprise network, however, may be expensive or impractical. Moreover, some applications may require the deployment of multiple sniffers to monitor the numerous channels in an 802.11 network. In this paper, we explore sampling strategies for monitoring multiple channels in 802.11b/g networks. We describe a simple sampling strategy, where each channel is observed for an equal, predetermined length of time, and consider applications where such a strategy might be appropriate. We then introduce a sampling strategy that weights the time spent on each channel according to the number of frames observed on that channel, and compare the two strategies under experimental conditions.


[Kotz research]