Apparatus and method for monitoring a wireless network
There is provided an apparatus and method to enable passive, real-time monitoring of an existing wireless network. It classifies and identifies threats and/or devices that are communicating using the infrastructure and data traffic patterns of the participating devices. The monitoring information is provided in a manner so as to provide appropriate insights for technical support and home users.
1. An apparatus for monitoring a wireless network, the apparatus including at least one memory and at least one hardware processor configured to:
receive, from at least one user device, data from the at least one user device;
extract, from the received data, information from a frame header, wherein the extracted information is at least one parameter selected from a group consisting of: source and destination addresses, frame type and sub-type, and SSIDs present;
prune, from the received data, unnecessary features, wherein pruning of unnecessary features aids in classification of the extracted information, the pruning being carried out using statistical analysis;
group, from the received data, basic features based on MAC addresses;
determine, from the received data, processed features based on block size;
carry out model training for predictive purposes, wherein the model training is carried out by taking two inputs: a set of signatures from the feature pruner and the set of MAC addresses to device types mapping from device annotator;
identify, from the received data, unusual data traffic patterns;
store frame information to enable mining of the information; and
present a visual representation of data traffic in the wireless network, wherein the visual representation is provided either for a pre-defined time window or for a real-time juncture.
2. The apparatus of claim 1 , wherein the data is receivable via multiple transmission protocols.
3. A data processor implemented method for monitoring a wireless network, the method comprising:
receiving, from at least one user device, data from the at least one user device;
extracting, from the received data, information from a frame header, wherein the extracted information is at least one parameter selected from a group consisting of: source and destination addresses, frame type and sub-type, and SSIDs present;
pruning, from the received data, unnecessary features, wherein pruning of unnecessary features aids in classification of the extracted information, the pruning being carried out using statistical analysis;
grouping, from the received data, basic features based on MAC addresses;
determining, from the received data, processed features based on block size;
carrying out model training for predictive purposes, wherein the model training is carried out by taking two inputs: a set of signatures from the feature pruner and the set of MAC addresses to device types mapping from device annotator;
identifying, from the received data, unusual data traffic patterns;
storing frame information to enable mining of the information; and
presenting a visual representation of data traffic in the wireless network, wherein the visual representation is provided either for a pre-defined time window or for a real-time juncture.
4. The method of claim 3 , wherein the data is receivable via multiple transmission protocols.