A wireless multi-step attack pattern recognition method for WLAN

作者：Chen, Guanlin; Zhang, Yujia; Wang, Can^*

来源：Expert Systems with Applications, 2014, 41(16): 7068-7076.

DOI：10.1016/j.eswa.2014.05.029

• Multi-stage attack
• Pattern recognition
• WLAN
• Correlation analysis
• Network security

Intrusion detection and prevention technology has been broadly applied to wired networks as an important means to protect network security. However, few work in this area has been extended to the WLAN. In this paper, we propose a wireless multi-step attack pattern recognition method (WMAPRM) based on correlation analysis with the main attributes of the IEEE 802.11 frame. The method consists of six steps: clustering wireless intrusion alerts, constructing a global attack database, building candidate attack chains, filtering candidate attack chains, correlating multi-step attack behaviors and recognizing multi-step attack patterns. Experimental results in real world environment show that WMAPRM is capable of identifying highly correlated multi-step attack patterns such as WEP crack with ARP + Deauthentication Flood, WEP crack with wesside-ng, config file stealing attack and authentication session hijack attack etc. The method is expected to improve both wireless intrusion detection and prevention performance in practical WLAN security scenarios.

• 出版日期2014-11-15
• 单位浙江大学; 浙江大学城市学院