A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks
One of the advanced Man-in-the-Middle (MitM) attacks is the Multi-Channel MitM (MC-MitM) attack, which is capable of manipulating encrypted wireless frames between clients and the Access Point (AP) in a Wireless LAN (WLAN). MC-MitM attacks are possible on any client no matter how the client authenti...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2024-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10423016/ |
| _version_ | 1797243294415060992 |
|---|---|
| author | Manesh Thankappan Helena Rifa-Pous Carles Garrigues |
| author_facet | Manesh Thankappan Helena Rifa-Pous Carles Garrigues |
| author_sort | Manesh Thankappan |
| collection | DOAJ |
| description | One of the advanced Man-in-the-Middle (MitM) attacks is the Multi-Channel MitM (MC-MitM) attack, which is capable of manipulating encrypted wireless frames between clients and the Access Point (AP) in a Wireless LAN (WLAN). MC-MitM attacks are possible on any client no matter how the client authenticates with the AP. Key reinstallation attacks (KRACK) in 2017-18, and the latest FragAttacks in 2021 are frontline MC-MitM attacks that widely impacted millions of Wi-Fi systems, especially those with Internet of Things (IoT) devices. Although there are security patches against some attacks, they are not applicable to every Wi-Fi or IoT device. In addition, existing defense mechanisms to combat MC-MitM attacks are not feasible for two reasons: they either require severe firmware modifications on all the devices in a system, or they require the use of several advanced hardware and software for deployment. On top of that, high technical overhead is imposed on users in terms of network setup and maintenance. This paper presents the first plug-and-play system to detect MC-MitM attacks. Our solution is a lightweight, signature-based, and centralized online passive intrusion detection system that can be easily integrated into Wi-Fi-based IoT environments without modifying any network settings or existing devices. The evaluation results show that our proposed framework can detect MC-MitM attacks with a maximum detection time of 60 seconds and a minimum TPR (true positive rate) of 90% by short-distance detectors and 84% by long-distance detectors in real Wi-Fi or IoT environments. |
| first_indexed | 2024-03-08T00:17:02Z |
| format | Article |
| id | doaj.art-6959696586d840ee9bb1009a4fc02e74 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-24T18:52:50Z |
| publishDate | 2024-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-6959696586d840ee9bb1009a4fc02e742024-03-26T17:49:24ZengIEEEIEEE Access2169-35362024-01-0112230962312110.1109/ACCESS.2024.336280310423016A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi NetworksManesh Thankappan0https://orcid.org/0000-0001-8919-4857Helena Rifa-Pous1https://orcid.org/0000-0003-0923-0235Carles Garrigues2https://orcid.org/0000-0002-7812-3401Estudis d'Informàtica Multimèdia i Telecomunicació, Internet Interdisciplinary Institute (IN3), Universitat Oberta de Catalunya (UOC), Barcelona, SpainEstudis d'Informàtica Multimèdia i Telecomunicació, Internet Interdisciplinary Institute (IN3), Universitat Oberta de Catalunya (UOC), Barcelona, SpainEstudis d'Informàtica Multimèdia i Telecomunicació, Internet Interdisciplinary Institute (IN3), Universitat Oberta de Catalunya (UOC), Barcelona, SpainOne of the advanced Man-in-the-Middle (MitM) attacks is the Multi-Channel MitM (MC-MitM) attack, which is capable of manipulating encrypted wireless frames between clients and the Access Point (AP) in a Wireless LAN (WLAN). MC-MitM attacks are possible on any client no matter how the client authenticates with the AP. Key reinstallation attacks (KRACK) in 2017-18, and the latest FragAttacks in 2021 are frontline MC-MitM attacks that widely impacted millions of Wi-Fi systems, especially those with Internet of Things (IoT) devices. Although there are security patches against some attacks, they are not applicable to every Wi-Fi or IoT device. In addition, existing defense mechanisms to combat MC-MitM attacks are not feasible for two reasons: they either require severe firmware modifications on all the devices in a system, or they require the use of several advanced hardware and software for deployment. On top of that, high technical overhead is imposed on users in terms of network setup and maintenance. This paper presents the first plug-and-play system to detect MC-MitM attacks. Our solution is a lightweight, signature-based, and centralized online passive intrusion detection system that can be easily integrated into Wi-Fi-based IoT environments without modifying any network settings or existing devices. The evaluation results show that our proposed framework can detect MC-MitM attacks with a maximum detection time of 60 seconds and a minimum TPR (true positive rate) of 90% by short-distance detectors and 84% by long-distance detectors in real Wi-Fi or IoT environments.https://ieeexplore.ieee.org/document/10423016/Attack signatureFragAttacksintrusion detectionInternet of Things (IoT)KRACKmulti-channel MitM (MC-MitM) |
| spellingShingle | Manesh Thankappan Helena Rifa-Pous Carles Garrigues A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks IEEE Access Attack signature FragAttacks intrusion detection Internet of Things (IoT) KRACK multi-channel MitM (MC-MitM) |
| title | A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks |
| title_full | A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks |
| title_fullStr | A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks |
| title_full_unstemmed | A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks |
| title_short | A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks |
| title_sort | signature based wireless intrusion detection system framework for multi channel man in the middle attacks against protected wi fi networks |
| topic | Attack signature FragAttacks intrusion detection Internet of Things (IoT) KRACK multi-channel MitM (MC-MitM) |
| url | https://ieeexplore.ieee.org/document/10423016/ |
| work_keys_str_mv | AT maneshthankappan asignaturebasedwirelessintrusiondetectionsystemframeworkformultichannelmaninthemiddleattacksagainstprotectedwifinetworks AT helenarifapous asignaturebasedwirelessintrusiondetectionsystemframeworkformultichannelmaninthemiddleattacksagainstprotectedwifinetworks AT carlesgarrigues asignaturebasedwirelessintrusiondetectionsystemframeworkformultichannelmaninthemiddleattacksagainstprotectedwifinetworks AT maneshthankappan signaturebasedwirelessintrusiondetectionsystemframeworkformultichannelmaninthemiddleattacksagainstprotectedwifinetworks AT helenarifapous signaturebasedwirelessintrusiondetectionsystemframeworkformultichannelmaninthemiddleattacksagainstprotectedwifinetworks AT carlesgarrigues signaturebasedwirelessintrusiondetectionsystemframeworkformultichannelmaninthemiddleattacksagainstprotectedwifinetworks |