Experiences in passively detecting session hijacking attacks in IEEE 802.11 networks

Current IEEE 802.11 wireless networks are vulnerable to session hijacking attacks as the existing standards fail to address the lack of authentication of management frames and network card addresses, and rely on loosely coupled state machines. Even the new WLAN security standard - IEEE 802.11i does not address these issues. In our previous work, we proposed two new techniques for improving detection of session hijacking attacks that are passive, computationally inexpensive, reliable, and have minimal impact on network performance. These techniques utilise unspoofable characteristics from the MAC protocol and the physical layer to enhance confidence in the intrusion detection process. This paper extends our earlier work and explores usability, robustness and accuracy of these intrusion detection techniques by applying them to eight distinct test scenarios. A correlation engine has also been introduced to maintain the false positives and false negatives at a manageable level. We also ex...

• Type: Conference
• Year: 2006
• Where: ACSW
• Authors: Rupinder Gill, Jason Smith, Andrew Clark
• Keywords: ACSW 2006, ACSW 2007, Detection Techniques, Intrusion Detection, Session Hijacking Attacks