Physical-Layer Intrusion Detection in Wireless Networks

This paper describes a method for detecting intrusions in wireless local area networks (WLANs) based on physical layer features extracted from the radio frequency (RF) waveform of individual network packets. The features considered include those intrinsic to the packet source (wireless user node), as well as those related to the propagation path between the source and a network access point (AP). It is shown that the statistics of a set of packet features can be used to fingerprint each packet source in the network, thereby providing a mechanism for identifying rogue node activity, such as a spoofing attack. Empirical results are presented for an IEEE 802.11b network