With the growth of wireless Wi-Fi traffic, detecting known and unknown attacks in networks remain challenging. Machine learning algorithms and neural networks support efficient tools for traffic analysis and intrusion detection. However, there are limited studies that compare the performance capabilities of these techniques for detecting attacks in networks of the 802.11 family of standards. There are several basic authentication standards for wireless networks. Each of them has its own advantages and disadvantages. Each has its own, rather complex, principle of operation. A large number of auxiliary diagrams and screenshots of the D-Link Airplane XtremeG Wireless Utility with the necessary settings are typical. The article discusses the main security problems of Wi-Fi wireless networks based on the 802.11 family of standards. Known vulnerabilities and possible methods of parrying them are given. The wireless networks of the IEEE 802.11 family of standards have more than 20 years' history of development and are widespread everywhere from homes to enterprise environments today. In this article, the architecture, an organization of communications and embedded security mechanisms of wireless networks will be discussed.
Human activity through the interaction of various devices across networks in everyday life increases daily. Most devices today can connect to the Internet and the number of connected appliances will reach 20.4 billion by 2020 (Gartner, 2019). The world is becoming more connected and with this comes a continuous increase in the amount of information exchanged between these devices.
Wireless technologies are attractive in the Internet era because they simplify connections and reduce the cost of devices. According to Cisco (2016), Wi-Fi and mobile traffic will grow 12% by 2021 from 2016 and will be 63% of all IP traffic. The dependence of humanity on this technology continues to grow, and by the end of 2018, the number of public access points will reach 340 million, which is seven times more than 2014 (Omar et al., 2016). The first standard of the Wi-Fi family, known as the IEEE 802.11, was released in 1997 and was followed with many amendments as it maintained the basis for wireless network products. Wireless networks also attract criminals as new intrusion techniques and attack vectors develop rapidly. Since the first version of the standard, developers-built security mechanisms to provide confidentiality of communications for all nodes in a Wireless Local Area Network (WLAN). The first attempt to implement Wired Equivalent Protection (WEP) was nearly immediately recognized as vulnerable to attacks, which threatened the confidentiality of the transmitted information. Subsequent development of protective mechanisms increased the ability to cope with threats and developers focused on the confidentiality and availability of wireless networks during attacks. However, the growth of computer processing power and ease of availability of software designed to assist with hacking help even low-skilled attackers perform attacks.
Wireless Intrusion Detection Systems (WIDS) are an integral part of modern security for wireless networks. These systems cope with the threats 24/7 and consider the human factor. Moreover, intruders can plan their actions to pass through WIDS exploiting human weaknesses (Martellini et al., 2017). For example, attackers can provoke a WIDS to generate alerts for a long time so that it appears as a common event to those monitoring the system, such as the case of the 22-hour unavailability of eBay due to the attack "when the IDS system constantly alarmed, but everyone was too busy to answer” (Cherry, 2000).
Nevertheless, WIDS has become one of the most effective tools allowing a quick response to threats. These systems combine different approaches to the analysis of traffic and data, including machine learning techniques. The application of machine learning in WIDS grew rapidly because the algorithms help to automate detection of attacks and malicious behavior in networks using clustering (Shamshirband et al., 2014), attack classification (Thing, 2017) or anomaly-based detection (Usha and Kavitha, 2017). Along with conventional algorithms, such as Random Forest or AdaBoost, Artificial Neural Networks (ANN) also show great performance in the analysis of traffic flow (Al-Jarrah et al., 2015).
This article helps to do overview of wireless connection security standards in company's digital infrastructure (WIDS) and find most common weaknesses to prevent cyber-attacks.
Some researchers tried to explore conventional Machine Learning (ML) and ANN
techniques for detecting attacks in networks [
The number of studies comparing ML and DL performance is limited, and existing
methods have significant limitations [
For more than 20 years, the standard has seen many versions and undergone many
amendments. Some of them are focused on legislative complaints, others on
technical improvements and on enhancing security [
WEP. Security mechanisms have been built into wireless networks since the first
version of the 802.11 standard [3,7,8,10, 25.35]. WEP was one of the first security
mechanism that was developed by a group of volunteer IEEE members to prevent
eavesdropping (confidentiality), unauthorized access to a wireless network (access
control), and tampering with transmitted messages (data integrity). WEP uses two
methods of authentication: Open System and Shared Keys, and provides the security
by encryption through the RC4 algorithm.
WEP mechanism has many fundamental weaknesses. First, it has problems in the
RC-4 algorithm because uses RC4 improperly and keys can be brute-forced. Second,
it allows an attacker to modify a message undetectably without knowing the
encryption keys. Third, it uses weak key management and updating key mechanism
and cannot prevent attacks such as reply attack and the forging of authentication
messages [
WPA was designed to fix the vulnerabilities of WEP. However, weaknesses of WPA have been discovered by many researchers. Moskowitz (2003) demonstrated the weaknesses of WPA against a dictionary attack in November 2003. Tews and Beck (2009) proposed a successful attack on WPA. They used the implementation of WPA with support of IEEE 802.1e Quality of Service (QoS) features. During this attack, a plain text from the encrypted message was recovered in 15 minutes. WPA2. The draft of the IEEE 802.11i was revealed in 2004, and it was finally published as the IEEE 802.11-2007 standard in 2007 (Society and Committee, 2007). The specification is the next generation of IEEE 802.11 and frequently referred to as WPA2. The basic mechanisms for generating keys and efforts which were used to protect traffic confidentiality and integrity will be discussed below. Generating a key in WPA2 specification is a hierarchical structure. The initialization of the primary key depends on the authentication method. The authorization method can be based on a PSK if the pre-shared key is used as the authentication method. As can be seen from Figure 2, STA generates a PSK using Password-Based Key Derivation function 2 (PBKDF2). The next step is generating PMK from PSK. A fresh PTK is composed of three parts: Key Confirmation Key (KCK), Key Encryption Key (KEK) and Temporal Key (TK) that are used to protect unicast traffic from AP and STA.
The 802.11i standard defines the Master Session Key (MSK) as the top-level key if
WLAN uses the 802.11X family standard for authorization. The active version of
the 802.1X-2010 standard is different from PSK authentication and involves the
following parties in the authentication process: a supplicant is a STA that wants to
connect to a WLAN, an authenticator device is an AP and authentication server such
as Radius [
CCMP uses the Advanced Encryption Standard (AES) algorithm as the basis for
encrypting data. It splits data into 128-bit pieces and encrypts them using a key of
the same size. TKIP and WEP are based on RC4, but the main difference between
TKIP and WEP is the centralized management of packet integrity, which is
performed at the AES level. WRAP can be used instead of CCMP as the encryption
method and is considered more secure because it is based on the Offset Codebook
(OCB) mode of AES [
WPA2 provides a robust and secure approach for wireless networks and solves several security issues. Nevertheless, it is susceptible to Denial of Service (DoS) attacks during re-authentication and re-association phases (Tsitroulis, Lampoudis and Tsekleves, 2014). Li et al., (2012) and Yin and Cui (2011) succeeded in efforts to enhance the security of WPA2, but at the same time, they have emphasized that growing computing capabilities make it much easier to exploit the vulnerabilities of the standard. 802.11w. The predecessors of the IEEE 802.11w standard focused on the confidentiality and integrity and paid little attention to the availability of wireless networks. Consequently, the security mechanisms of wireless networks were vulnerable to DDoS attacks, because management frames remained unprotected. In 2009, the IEEE 802.11w-2009 (IEEE, 2009) standard was approved focusing on these issues. The Robust Management Frames (RMF) mechanism of the standard provide cryptographic protection of Deauthentification, Disassociation and Action frames.
A new PTK was presented in the WPA2 mechanism and responsible for protecting unicast management frames. The new encryption key focusing on broadcast management frames was introduced in IEEE 802.11w, namely the Integrity Group Transient Key (IGTK). Moreover, the new the Security Association Query (SA Query) mechanism was implemented to defend from Association Request attacks. It generates SA Query Request and Response which corresponds between nodes and helps to verify the association procedure. The procedure is interrupted if the STA Query Response message is not recognized as valid by the AP.
Another significant improvement is the Timeout Information Element (TIE). The
timer allows an AP to store a session if it receives another SA Request at the time of
waiting for the response from an STA. The AP expects to wait for a response from
the STA for a certain time and does not respond to requests from third-party clients.
Nevertheless, the final improvement in the wireless security mechanism is not free
from vulnerabilities. For example, an attacker can create a successful DDoS attack
by sending Deauthentication frames repeatedly and preventing the association
between the AP and STA during the handshake phase [
In summary, these results show that even the final implementation of the 802.11 standards has vulnerabilities. Before proceeding to examine wireless security, it is necessary to give an overview of existing attacks on 802.11 networks.
The wireless networks are based on the final revision of the standard (IEEE Std
802.11 -2016, 2016) and use the following radio frequencies 2.4 GHz, 3650 MHz,
4.9 GHz, 5 GHz, 5.9 GHz, 60 GHz. The most common frequency is 2.4 GHz that
can be distinguish into 11-14 channels depending on the region [
The networks can be organized into two modes: The Infrastructure and Ad-Hoc modes. As can be seen from Figure 3, Client Stations (STA) communicate through an organizational device, namely the Access Point (AP) in the infrastructure mode. A group of stations using the same radio frequency is known as a Basic Service Set (BSS) that can be interconnected via a Distribution System (DS) into an Extended Service Set (ESS). Wireless Local Area Network (WLAN) systems are defined as systems that include the DS and one or more APs.
The Ad Hoc mode is a term used as a general description of an Independent Basic Service Set (IBSS). IBSS forms peer-to-peer connections between STAs within their range and does not rely on APs. These two modes have different traffic behavior and vulnerabilities. This research is focused on the description of the architecture and security issues of the infrastructure mode. A brief overview of communications is provided below. The communication structure of the Wi-Fi can be described in the context of Open Standards Interconnect (OSI) seven-layer communications model (ISO/IEC 7498-1, 1994). As can be seen from Figure 4, standards in the IEEE project 802.11 target two layers: Physical (PHY) and Data Link layers. The PHY layer specifies modulation, coding techniques and responsible for media and signal transmission. The Data Link Layer is divided into two sublayers: Logic Link Control (LLC) and Media Access Control (MAC). The LLC sublayer receives information form layers 3 to 7 and transfers to MAC sublayer. MAC sublayer is responsible to add information from second layer such as source, destination and BSS.
As shown in Figure 4, frames are basic transfer units of Data Link Layer. The family
of IEEE 802.11 standards has different types of frames. Figure 5 presents a generic
data frame. Data frames have the same structure consisting of a header, the frame
body, and Frame Check Sequence (FCS) but, depending on the specific type, some
of the fields may not be used [
Figure 6 demonstrates the establishment of communication through a search for the available networks by sending probe requests. The client can explicitly request the network to which it wants to connect or send 0 bytes as SSID which is also known as Broadcast SSID. The AP is answered by a probe response packet.
Fig. 6. Frame exchange between two parties using 802.11i (frame exchanges of 4-way handshake (WPA-PSK) is shown simplified) After this packet is received, the client sends an authentication request which must be answered by authentication response. The client sends an association request if the previous exchange of authentication packet was successful and waits for association response. The next step is the handshake and it depends on the security mechanism chosen for establishing connections.
Figure 7 demonstrates a successful four-way handshake using a Wi-Fi Protected Access Pre-Shared Key (WPA-PSK) as an example. A Pre-Shared Network Key (PSK) is used to start communication it can be in the range from 8 to 63 ASCII characters. A Pairwise Master Key (PMK) is generated based on the combination of the pre-shared key and the SSID of the network. The STA and AP negotiate a temporary Pairwise Transient Key (PTK). These temporary keys are dynamically generated each time the client connects based on MAC addresses and they exchange random numbers of A-nonce from the access point and S-nonce from the STA side. This helps to ensure uniqueness and non-repeatability of the keys.
The AP checks the PMK from the STA using the Message Integrity Code (MIC)
which is a cryptographic hash of the packet [35]. It helps to prevent tampering
because if MIC is not valid that means that PTK and PMK are also not correct as
PTK is obtained from PMK. Other security features of 802.11 standards will be
discussed in more detail later.
Control frames assist and coordinate the delivery of data from clients to APs. They
have one the of the following subtypes: Request to Send (RTS), Clear to Send
(CTS), Acknowledgment (ACK) and Power-Save Poll (PS-Poll). RTS and CTS are
optional data frames, that help to reduce frame collisions, which are introduced by
the hidden node problem because it requests permission to occupy the channel
before data transfer [
Data frames are used to carry actual information from other layers after communication is established. They can be categorized according to function. For example, basic data frames are used for delivery and receiving data but null data frames care no payload such as information about the sleep state of devices.
With the growth of wireless Wi-Fi traffic, detecting known and unknown attacks in networks remain challenging. Machine learning algorithms and neural networks support efficient tools for traffic analysis and intrusion detection. However, there are limited studies that compare the performance capabilities of these techniques for detecting attacks in networks of the 802.11 family of standards. There are several basic authentication standards for wireless networks. Each of them has its own advantages and disadvantages. Each has its own, rather complex, principle of operation. A large number of auxiliary diagrams and screenshots of the D-Link Airplane XtremeG Wireless Utility with the necessary settings are typical. In the article the authors tried to show evolution and common weaknesses of well-known security standards and through that provide more secured architecture and communication lines within popular WIDS.
The article discusses the main security problems of Wi-Fi wireless networks based on the 802.11 family of standards. Known vulnerabilities and possible methods of parrying them are given. The wireless networks of the IEEE 802.11 family of standards have more than 20 years’ history of development and are widespread everywhere from homes to enterprise environments today. In this article, the architecture, an organization of communications and embedded security mechanisms of wireless networks are discussed. The main purpose of this article is to provide and create secured architecture and help specialists to avoid leaks of data, in time do updates and prevent black holes in security 802.11 standards.
This article was funded as part of the internal grant under the name "Preparation of scientifically based proposals for the development of the Russian market of financial technologies and alternative money as an element of the country's innovative policy" by PRUE.
References Available at: http://csrc.ncsl.nist.gov/publications/nistpubs/800-94/SP800-94.pdf. (Accessed: 17 August 2018). 28. Schmidhuber, J. (2015) ‘Deep Learning in neural networks: An overview’, Neural
Networks, pp. 85–117. doi: 10.1016/j.neunet.2014.09.003. 29. Scikit-Learn (2018) GridSearchCV. Available at: http://scikitlearn.org/stable/modules/generated/sklearn.model_selection.GridSearchCV.html (Accessed: 17 August 2018). 30. Shamshirband, S. et al. (2014) ‘D-FICCA: A density-based fuzzy imperialist competitive clustering algorithm for intrusion detection in wireless sensor networks’, Measurement: Journal of the International Measurement Confederation, 55, pp. 212–226. doi: 10.1016/j.measurement.2014.04.034. 31. Tews, E. and Beck, M.: ‘Practical Attacks Against WEP and WPA’, Proceedings of the second ACM conference on Wireless network security, pp. 79–85 (2009) 32. Tsitroulis, A., Lampoudis, D. and Tsekleves, E.: ‘Exposing WPA2 Security Protocol Vulnerabilities’, International Journal of Information and Computer Security, 6(1), p. 93 (2014) 33. Wang, W. and Wang, H.: ‘Weakness in 802.11w and an improved mechanism on protection of management frame’, in 2011 International Conference on Wireless Communications and Signal Processing, WCSP (2011) 34. Wong, S.: ‘The evolution of wireless security in 802.11 networks: WEP, WPA and 802.11 standards’, SANS Institute, (October), pp. 1–9 (2003) 35. Yin, D. and Cui, K.: ‘A research into the latent danger of WLAN’, in ICCSE 2011 - 6th International Conference on Computer Science and Education, Final Program and Proceedings, pp. 1085–1090 (2011)