- 學位論文
針對無線網路接取點之邪惡雙胞胎攻擊偵測系統設計與實現
Design and Implementation of a Rogue Access Point Detection System against Evil-Twin Attack
摘要
隨著室內環境需要穩定的高速傳輸網絡急劇發展，Wi-Fi在我們生活中的作用越來越重要。進而無線存取點的部署增加，未經授權的存取點成為重要的資訊安全威脅。然而，近期的檢測方法都集中在客戶端，並且只使用單點測量，這些方法的檢測準確度取決於測量點和邪惡雙胞胎無線存取點的相對位置，如果與待測物距離太遠，則整體準確度會下降。為了解決這個問題，我們提出了一種邪惡雙胞胎無線存取點攻擊 (ETA) 檢測方法，改善以前方法的不足。首先，我們執行一系列數據預處理方法來處理缺失和更新異常數據。然後，我們提出了一種新的基於序列的數據分割方法，可以計算週期性時間序列數據的差異。這種檢測方式比較全面，不會受到單一數據的影響。之後，我們使用自動編碼器 (AutoEncoder)模型來檢測環境中是否有邪惡雙胞胎無線存取點攻擊。該模型根據時間序列接收信號強度 (RSS) 訊號分佈的特徵變化來識別異常。最後，我們提出了一種新穎的投票機制透過多個探測器共同預測最終結果；與以往文獻不同的是，我們使用多個探測器代替單點監測大面積區域，以補償單點檢測的誤報率，使系統更加實用。為了驗證系統的穩健性，我們構建了三種實際攻擊場景，包括視距 (LOS)、非視距 (NLOS) 和邪惡雙胞胎無線存取點出現在不同位置三個場景。在實驗結果，我們的新系統可以將準確率提高20%以上至接近96%的準確率，此外，與單個探測器相比，投票機制後的性能可以將整體系統的準確率再提高6%。
並列摘要
Along with the rapid development of indoor environments requiring stable high-speed transmission networks, the role of Wi-Fi in our lives is becoming more and more important. With the increase in access point deployments, the unauthorized access point is an important information security threat. However, most recent detection methods focus on the client-side and only use single-point measurements. The detection accuracy of these methods depends on the relative position of the measurement point and the evil twin; if the distance is too far, the overall accuracy drops drastically. To solve this problem, we propose an evil twin attack (ETA) detection approach to improve the lack of previous methods. First, we perform a series of data preprocessing methods to handle missing and update outlier data. Then, we propose a new sequence-based data segmentation method that can calculate the difference of periodic time series data. This detection method is more comprehensive and will not be affected by a single data. After that, we use AutoEncoder to detect evil twin attacks. The model identifies anomalies based on characteristic changes in the time-series Received Signal Strength (RSS) information distribution. Finally, we propose a novel voting mechanism to predict the final prediction. The difference from previous literature is that we use multiple sniffers instead of a single point to monitor large areas to compensate for the false alarm rate of single-point detection and make the system more practical. To verify the system's robustness, we build three actual attack scenarios, including line-of-sight (LOS), non-line-of-sight (NLOS), and a scenario where the evil twin appears in different locations. In terms of experimental results, our novel model can improve the accuracy by more than 20% to close to 96% accuracy. Furthermore, the performance of the voting mechanism can be improved by 6% compared to a single sniffer.