• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.87-95
• /
• 2014

Under only authorized AP is allowable environment, rogue AP which is generated by a smartphone tethering can be a serious security breach. To solve rogue AP problem, this paper proposes classifying algorithm of Kernel Support Vector Machine using features of RTT data. Through our experiment, we can detect rogue AP from LTE mobile network.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.3
• /
• pp.431-444
• /
• 2013

Widespread use of smartphones and wireless LAN accompany a threat called rogue AP. When a user connects to a rogue AP, the rogue AP can mount the man-in-the-middle attack against the user, so it can easily acquire user's private information. Many researches have been conducted on how to detect a various kinds of rogue APs, and in this paper, we are going to propose an algorithm to identify and detect a rogue AP that impersonates a regular AP by showing a regular AP's SSID and connecting to a regular AP. User is deceived easily because the rogue AP's SSID looks the same as that of a regular AP. To detect this type of rogue APs, we use a machine learning algorithm called SVM(Support Vector Machine). Our algorithm detects rogue APs with more than 90% accuracy, and also adjusts automatically detection criteria. We show the performance of our algorithm by experiments.

• Journal of Internet Computing and Services
• /
• v.17 no.3
• /
• pp.11-18
• /
• 2016

Accessing unauthorized rogue APs in WiFi environments is a very dangerous behavior which may lead WiFi users to be exposed to the various cyber attacks such as sniffing, phishing, and pharming attacks. Therefore, prompt and precise detection of rogue APs and properly alarming to the corresponding users has become one of most essential requirements for the WiFi security. This paper proposes a new rogue AP detection method which is mainly using the installation information of authorized APs and the DHCP snooping information of the corresponding switches. The proposed method detects rogue APs promptly and precisely, and notify in realtime to the corresponding users. Since the proposed method is simple and does not require any special devices, it is very cost-effective comparing to the wireless intrusion prevention systems which are normally based on a number of detection sensors and servers. And it is highly precise and prompt in rogue AP detection and flexible in deployment comparing to the existing rogue AP detection methods based on the timing information, location information, and white list information.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.733-734
• /
• 2011

지난 몇 년 동안 무선랜(Wireless LAN)은 다양한 영역에서 가장 널리 사용 되었으며, 가장 크게 발전을 하였다. 그러나 무선랜의 특성상 해킹과 침투에 취약한 약점을 안고 있다. 아직도 많은 보안적 취약점을 가지고 있으며, 특히 그 중에서도 Rogue AP(Access Point)는 가장 심각한 보안 취약점으로 대두되고 있다. 현재 Rogue AP 탐지를 위하여 넷스텀블러와 같은 스니핑 소프트웨어를 설치하여 주변 지역을 돌아다니는 워드라이빙 형태의 탐지방법은 아직도 사용되고 있다. 그러나, 이러한 방법은 대규모로 확장되어 가는 무선랜 환경에 적합하지 않다. 본 논문은 무선랜 환경에서 Rogue AP 탐지 문제의 해결책을 제시한다. AP의 전파 영역을 이용하는 방식으로, AP가 신호를 받을 수 있도록 수정하여, 주변에 새로운 AP가 탐지될 경우, AP가 서버와 새롭게 발견된 AP에 신호를 보내고, 이를 바탕으로 서버는 WhiteList를 통해서 Rogue AP 여부를 결정한다. 따라서 본 논문의 제안 방식은 기존의 탐지 방식에 비해 Rogue AP의 효과적 탐지가 가능하다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.2
• /
• pp.334-348
• /
• 2015

Widespread use of smart devices accompanies increase of use of access point (AP), which enables the connection to the wireless network. If the appropriate security is not served when a user tries to connect the wireless network through an AP, various security problems can arise due to the rogue APs. In this paper, we are going to examine the threat by evil-twin, which is a kind of rogue APs. Most of recent researches for detecting rogue APs utilize the measured time difference, such as round trip time (RTT), between the evil-twin and authorized APs. These methods, however, suffer from the low detection rate in the network congestion. Due to these reasons, in this paper, we suggest a new factor, packet inter-arrival time (PIAT), in order to detect evil-twins. By using both RTT and PIAT as the learning factors for the support vector machine (SVM), we determine the non-linear metric to classify evil-twins and authorized APs. As a result, we can detect evil-twins with the probability of up to 96.5% and at least 89.75% even when the network is congested.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.316-318
• /
• 2004

최근 무선 네트워크 장비의 가격이 하락함에 따라 낮은 전송 속도를 가지는 이동 통신 시스템의 대안으로 무선랜 시스템의 수요가 증가하고 있다. 그러나 무선랜은 특성상 해킹와 침투에 취약한 약점을 안고 있다. 무선랜 환경에서 유선 네트워크와 무선 네트워크를 매개해주는 액세스 포인트는 내부 네트워크안에서만 접속이 이루어진다. 이러한 취약점을 이용하여 공격자는 위장 액세스 포인트를 설치하여 내부 망으로 침투할 수 있게 된다. 본 논문에서는 무선 구간 모니터링을 하여 위장 액세스 포인트를 탐지하고 AAA서버인 라디우스 인증 서버를 사용하여 위장 액세스 포인트를 차단하는 시스템을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.2
• /
• pp.259-266
• /
• 2012

Malicious rogue AP has been used for variety attacks such as packet sniffing and Man-In-The-Middle Attack. It is used for the purpose of data leakage via 3G network within companies, and the unauthorized AP could be a reason of security incidents even though it is not intended. In this paper, we propose the method for detecting unauthorized access point over 3G networks throughout the RTT (Round Trip Time) value for classification. Through the experiments, we show that the method can classify the AP which is installed by normal way and the AP over 3G networks successfully.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.10a
• /
• pp.821-823
• /
• 2015

우리나라에서 어딜 가든 WI-FI를 이용해 네트워크에 접속할 수 있는 환경이 되었다. 하지만 rogue AP로 인한 모바일 기기들의 좀비화, 개인정보 유출, BYOD환경으로 인한 회사의 자료유출까지 다양한 정보들을 보호하고 모바일 기기의 해킹가능성을 줄여야 한다. 본 논문에서는 접속 AP정보와 GPS기반 위치정보를 신뢰 테이블에 등록해 이동 중에는 신뢰테이블 외 신호는 사용자의 확인을 거쳐 rogue AP에 자동접속 되어 기기가 감염되거나, 개인정보가 유출되는 일을 방지하기 위한 방법을 제안한다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.13 no.4
• /
• pp.1839-1848
• /
• 2012

Recently, smartphone communications using Wi-Fi channel are increasing rapidly to provide diverse internet services. The WPA security protocol was used for data protection between user and wireless AP. However, WPA-PSK protocol was known to be weak to the dictionary attack. In this paper, we proposed a secure WPA-PSK protocol to resist the dictionary attack. Since the proposed method was designed to generate a strong encryption key which is combined the Diffie-Hellman key agreement scheme with secrecy property of PSK(Pre-Shared Key), we can protect the Wi-Fi channel from Man-In-The-Middle attack and Rogue AP impersonation attack.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.35-42
• /
• 2004

Ubiquitous Computing is gradually accepting in our real society. Already some Advanced State has studying of Ubiquitous for more convenience Ubiquitous environment. Anywhere, Anytime user can be provided information and service that he want, but it has some problem such as Rogue AP, IP spoofing, DoS attack, Warm which can causing social confusion in Ubiquitous society. In this situation we must analytics that security requirement in the Ubiquitous network environment and investigate 'Ad hoc' and RFID which is main technique for network infra construction.struction.