We develop a practical and comprehensive hybrid rogue access point (AP) detection framework for commodity Wi-Fi networks. It is the first scheme that combines the distributed wireless media surveillance and the centralized wired end socket level traffic "fingerprinting." The former is designed not only to detect various types of rogue APs, but also to discover suspicious activities so as to prevent the adversaries from turning victim APs into rogue devices. Moreover, the socket level traffic

more »

... gerprinting helps our frame work to achieve a finer granularity on rogue AP detection among the existing schemes. This framework has the following nice properties: i) it requires neither specialized hardware nor modification to existing standards; ii) the proposed mechanism greatly improves the rogue AP detection probability so that network resilience is improved; iii) it provides a cost-effective solution to Wi-Fi network security enhancement by incorporating free but mature software tools; iv) it can protect the network from adversaries capable of using customized equipment and/or violating the IEEE 802.11 standard; v) its open architecture allows extra features to be easily added on in the future. Our analysis and evaluation demonstrate that this hybrid ro gu e A P p rot ec t i on f r a m ew o rk i s ca p ab l e o f rel i a bl y rev ea l i ng ro g ue dev i ce s a n d p re em p t i n g po t e n t i al at t a ck s . Index Terms-Rogue access point detection, commodity Wi-Fi networks, intrusion detection, wireless security. This full text paper was peer reviewed at the direction of IEEE Communications Society subject matter experts for publication in the IEEE INFOCOM 2008 proceedings. 978-1-4244-2026-1/08/$25.00