无线局域网非授权用户入侵行为分析及检测*

针对当前流行的破解有线等效加密无线局域网密钥进而盗用上网资源的现象,研究了相关产品的攻击手段.对其提供的交互式重放攻击、ARP注入攻击、chopchop攻击和分片攻击四种攻击方式,通过跟踪记录攻击过程,分析了它们的攻击原理.在借鉴KDD99等特征提取方法的基础上,提取了9个用于识别攻击的流量统计特征,并利用支持向量机设...

Behavior analysis and intrusion detection of illegal access to WLAN

A hacker wireless card named SIGLINK, which is able to reveal the Wired Equivalent Privacy (WEP) key on WLAN and access the Internet for free, had been widely used. For detection of the SIGLINK, the paper studied the four means of attack: interactive packet replay, ARP-request reinjection, chopchop, fragmentation. The work presented a principle analysis of them by reviewing the process behavior when the intrusion was implemented, and proposed a intrusion detection system (IDS) against it. The IDS selected 9 traffic statistical features to detect the attacks, and used Support Vector Machine (SVM) as the recognition algorithm. The experiment results show that the scheme makes a high detection rate. It is effective to alarm the attacks.