Системы обнаружения вторжений в сетях широкополосного радиодоступа стандарта IEEE 802.11

Abstract

Purpose: The research of developers of IDS and IPS has provided an operational model of an intrusion detection system which can detect and block typical wireless attacks in a wire system of data transfer. Yet the problem of techniques for monitoring, detecting and responding to information technology security breaches is very relevant in IEEE 802.11 radio networks. This research has been targeted at development of methods of system automation for preventing attacks on organization's wireless access points. Methods: signature and heuristic analysis of network traffic, correlation analysis of intrusion attempts. Results: There have been developed basic principles of constructing a system of intrusion detection in wireless networks. There have been worked out requirements for the methods of IDS data collection and analysis. There has been presented a technology of intruder detection at strategic points of a target IT system applying a method of evaluation of a received RSSI signal and a method of difference of TDoA signal arrival. There have been developed methods of radio channel scanning allowing detecting attacks in both autonomous systems and systems with central event processing. Practical relevance: The research results allow increasing the safety of the existing distributed radio networks.