Method and system for locating a wireless access device in a wireless network
View Patent ↗A wireless access device in a wireless network, whether a known or unknown entity, can be located using a geolocation system according to the present invention. A signal strength is determined by a wireless intrusion detection system (WIDS) node in a wireless network for each wireless access device that it detects. Based on the signal strength, an approximate distance from the node is determined, which, in one embodiment corresponds to a radius of a circle around the node. To account for error, an approximation band of the circle is calculated that will allow a user to determine the approximate location of the device within the wireless network.
1. A computer-implemented method, the method comprising:
detecting a wireless access device using a plurality of nodes at known locations;
detecting, with a particular node of the plurality of nodes, a communications channel on which the wireless access device is operating by;
observing a plurality of communications channels; and
selecting the communications channel corresponding to a largest average received signal strength;
determining, with the particular node, a signal strength of the wireless access device with respect to the particular node;
determining, with the particular node, a distance to the wireless access device from the particular node based on the signal strength;
estimating an area using the distance, with the particular node, to determine possible locations of the wireless access device relative to the particular node; and
sending the area to a collector device for determination of a location of the wireless access device using information from at least two of the plurality of nodes.
2. The method of claim 1 , wherein detecting the communications channel further comprises detecting a 802.11 communications channel on which the wireless access device is operating among a plurality of 802.11 communications channels.
3. The method of claim 1 , wherein detecting the communications channel comprises:
observing a wireless network channel in a wireless network for a predetermined amount of time;
determining signal strengths of individual ones of a plurality of transmissions received on the wireless network channel;
calculating an average signal strength value per wireless network channel, corresponding to the wireless access device; and
detecting the communications channel in use by the wireless access device based on the average signal strength value.
4. The method of claim 1 , where the estimating further comprises estimating a band around the particular nodes, within which the wireless access device could be located, based on the distance from the particular nodes.
5. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations, the operations comprising:
detecting a wireless access device using a plurality of nodes at known locations;
determining a signal strength of the wireless access device with respect to individual ones of the plurality of nodes;
determining a distance to the wireless access device from the individual ones of the plurality of nodes based on the signal strength to determine possible locations of the wireless access device; and
estimating an area for the individual ones of the plurality of nodes corresponding to the possible locations of the wireless access device by detecting a band around the individual ones of the plurality of nodes within which the wireless access device could be located based on the determined distance from the individual ones of the plurality of nodes.
6. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations, the operations comprising:
detecting a wireless access device using a plurality of nodes at known locations;
detecting, with a particular node of the plurality of nodes, a communications channel on which the wireless access device is operating by:
observing a plurality of communications channels; and
selecting the communications channel corresponding to a largest average received signal strength;
determining, with the particular node, a signal strength of the wireless access device with respect to the particular node;
determining, with the particular node, a distance to the wireless access device from the particular node based on the signal strength;
estimating an area using the distance, with the particular node, to determine possible locations of the wireless access device relative to the particular node; and
sending the area to a collector device for determination of a location of the wireless access device using information from at least two of the plurality of nodes.
7. The non-transitory computer-readable medium of claim 6 , wherein detecting the communications channel further comprises detecting a 802.11 communications channel on which the wireless access device is operating among a plurality of 802.11 communications channels.
8. The non-transitory computer-readable medium of claim 6 , wherein detecting the communications channel comprises:
observing a wireless network channel in a wireless network for a predetermined amount of time;
determining received signal strengths of individual ones of a plurality of transmissions received on the wireless network channel;
calculating an average received signal strength value per wireless network channel corresponding to the wireless access device; and
detecting the communications channel in use by the wireless access device based on the average received signal strength value.
9. The non-transitory computer-readable medium of claim 6 , wherein the estimating the area further comprises estimating a band around the particular node within which the wireless access device could be located based on the distance from the particular node.
10. The non-transitory computer-readable medium of claim 6 , wherein the operations further comprise:
receiving information from the plurality of nodes corresponding to possible locations of the wireless access device relative to the plurality of nodes respectively; and
determining an actual location of the wireless access device based on one or more intersections between the areas.
11. The method of claim 1 , further comprising:
receiving information from the plurality of nodes including areas corresponding to possible locations of the wireless access device relative to the plurality of nodes respectively; and
determining an actual location of the wireless access device based on one or more intersections between the areas.
12. An apparatus comprising:
a collector device; and
a plurality of nodes at known locations in communication with the collector device;
wherein individual ones of the plurality of nodes are configured to, from a point of view of a particular node of the individual ones of the plurality of nodes:
detect an existence of a wireless access device;
detect a communications channel on which the wireless access device is operating by:
observing a plurality of communications channels; and
selecting the communications channel corresponding to a largest average received signal strength;
determine a signal strength of the wireless access device with respect to the particular node; and
determine a distance to the wireless access device from the particular node based on the signal strength, and
estimate an area using the distance corresponding to the possible locations of the wireless access device relative to the particular node; and
send the area to the collector device for determination of a location of the wireless access device using information from at least two of the individual ones of the plurality of nodes.
13. The apparatus of claim 12 , wherein the particular node configured to detect the communications channel comprises the particular node configured to detect a 802.11 communications channel on which the wireless access device is operating among a plurality of 802.11 communications channels.
14. The apparatus of claim 12 , wherein the particular node configured to detect the communications channel comprises the particular node configured to:
observe a wireless network channel in a wireless network for a predetermined amount of time;
determine received signal strengths of each of a plurality of transmissions received on the wireless network channel;
calculate an average received signal strength value per wireless network channel, corresponding to the wireless access device; and
detect the communications channel in use by the wireless access device based on the average received signal strength value.
15. The apparatus of claim 12 , wherein the particular node configured to estimate the area comprises the particular node configured to estimate a band around the particular node within which the wireless access device could be located based on the distance from the particular node.
16. The apparatus of claim 15 , wherein the particular node is further configured to detect the band based on a margin of error.
17. The non-transitory computer-readable medium of claim 5 , wherein the operations further comprise:
receiving information from the plurality of nodes including areas corresponding to possible locations of the wireless access device relative to the plurality of nodes respectively; and
determining an actual location of the wireless access device based on one or more intersections between the areas.
18. The apparatus of claim 12 wherein the collector device is configured to determine an actual location of the wireless access device based on one or more intersections between areas received from at least two of the plurality of nodes.
19. An apparatus comprising:
a collector device; and
a plurality of nodes at known locations in communication with the collector device;
wherein the plurality of nodes are configured to detect an existence of a wireless access device and determine a signal strength of the wireless access device with respect to individual ones of the plurality of nodes; and
wherein the collector device is configured to:
determine a distance to the wireless access device from individual ones of the plurality of nodes based on the signal strength to determine possible locations of the wireless access device, and
estimate an area for the individual ones of the plurality of nodes corresponding to the possible locations of the wireless access device by detecting a band around each of the plurality of nodes within which the wireless access device could be located based on the determined distance from each of the plurality of nodes.
20. The apparatus of claim 19 wherein the collector is further configured to determine an actual location of the wireless access device based on one or more intersections between the areas.