Experimentation in intrusion and detection on wireless local area networks.

摘要

IEEE 802.11 is the U.S. standard protocol for wireless local area networks. Since the WEP encryption that had been used for security to IEEE 802.11 was broken, the WPA encryption was considered to be the secure alternative that could still run on hardware developed for the WEP encryption. However, in 2009 Beck and Tews developed an attack that took advantage of WPA with TKIP, allowing packets to be forged and sent on the network. Furthermore, Halverson and Haugen extended these attacks by decrypting larger DHCP packets. This thesis focuses on the detection and prevention of current attacks on 802.11i WPA. Open source systems and methods will be used to secure networks against these types of attacks. The methodology used recreates current attacks in a laboratory setting, recording traffic from the air, as well as from the wire. The attack is analyzed, and then methods of intrusion detection and prevention are discussed. The work of this thesis is to analyze current attacks and develop signatures and other methods that identify these attacks. These signatures are then integrated into a system that allows detection and prevention of these attacks.