WIRELESS SELF-PROTECTIO SYSTEM by Samer Fayssal
Total Page：16
File Type：pdf, Size：1020Kb
Wireless Self-Protection System Item Type text; Electronic Dissertation Authors Fayssal, Samer Nabih Publisher The University of Arizona. Rights Copyright © is held by the author. Digital access to this material is made possible by the University Libraries, University of Arizona. Further transmission, reproduction or presentation (such as public display or performance) of protected items is prohibited except with permission of the author. Download date 03/10/2021 00:51:21 Link to Item http://hdl.handle.net/10150/195773 WIRELESS SELF-PROTECTIO SYSTEM By Samer Fayssal ____________________ Copyright © 2008 Samer Fayssal A Dissertation Submitted to the Faculty of the DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING In Partial Fulfillment of the Requirements For the Degree of DOCTOR OF PHILOSOPHY In the Graduate College THE UNIVERSITY OF ARIOZNA 2008 2 THE UNIVERSITY OF ARIZONA GRADUATE COLLEGE As members of the Dissertation Committee, we certify that we have read the dissertation prepared by Samer Fayssal entitled “ Wireless Self-Protection System ” and recommend that it be accepted as fulfilling the dissertation requirement for the Degree of Doctor of Philosophy __________________________________________________Date: August 22, 2008 Salim Hariri, Ph.D. __________________________________________________ Date: August 22, 2008 Jerzy W. Rozenblit, Ph.D. __________________________________________________ Date: August 22, 2008 Ali Akoglu, Ph.D. Final approval and acceptance of this dissertation is contingent upon the candidate’s submission of the final copies of the dissertation to the Graduate College. I hereby certify that I have read this dissertation prepared under my direction and recommend that it be accepted as fulfilling the dissertation requirement. ________________________________________________ Date: August 22, 2008 Dissertation Director: Salim Hariri, Ph.D. 3 STATEMENT BY AUTHOR This dissertation has been submitted in partial fulfillment of requirements for an advanced degree at the University of Arizona and is deposited in the University Library to be made available to borrowers under rules of the Library. Brief quotations from this dissertation are allowable without special permission, provided that accurate acknowledgment of source is made. Requests for permission for extended quotation from or reproduction of this manuscript in whole or in part may be granted by the head of the major department or the Dean of the Graduate College when in his or her judgment the proposed use of the material is in the interests of scholarship. In all other instances, however, permission must be obtained from the copyright holder. SIGNED: Samer Fayssal 4 ACKOWLEDGEMETS Special thanks to professor Salim Hariri, my advisor and mentor. Professor Hariri taught me that in order of becoming a better learner, I should be humble and open minded. He taught me to be patient, tolerant, and hard working person. I would like to thank my committee members Professor Jerzy Rozenblit, Professor Bernard Zeigler, and Dr. Ali Akuglo for serving in my comprehensive exam and defense committees. I would like to thank my laboratory mates, especially Yousif AlNashif. I would like to thank my parents, my brother and sister for all their support, without them I could never made it that far in my educational journey. 5 TABLE OF COTETS LIST OF FIGURES.......................................................................................................... 10 LIST OF TABLES …........................................................................................................12 ABSTRACT .…………………………………………………………………………… 13 Chapter 1. INTRODUCTION ......................…………………………………………… 15 1.1 Motivation ….……………...…………………………………………………. 15 1.2 Contribution ………………………………………………………………...... 17 1.3 Organization ………………………………………………………………….. 19 Chapter 2 . WIRELESS NETWORK OVERVIEW…………...……………………….. 20 2.1 Wireless protocols ….…………………………………………………........ 20 2.1.1 IEEE 802.11 WLAN Overview ………………………………………... 21 2.1.2 IEEE 802.15 WPAN Overview………………………………………… 22 2.1.3 IEEE 802.16 WMAN Overview ……………………………………….. 25 2.1.4 IEEE 802.20 WWAN Overview ……………………………………….. 27 2.1.5 IEEE 802.22 WRAN Overview ………………………………………... 28 2.1.6 Future Networks ………………………………………………………... 28 2.2 IEEE 802.11 Wireless Local Area Networks Review ……………………….. 29 2.2.1 History and Characteristics …………………………………………….. 29 2.2.2 IEEE 802.11 PHY and MAC layers Overview …………………….. 32 2.2.2.1 MAC characteristics and security analysis …………………….. 32 6 TABLE OF COTETS – COTIUED 2.2.2.2 802.11 Physical Layer ……………………………………………….. 41 2.3 Cryptographic Methods for wireless networks ………………………………. 44 2.3.1 Introduction to Cryptography and Cryptanalysis ……...……………... 45 2.3.2 History and Classification of Cryptography Ciphers ………………… 46 2.3.2.1 Symmetric Ciphers ……………………………………….. 46 2.3.2.2 Asymmetric Ciphers ……………………………………... 49 2.3.3 Cryptographic Methods used in IEEE 802.11 ………...……………... 49 2.4 Conclusion of Chapter 2 …………………………………………………… 52 Chapter 3. REVIEW OF WIRELESS ATTACKS AND SECURITY METHODS….... 53 3.1 Review of Wireless Network Attacks ……………………………………... 53 3.1.1 Attacks on wireless Personal Area Networks ………..………… 53 3.1.2 Attacks on wireless Local Area Networks …………….……….. 55 3.1.3 Attacks on wireless Metropolitan Area Networks ……………... 60 3.2 Existing Wireless Security Techniques …………………………………… 60 3.3 Conclusion of Chapter 3 …………………………………………………... 63 Chapter 4. TAXONOMY OF WLAN ATTACKS ………...…………………………... 64 4.1 Complexity ………………………………………………………………... 65 4.2 Source Validity …………………………………………………………… 66 4.3 Activity …………………………………………………………………… 67 4.4 Purpose ……………………………………………………………………. 68 7 TABLE OF COTETS – COTIUED 4.5 Vulnerability ……………………………………………………………… 70 4.6 Medium …………………………………………………………………… 72 4.7 Characterization …………………………………………………………... 72 4.8 Victim …………………………………………………………………….. 73 4.9 Analysis of Attack behaviors …………………………………………….. 74 4.10 Conclusion of Chapter 4 ………………………………………………….. 75 Chapter 5. WIRELESS SELF-PROTECTION SYSTEM METHODOLOGY…...……. 76 5.1 Flow Monitoring ………………………………………………………….. 77 5.1.1 Cisco NetFlow ………………………………………………… 77 5.1.2 Sflow …………….……………………………………………... 78 5.2 Wireless Network Flow …...……………………………………………… 78 5.2.1 Measurement Attributes ………………………………….…….. 79 5.2.1.1 Signal Information Measurement Attributes ………....... 80 5.2.1.2 Channel Information …………………………………… 83 5.2.1.3 Packet Information ……………………………………... 84 5.3 WNetFlow Methodology …………………………………………………. 85 5.4 Feature Selection ………………………………………………………….. 87 5.5 Temporal Analysis of WNetFlows ………...……………………………... 90 5.6 Anomaly Behavior Analysis …………………………………………….... 92 5.6.1 State Machine Anomaly Analysis …………………………...... 93 8 TABLE OF COTETS – COTIUED 5.6.2 WSPS Training-based Anomaly Behavior Analysis …...……… 93 5.7 Attack Detection and Proactive Actions ………………………………….. 95 5.8 Conclusion of Chapter 5 ………………………………………………….. 96 Chapter 6. WIDS EVALUATION METHODOLOGY ………...……………………… 97 6.1 Review of Evaluation methodologies …………………………………….. 97 6.2 Proposed WIDS Evaluation Methodology …………………………………98 6.2.1 Accuracy ………………………………………………...……... 98 6.2.1.1 False Positive …………………………………………... 98 6.2.1.2 Detection Rate …………………………………………. 99 6.2.1.3 Receiver Operating Characteristic ……………………. 100 6.2.2 Adaptability ……...……………………………………………. 101 6.2.3 Scalability and Overhead …………………………………...… 103 6.2.4 Latency for Dynamic Configuration ………………………….. 104 6.3 Conclusion of Chapter 6 ……………………………………...…………. 104 Chapter 7. EXPERIMENTAL RESULTS ……………………………………………. 105 7.1 Test Bed at ITL The University of Arizona …….……………………….. 105 7.1.1 WSPS Configuration ………………………………………... 105 7.2 Experimental Results …………………………………………………… 108 7.2.1 WSPS Evaluation and Experimental Results ……………….. 109 7.2.1.1 Experimental Results ……………..…………………... 111 9 TABLE OF COTETS – COTIUED 7.2.2 Evaluation Methodology Experimental Results ……………… 122 7.2.2.1 Accuracy ……………………………………………… 122 7.2.2.2 Adaptability …………………………………………… 127 7.2.2.3 Scalability and Overhead ……………………………... 129 Chapter 8. CONCLUSION AND FUTURE WORK ………...……………………….. 132 8.1 Dissertation summary ……………………………………………………. 132 8.2 Contribution ……………………………………………………………….132 8.3 Future Research ………………………………………………………….. 134 8.3.1 Implementing more features for WSPS ………….………….... 134 8.3.2 Applying WNetFlow to different Wireless Models ………….. 135 8.3.2.1 Wireless Personal Area Networks ……………………. 135 8.3.2.2 Wireless Metropolitan Area Networks ……………….. 136 8.3.2.3 Wireless Regional Area Networks ……………………. 136 8.3.2.4 Future Networks ………………………………………. 136 REFERENCES ……………………………………………………………………….. 137 10 LIST OF FIGURES 2.1: Wireless Networks sorted by transmission range………………………………….. 20 2.2: IEEE 802.11/802.11i state machine ……………………………………………….. 31 2.3: MAC frame architecture ………...………………………………………………… 34 2.4: DES Standard ……………………………………………………………………… 46 2.5: WEP Design ……………………………………………………………………….. 46 4.1: Wireless Network Attack Mechanisms……………………………………………. 64 5.1: Concept of Operations for WSPS …..……………………………………………... 77 5.2: WNetFlow Structure ………………………………………………………………. 79 5.3: Rule based analysis for Wireless attack detection algorithm ……………………... 95 6.1: ROC Curve showing direct comparison between AWIDS and Airdefense for 4 different types of attacks……………………………………..… 101 7.1: Testbed at ITL/The University of Arizona ………………………………………. 108 7.2: Median number of frames for 50 frames per second beacon flood attack observed using multiple features (f1:conn_num, f2:beacon_frm, f3:beacon_src, f4:mgmt_frm) with 3