Generating Representative Attack Test Cases for Evaluating and Testing Wireless Intrusion Detection Systems

Khalid Nasr

doi:10.5121/ijnsa.2012.4301

Abstract

Openness of wireless communication medium and flexibility in dealing with wireless communication protocols and their vulnerabilities create a problem of poor security. Due to deficiencies in the security mechanisms of the first line of defense such as firewall and encryption, there are growing interests in detecting wireless attacks through a second line of defense in the form of Wireless Intrusion Detection System (WIDS). WIDS monitors the radio spectrum and system activities and detects attacks leaked from the first line of defense. Selecting a reliable WIDS system depends significantly on its functionality and performance evaluation. Comprehensive and credible evaluation of WIDSs necessitates taking into account all possible attacks. While this is operationally impossible, it is necessary to select representative attack test cases that are extracted mainly from a comprehensive classification of wireless attacks. Dealing with this challenge, this paper proposes a holistic taxonomy of wireless security attacks from the perspective of the WIDS evaluator. This proposed taxonomy includes all relevant necessary and sufficient dimensions for wireless attacks classification and it helps in generating and extracting the representative attack test cases.

Highlights

Along with growing reliance on wireless networking technology in recent years, the challenges of wireless network security have been increasing
One of the pivotal elements in wireless network security is the wireless intrusion detection system (WIDS) that is considered as a second line of defense for detecting any leaked attacks form the first line of defense such as firewall and encryption
Characteristics of WIDSs do not deviate much more from the wired intrusion detection systems (IDSs); just the RF sensors, wireless communication features and wireless attack features are taken into account for WIDSs

Summary

Introduction

Along with growing reliance on wireless networking technology in recent years, the challenges of wireless network security have been increasing. Signature-based technique concerns with detecting any evidence of attacks, according to a predefined and established model for specific known attacks This technique presents low false positives, but it couldn't be able to detect the novel attacks which may cause high false negatives. The considered taxonomy is created by extracting the attack signs or signatures from all possible attacks and assembling the common attack signs under representative dimensions These taxonomy dimensions guide to techniques and mechanisms that can be followed by the securitydefender to prevent the attacks. The attacks are classified from the perspective of the securitycountermeasure evaluator Dimensions of this taxonomy guide to the attack generation process and help in extracting the attack test cases.

Methods

Results

Conclusion