Identity-Based Attack Detection and Classification Utilizing Reciprocal RSS Variations in Mobile Wireless Networks

Identity-based attacks (IBAs) are one of the most serious threats to wireless networks. Recently, there is an increasing interest in using the received signal strength (RSS) to detect IBAs in wireless networks. However, current schemes tend to generate excessive false alarms in the mobile scenario. In this paper, we propose a stronger Reciprocal Channel Variation-based Identification and classification (RCVIC) scheme for the mobile wireless networks, which exploits the reciprocity of the wireless fading channel and RSS variations naturally incurred by mobility to improve the detection performance. Different from current schemes only detect IBAs, RCVIC scheme conducts a multi-stage detection processes. If the IBAs are detected, RCVIC scheme partitions the received frames into two classes. The frames in the same class should be sent from the same senders, which could benefit the further analysis, such as network forensics, attacker localizing and trajectory analysis, etc. The feasibility of RCVIC are numerically evaluated through theoretical analysis and simulations. It is further validated through experiments using off-the-shelf 802.11 devices under different attacking patterns in real indoor and outdoor mobile scenarios.