Detection of threats to networks, based on geographic location
A method for a wireless network. The network includes at least a server and a plurality of computer devices wirelessly connected to the server. At least one of the computer devices is under attack by an ‘attacker’ device. The method provides for detection and reporting of the attack as to the location of the attack. The method includes detecting an attack by one of the computer devices, using a zCore module and transmitting an ‘attack report’ to the server. The report includes at least the attack location. The method also includes notifying at least one of the plurality of computer devices and an external computer device that the network is compromised.
1. A method for detecting an attack in a wireless network comprising at least a server and a plurality of computer devices wirelessly connected to the server, the method comprising:
detecting, by a first computer device, an attack on the first computer device by an attacking entity via the wireless network;
determining a geographic location corresponding to the wireless network based on location information associated with the first computer device and one or more network characteristics of the wireless network;
associating the detected attack with the determined geographic location; and
transmitting the association between the detected attack and the determined geographic location to the server, the server configured to:
determine that the wireless network is compromised based on a threshold number of detected attacks detected by a plurality of computer devices including the first computer device, each of the threshold number of detected attacks being associated with locations within a geographical danger zone surrounding the determined geographic location;
prior to a second computer connecting to the wireless network, determine that the second computer device has physically entered the geographical danger zone after the detected attack, the second computer device not included in the plurality of computer devices; and
prior to the second computer connecting to the wireless network and in response to determining that the second computer device has entered the geographical danger zone, notify the second computer device that the wireless network is compromised.
2. The method of claim 1 , further comprising classifying the wireless network according to a category of the attack, wherein the server is further configured to notify the second computer device of the classification of the wireless network.
3. The method of claim 2 , wherein the wireless network is classified as a compromised network in response to a detection of a predefined threshold number of attacks via the wireless network.
4. The method of claim 1 , further comprising classifying the geographic location as dangerous in response to the determination that the threshold number of detected attacks are associated with locations within a threshold distance of the determined geographic location.
5. The method of claim 4 , further comprising identifying a geographic area corresponding to the geographic location by calculating a geo-spatial location corresponding to the first computer device.
6. The method of claim 1 , wherein the second computer device is configured to block access to the wireless network in response to receiving the notification from the server.
7. The method of claim 1 , wherein the transmitted association comprises one or more of: a time of the attack, an attack type, a MAC address of the attacking entity, a MAC address of the wireless network, a BSSID (Basic Service Set Identity), an SSID (Service Set Identifier), GPS (Global Positioning System) coordinates, and a geo IP location.
8. The method of claim 1 , wherein the server is a cloud server.
9. The method of claim 1 , wherein the first computer device comprises one of: a mobile device, a smart phone, a tablet computer, or a laptop computer.
10. The method of claim 1 , wherein the detected attack comprises one of: an MITM attack, ARP spoofing, DNS poisoning, Port scanning, and Malicious injection.
11. The method of claim 1 , wherein the second computer device is further configured to establish a secure connection to the server for analysis of threats or attacks taking place near the geographic location.
12. The method of claim 1 , wherein the one or more network characteristics include at least one selected from a group consisting of a media access control (MAC) address of the wireless network and a service set identifier of the wireless network.
13. A computer device for detecting an attack in a wireless network comprising at least a server connected and a plurality of computer devices wirelessly connected to the server, the computer device comprising:
a detection/prevention module configured to:
detect an attack on the computer device by an attacking entity via the wireless network;
determine a geographic location corresponding to the wireless network based on location information associated with the first computer device and one or more network characteristics of the wireless network; and
associate the detected attack with the determined geographic location; and
an output configured to transmit the association between the detected attack and the determined geographic location to the server, the server configured to:
determine that the wireless network is compromised based on a threshold number of detected attacks detected by a plurality of computer devices including the first computer device, each of the threshold number of detected attacks being associated with locations within a geographical danger zone surrounding the determined geographic location;
prior to a second computer connecting to the wireless network, determine that the second computer device has physically entered the geographical danger zone after the detected attack, the second computer device not included in the plurality of computer devices; and
prior to the second computer connecting to the wireless network and in response to determining that the second computer device has entered the geographical danger zone, notify the second computer device that the wireless network is compromised.
14. The computerized system of claim 13 , wherein the transmitted association comprises a canonic message.
15. The computerized system of claim 13 , wherein the output is further configured to notify an additional computer device located within a threshold distance of the computer device that the wireless network is compromised.
16. The computerized system of claim 13 , wherein the output is further configured to notify an additional computer device in response to the additional computer device moving from outside a threshold distance of the computer device to within the threshold distance of the computer device, the notification comprising a list of all nearby compromised networks.
17. The computerized system of claim 13 , wherein the server is further configured to provide a threat level map to the second computer device, the threat level map identifying a threat level for each of one or more geographic regions.
18. The computerized system of claim 17 , wherein the threat level map indicates a classification for each of the one or more geographic regions based on a number of threats detected in each geographic region.
19. The computerized system of claim 13 , wherein the geographic location corresponding to the wireless network is determined based on historical network parameters.
20. The computer device of claim 13 , wherein the one or more network characteristics include at least one selected from a group consisting of a media access control (MAC) address of the wireless network and a service set identifier of the wireless network.