Method for detecting rogue devices operating in wireless and wired computer network environments
View Patent ↗A management of wireless and wired computer network environments in which rogue and other devices that may affect the performance and/or security of the wireless computer network can be detected. Specifically, the present invention discloses a method and system of detecting all interfaces, Media Access Control (MAC) addresses and radio MAC addresses (BSSIDs) affiliated with a rogue device and compiling this information into a database. As a result, the present invention reduces the number of alerts that one rogue device can generate and increases the accuracy and speed of locating the rogue device within a network.
1. A computer implemented method, comprising:
receiving, at a computing device connected to a network, a wireless Media Access Control (MAC) address for a wireless device connected to the network, wherein the wireless MAC address for the wireless device corresponds to a manufacturer for the wireless device;
determining that the wireless device is a rogue wireless device, wherein determining includes comparing the wireless MAC address for the wireless device with a list of valid wireless MAC addresses used by authorized wireless devices connected to the network;
determining a list of wired MAC addresses used by devices connected to the network using wired connections;
determining that elements of the wireless MAC address for the rogue wireless device match elements of a wired MAC address, wherein determining includes comparing elements of the wireless MAC address for the rogue wireless device with elements of the wired MAC addresses on the list of wired MAC addresses;
determining that the rogue wireless device is connected to the network over a wired connection based on the match;
assigning a security risk score to the rogue wireless device, wherein assigning includes using the wireless MAC address corresponding to the manufacturer; and
displaying the security risk score.
2. The method of claim 1 , further comprising:
identifying a network address for a wired network connection of the rogue wireless device.
3. The method of claim 2 , further comprising:
probing the network address to identify an operating system for the rogue wireless device; and
updating the security score for the rogue wireless device based on the operating system.
4. The method of claim 3 , further comprising:
updating or creating a record associated with the rogue wireless device, wherein the record includes the wireless MAC address for the wireless device, the network address for the wired connection of the rogue wireless device, the operating system for the rogue wireless device, and the security score for the rogue wireless device.
5. The method of claim 1 , further comprising:
determining a location of the rogue wireless device, wherein determining the location of the rogue wireless device includes using a wireless triangulation method to locate the rogue wireless device; and
displaying the location of the rogue wireless device.
6. The method of claim 1 , wherein determining that the rogue wireless device is connected to the network over a wired connection includes matching a manufacturer for the wireless device with a manufacturer corresponding to one or more wired MAC addresses in the list.
7. The method of claim 1 , wherein determining the list includes reading bridge forwarding tables or address resolution protocol tables of one or more network devices connected to the network.
8. A system comprising:
one or more processors;
a non-transitory computer readable medium communicatively coupled to the one or more processors, the non-transitory computer readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
receiving a wireless Media Access Control (MAC) address for a wireless device connected to a network, wherein the wireless MAC address for the wireless device corresponds to a manufacturer for the wireless device;
determining that the wireless device is a rogue wireless device, wherein determining includes comparing the wireless MAC address for the wireless device with a list of valid wireless MAC addresses used by authorized wireless devices connected to the network;
determining a list of wired MAC addresses used by devices connected to the network using wired connections;
determining that elements of the wireless MAC address for the rogue wireless device match matches elements of a wired MAC address, wherein determining includes comparing elements of the wireless MAC address for the rogue wireless device with elements of the wired MAC addresses on the list of wired MAC addresses;
determining that the rogue wireless device is connected to the network over a wired connection based on the match;
assigning a security risk score to the rogue wireless device, wherein assigning includes using the wireless MAC address corresponding to the manufacturer; and
displaying the security risk score.
9. The system of claim 8 , wherein the operations further include:
identifying a network address for a wired network connection of the rogue wireless device.
10. The system of claim 9 , wherein the operations further include:
probing the network address to identify an operating system for the rogue wireless device; and
updating the security score for the rogue wireless device based on the operating system.
11. The system of claim 10 , wherein the operations further include:
updating or creating a record associated with the rogue wireless device, wherein the record includes the wireless MAC address for the wireless device, the network address for the wired connection of the rogue wireless device, the operating system for the rogue wireless device, and the security score for the rogue wireless device.
12. The system of claim 8 , wherein determining that the rogue wireless device is connected to the network over a wired connection includes matching the manufacturer for the wireless device with a manufacturer corresponding to one or more wired MAC addresses in the list.
13. The system of claim 8 , wherein determining the list includes reading bridge forwarding tables or address resolution protocol tables of one or more network devices connected to the network.
14. The system of claim 8 , wherein the operations further include:
determining a location of the rogue wireless device, wherein determining the location of the rogue wireless device includes using a wireless triangulation method to locate the rogue wireless device; and
displaying the location of the rogue wireless device.
15. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
receiving a wireless Media Access Control (MAC) address for a wireless device connected to a network, wherein the wireless MAC address for the wireless device corresponds to a manufacturer for the wireless device;
determining that the wireless device is a rogue wireless device, wherein determining includes comparing the wireless MAC address for the wireless device with a list of valid wireless MAC addresses used by authorized wireless devices connected to the network;
determining a list of wired MAC addresses used by devices connected to the network using wired connections;
determining that elements of the wireless MAC address for the rogue wireless device match elements of a wired MAC address, wherein determining includes comparing elements of the wireless MAC address for the rogue wireless device with elements of the wired MAC addresses on the list of wired MAC addresses;
determining that the rogue wireless device is connected to the network over a wired connection based on the match;
assigning a security risk score to the rogue wireless device, wherein assigning includes using the wireless MAC address corresponding to the manufacturer; and
displaying the security risk score.
16. The non-transitory computer readable medium of claim 15 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
identifying a network address for a wired network connection of the rogue wireless device.
17. The non-transitory computer readable medium of claim 15 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
probing the network address to identify an operating system for the rogue wireless device; and
updating the security score for the rogue wireless device based on the operating system.
18. The non-transitory computer readable medium of claim 17 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
updating or creating a record associated with the rogue wireless device, wherein the record includes the wireless MAC address for the wireless device, the network address for the wired connection of the rogue wireless device, the operating system for the rogue wireless device, and the security score for the rogue wireless device.
19. The non-transitory computer readable medium of claim 15 , wherein determining that the rogue wireless device is connected to the network over a wired connection includes matching the manufacturer for the wireless device with a manufacturer corresponding to one or more wired MAC addresses in the list.
20. The non-transitory computer readable medium of claim 15 , wherein determining the list includes reading bridge forwarding tables or address resolution protocol tables of one or more network devices connected to the network.
21. The non-transitory computer readable medium of claim 15 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
determining a location of the rogue wireless device, wherein determining the location of the rogue wireless device includes using a wireless triangulation method to locate the rogue wireless device; and
displaying the location of the rogue wireless device.