Spoofing detection
A method for detecting spoofing by wireless access devices. In some embodiments, spoofing can be detected based on locations for a wireless access device having an identifier at first and second times. The locations are compared to determine whether the wireless access device could access the particular network at the locations in the time period between the first and second times. In several embodiments, spoofing can be detected by tracking the activity of wireless access devices and identifying events that that are prohibited by one or more policy elements of the particular network.
1. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations, the operations comprising:
receiving a first state of a wireless access device and a first communication device to which the wireless access device is communicating over a particular network at a first time at a particular node of a plurality of nodes;
receiving or generating a first event for the wireless access device identifying the first state and the first communication device;
receiving a second state of the wireless access device and a second communication device to which the wireless access device is communicating over the particular network at a second time at the particular node of the plurality of nodes;
receiving or generating a second event for the wireless access device identifying the second state and the second communication device in response to determining that at least one of:
the first state and the second state are different, and
the first communication device and the second communication device are different; and
checking the first and second events with a collector device for activities prohibited by one or more policy elements of the particular network, wherein the collector device is configured with the one or more policy elements.
2. The non-transitory computer-readable medium of claim 1 , the operations further comprising sending an alert signal in response to determining that the first and second events identify an activity that is prohibited by the one or more policy elements.
3. The non-transitory computer of claim 1 , the operations further comprising updating a state table that tracks current activity of a plurality of wireless access devices, the state table configured to identify changes in state of each of the plurality of wireless access devices.
4. The non-transitory computer-readable medium of claim 1 , the operations further comprising identifying indicators that the wireless access device is a fixed wireless access device, a movable wireless access device, a moving wireless access device, an unknown wireless access device, or a spoofed wireless access device via the one or more policy elements.
5. The non-transitory computer of claim 1 , the operations further comprising receiving an indication of at least one of: a disconnected state, an authenticating state, an associating state, a reassociating state, a transmitting data state, a disassociating state, or a deauthenticating state.
6. The non-transitory computer of claim 1 , the operations further comprising identifying at least one of a MAC address, a channel number used, a received signal strength, or an access point name of the wireless access.
7. An apparatus comprising:
a collector device;
a plurality of nodes in communication with the collector device; and
wherein the plurality of nodes in communication with the collector device are configured to:
receive a first state of a wireless access device and a first communication device to which the wireless access device is communicating over a particular network at a first time at a particular node of the plurality of nodes;
receive or generate a first event for the wireless access device identifying the first state and the first communication device;
receive a second state of the wireless access device and a second communication device to which the wireless access device is communicating over the particular network at a second time at the particular node of the plurality of nodes;
receive or generate a second event for the wireless access device identifying the second state and the second communication device in response to determining that at least one of:
the first state and the second state are different, and
the first communication device and the second communication device are different; and
check the first and second events with a collector device for activities prohibited by one or more policy elements of the particular network, wherein the collector device is configured with the one or more policy elements.
8. The apparatus of claim 7 wherein at least one of the plurality of nodes in combination with the collector device are further configured to: send an alert signal in response to determining that the first and second events identify an activity that is prohibited by the one or more policy elements.
9. The apparatus of claim 7 wherein at least one of the plurality of nodes in communication with the collector device are further configured to identify indicators that the wireless access device is a fixed wireless access device, a movable wireless access device, a moving wireless access device, an unknown wireless access device, or a spoofed wireless access device via the one or more policy elements.
10. The apparatus of claim 7 , wherein the collector device is further configured to receive an indication of at least one of: a disconnected state, an authenticating state, an associating state, a reassociating state, a transmitting data state, a disassociating state, or a deauthenticating state.
11. The apparatus of claim 7 , wherein the collector device updates a state table that tracks current activity of a plurality of wireless access devices, the state table configured to identify changes in state of each of the plurality of wireless access devices.