Granted Patent B1

US 9,781,604 · App. 14/616,761 · Granted Oct 3, 2017

Abstract

Claims (71)

1. A computer-implemented method for detecting illegitimate devices on wireless networks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

Identifying, at the computing device, a baseline signal strength for a wireless network;

detecting, at the computing device, that the computing device has moved;

identifying, at the computing device, a new baseline signal strength for the wireless network in response to detecting that the computing device has moved;

monitoring, at the computing device, a signal strength of the wireless network to obtain at least one additional signal strength measurement;

determining, at the computing device, that the additional signal strength measurement varies from the new baseline signal strength beyond a threshold;

determining, at the computing device, in response to determining that the additional signal strength measurement varies from the new baseline signal strength, that an illegitimate device is present on the wireless network;

in response to determining that the illegitimate device is present on the wireless network, initiating, at the computing device, a security action.

2. The computer-implemented method of claim 1 , wherein identifying the baseline signal strength comprises:

identifying a set of signal strength measurements for the wireless network;

calculating a central tendency for the set of signal strength measurements.

3. The computer-implemented method of claim 2 , wherein the central tendency comprises at least one of:

a mean value;

a median value;

a mode value.

4. The computer-implemented method of claim 1 , wherein the threshold comprises a percentage of the baseline signal strength.

5. The computer-implemented method of claim 1 , wherein the signal strength comprises a Received Signal Strength Indication.

6. The computer-implemented method of claim 1 , wherein monitoring the signal strength comprises obtaining the additional signal strength measurement periodically at a predetermined interval.

7. The computer-implemented method of claim 1 , wherein:

the wireless network comprises a public wireless network to which the computing device is connected;

the illegitimate device comprises a malicious device that represents itself as a wireless access point and intercepts network traffic intended for a legitimate wireless access point.

8. The computer-implemented method of claim 1 , wherein the security action comprises at least one of:

alerting a user of the computing device that the illegitimate device is present on the wireless network;

disconnecting the computing device from the wireless network;

preventing the computing device from connecting to the wireless network;

disabling wireless networking on the computing device.

9. A system for detecting illegitimate devices on wireless networks, the system comprising:

a baseline module, stored in memory, that:

identifies, at a computing device, a baseline signal strength for a wireless network;

detects, at the computing device, that the computing device has moved;

identifies, at the computing device, a new baseline signal strength for the wireless network in response to detecting that the computing device has moved;

a monitoring module, stored in memory, that monitors, at the computing device, a signal strength of the wireless network to obtain at least one additional signal strength measurement;

an analysis module, stored in memory, that:

determines, at the computing device, that the additional signal strength measurement varies from the new baseline signal strength beyond a threshold;

determines, at the computing device, in response to determining that the additional signal strength measurement varies from the new baseline signal strength, that an illegitimate device is present on the wireless network;

a security module, stored in memory, that, in response to determining that the illegitimate device is present on the wireless network, initiates, at the computing device, a security action;

at least one physical processor configured to execute the baseline module, the monitoring module, the analysis module, and the security module.

10. The system of claim 9 , wherein the baseline module identifies the baseline signal strength by:

identifying a set of signal strength measurements for the wireless network;

calculating a central tendency for the set of signal strength measurements.

11. The system of claim 10 , wherein the central tendency comprises at least one of:

a mean value;

a median value;

a mode value.

12. The system of claim 9 , wherein the threshold comprises a percentage of the baseline signal strength.

13. The system of claim 9 , wherein the signal strength comprises a Received Signal Strength Indication.

14. The system of claim 9 , wherein the monitoring module monitors the signal strength by obtaining the additional signal strength measurement periodically at a predetermined interval.

15. The system of claim 9 , wherein:

the wireless network comprises a public wireless network to which the computing device is connected;

the illegitimate device comprises a malicious device that represents itself as a wireless access point and intercepts network traffic intended for a legitimate wireless access point.

16. The system of claim 9 , wherein the security action comprises at least one of:

alerting a user of the computing device that the illegitimate device is present on the wireless network;

disconnecting the computing device from the wireless network;

preventing the computing device from connecting to the wireless network;

disabling wireless networking on the computing device.

17. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, at the computing device, a baseline signal strength for a wireless network;

detect, at the computing device, that the computing device has moved;

identify, at the computing device, a new baseline signal strength for the wireless network in response to detecting that the computing device has moved;

monitor, at the computing device, a signal strength of the wireless network to obtain at least one additional signal strength measurement;

determine, at the computing device, that the additional signal strength measurement varies from the baseline signal strength beyond a threshold;

determine, at the computing device, in response to determining that the additional signal strength measurement varies from the baseline signal strength, that an illegitimate device is present on the wireless network;

in response to determining that the illegitimate device is present on the wireless network, initiate, at the computing device, a security action.

18. The non-transitory computer-readable medium of claim 17 , wherein the one or more computer-readable instructions cause the computing device to identify the baseline signal strength by:

identifying a set of signal strength measurements for the wireless network;

calculating a central tendency for the set of signal strength measurements.

19. The non-transitory computer-readable medium of claim 18 , wherein the central tendency comprises at least one of:

a mean value;

a median value;

a mode value.

20. The non-transitory computer-readable medium of claim 17 , wherein the threshold comprises a percentage of the baseline signal strength.

Assignments (6)