On detecting CTS duration attacks using K-means clustering in WLANs

Abstract

IEEE 802.11 based Wireless LAN (WLAN) standard has been one of the most successful wireless technology standards with total expected sales rising to a staggering $6.1Billion by 2015. The proliferation of 802.11 based WLANs highlights the need to focus on development of new solutions for security as enterprises and campuses increasingly being covered by WLANs. Denial of Service (DoS) is one of the popular attacks that prevents WLAN users from accessing the wireless network resources. Most DoS attacks such as the Clear-to-Send (CTS) duration attack is easy to carry out by an attacker. This work focuses on the use of clustering techniques on wireless traffic datasets for detecting CTS-based DoS attacks on 802.11 WLANs. Performance evaluation shows that, under the cases of naïve CTS duration attacker as well as the sophisticated CTS duration attacker, the k-means clustering technique is able to achieve high detection rates and low false positive rates with relatively small values of k (i.e., number of clusters).