Sequence Number-Based MAC Address Spoof Detection

Abstract. The exponential growth in the deployment of IEEE 802.11based wireless LAN (WLAN) in enterprises and homes makes WLAN an attractive target for attackers. Attacks that exploit vulnerabilities at the IP layer or above can be readily addressed by intrusion detection systems designed for wired networks. However, attacks exploiting linklayer protocol vulnerabilities require a different set of intrusion detection mechanism. Most link-layer attacks in WLANs are denial of service attacks and work by spoofing either access points (APs) or wireless stations. Spoofing is possible because the IEEE 802.11 standard does not provide per-frame source authentication, but can be effectively prevented if a proper authentication is added into the standard. Unfortunately, it is unlikely that commercial WLANs will support link-layer source authentication that covers both management and control frames in the near future. Even if it is available in next-generation WLANs equipments, it cannot prot...

• Type: Conference
• Year: 2005
• Where: RAID
• Authors: Fanglu Guo, Tzi-cker Chiueh
• Keywords: IEEE 802.11, Intrusion Detection, Most Link-layer Attacks, RAID 2005