WIDS: Wireless Intrusion Detection System for 802.11 Networks

"The combination of inherent insecurity of wireless networks (signals radiating further than the intended coverage area) and weaknesses in the current security mechanisms are weighing heavily against this highly valuable network technology. Thus, wirelessnetworks on military bases and on board Navy ships at dock will be open targets for attack; this useful technology will not be fielded until the security vulnerabilities are addressed and mitigated. Architecture Technology Corporation (ATC) proposes tocreate Wireless Intrusion Detection System (WIDS), an intelligent access point integrating intrusion detection, firewalling, and packet filtering, and capable of using moveable, directional antennae to provide a bearing on the locations of intruders. WIDSimproves upon the state-of-the-art by providing much earlier detection capabilities than is currently available. Users of WIDS will be able to detect network intruders as they connect or attempt to connect to the WIDS access point, before they connectto the omni-directional access points for their real network. In some cases, intruders can be detected when they are attempting to scan for networks (e.g., by using netstumbler), long before they associate with the access point. By using a combination ofsignature and behavior based techniques, WIDS can detect "spoofed" MAC addresses (i.e., an intruder masquerading as a legitimate user). WIDS uses directional antennae so that intru