Wireless intrusion prevention system using dynamic random forest against wireless MAC spoofing attack

With the emergency of Bring Your Own Device (BOYD) and Internet of Things (IoT) in enterprises, there has been an increase in the use of wireless networks through mobile devices and tablet computers. However, as a negative effect, such increase has also led to increased security threat in wireless networks and thus, the importance of wireless network security has increased. As a way to cope with such threat, many enterprises have introduced wireless intrusion prevention system (WIPS) solution, which consists of WIPS sensors and a centralized WIPS server. By monitoring the radio signal in wireless local area networks (LAN), WIPS solution shuts off access by an unauthorized wireless device and prevents an rogue Access Point (AP). In this paper, we propose an implementation framework for WIPS solution that ananlzes the received signal strength (RSS) values collected from multiple WIPS sensors. By overcoming the performance (including accuracy and F-measure) decrease in the wireless environment with much noise, the proposed WIPS solution shows the high performance even under the wireless environment with low signal-to-noise ratio (SNR). For this purpose, the proposed WIPS solution analyzes the RSS values collected from multiple WIPS sensors by using a dynamic random forest (DRF) algorithm. By adding trees that are the most suitable to forest, the DRF algorithm can improve the performance of the WIPS solution. From the experimental results, it is observed that the proposed WIPS solution combined with the DRF algorithm shows the good-enough performance under various SNR and attack distance.