Intrusion Detection Method of Wireless Local Area Network MAC Layer Based on Hidden Markov Model

您当前的位置：

首页 >

文章列表页 >

Intrusion Detection Method of Wireless Local Area Network MAC Layer Based on Hidden Markov Model

更新时间：2025-07-09

- Intrusion Detection Method of Wireless Local Area Network MAC Layer Based on Hidden Markov Model
- Vol. 43, Issue 12, Pages: 26-30(2009)
- 作者机构：
  
  1. 中国科学技术大学计算机科学与技术系,合肥,230027
  2. 网络与交换技术国家重点实验室,北京,100876
  3. 安徽省计算与通讯软件重点实验室,合肥,230027
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393
- Online First：10 December 2009，
  
  Published：2009
- 稿件说明：
移动端阅览
Intrusion Detection Method of Wireless Local Area Network MAC Layer Based on Hidden Markov Model[J]. 2009, 43(12): 26-30.
DOI：

Intrusion Detection Method of Wireless Local Area Network MAC Layer Based on Hidden Markov Model[J]. 2009, 43(12): 26-30. DOI：

摘要

将无线局域网媒体接入控制(MAC)层字段作为检测入侵的分析对象

提出了基于隐马尔可夫模型(HMM)的无线局域网MAC层入侵检测方法.采用了基于控制台、服务器、代理的3层分布式无线局域网入侵检测框架; 基于HMM模型对无线局域网的MAC帧头部进行建模; 利用正常的无线局域网络数据对HMM进行训练

并记忆正常系统下的数据包行为.由此

检测发现了出现概率小的数据包或数据包序列

并制定了入侵检测阈值.试验结果表明

所提方法对已有的无线局域网MAC层攻击的误报率和漏报率比较低

并能检测未知攻击.

Abstract

The packet field of wireless local area network(WLAN)medium access control(MAC)layer is taken for the analytical object of detecting intrusion. An intrusion detection method of WLAN MAC layer is proposed based on the hidden Markov model(HMM). A three layers frame including console

server and agents is given; the data of WLAN MAC layer is used to model the HMM; then the normal data of WLAN is used to train the HMM and to memorialize the normal action of WLAN. An intrusion will be detected when the occuring probability of a packet data or a sequence of packet data is smaller than a given threshold. Experimental results show that the proposed method has low false positive rate and missing report rate when detecting the known attacks on WLAN MAC layers

and also detects unknown attacks.

关键词

Keywords

references

Andrew Lockhart. Snort-wireless [EB/OL]. [2009-01-15]. http:∥www. snort-wireless. org/.

Fatblock Working Group.WIDZ [EB/OL]. [2009-01-15].http:∥www.loud-fat-bloke. co.uk/w80211.html.

RABINER L R, JUANG B H. An introduction to hidden Markov models [J]. ASSP Magazine, 1986,3(1):4-16.

RABINER L R.A tutorial on hidden Markov models and selected applications in speech recognition[J]. Proceedings of the IEEE, 1989, 77(2):257-286.

WARRENDER C, FORREST S, PEARLMUTTER B. Detecting intrusions using system calls: alternative data models [C]∥Proceedings of the 1999 IEEE Symposium on Security and Privacy. Los Alamitos, CA, USA: IEEE Computer Society,1999:133-145.

IEEE. Telecommunications and information exchange between systems: local and metropolitan area networks-specific requirements part 11( wireless LAN medium access control(MAC)and physical layer(PHY)specifications 2007)[EB/OL]. [2009-01-02].http:∥standards.ieee.org/getieee802/download/802.11-2007.pdf.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

The Security Analysis and Detection of 802.1X Wireless Local Area Network

An Adaptive Security Management Framework for Wireless Local Area Network and Its Application

A Fast Pattern Matching Algorithm in Intrusion Detection System

Review of the Application of EBSILON Software in Combined Heat and Power System Optimization

Influence of Structural Parameters on the Summer Operational Characteristics of a Three-Tower-in-One Indirect Air-Cooling System

Related Author

薛雨杨 1

刘振华 1

姜庆民

吴宁

刘伟华

Related Institution

Province Key Laboratory of Software in Computing

The School of Electronics and Information Engineering, Xi'an Jiaotong University

⁰