Is there any methodology to detect smart deauthentication attack?

Question

I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.

Whenever I sent De-Auth frames continuously to APs for limited time I got detected by IDS. But When I sent limited frames randomly I was not detected. I am curious to know if there is any methodology to analyze this kind of smart attack using techniques like machine learning/ wavelets/signal processing etc.

Can any one please suggest papers to read on Wireless IDS for detecting the attack if attack is done randomly or periodically (when attacker sends limited frames less than or equal to the threshold value of detector).

Thank You.

Answer 1

Sending De-Auth frames in the manner you have mentioned - randomly or periodically which remain under the threshold value of detector, may be considered an adversarial attack against intrusion detection systems that could be using machine learning or other methods to be detecting intrusions.

Sending the frames randomly could be considered a form of perturbation, there is a lot of research currently in adversarial attacks against IDS in many different fields, most notably malware, email spam, network attacks etc.

I don't have any papers that come to mind for this specific problem however reading about adversarial attacks against IDS may help you as there are plenty of papers that suggest methods of defending against these adversarial attacks. A good paper that may give you an overview of this area is the following:

Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues https://www.sciencedirect.com/science/article/pii/S0020025513002119

It is quite heavy however even if you grasp the general principles, it may help you.

I have been researching adversarial attacks against NIDS and one of the attack methods is to slow down packets or send them much more randomly to avoid detection.

Answer 2

Responding to your question I do not know tools / methodology that fit your desire.

From what I can think the fact of being detected or not might be related with the threshold of the wireless infrastructure and not of you being unnoticed.

The de-authentication attack has the objective of providing the attacker the initial 4 way handshake or the EAP handshake to the wireless infrastructure.

Small number of de-authentication might not be relevant to the attack or the infrastructure might have other means of compensation of the risk depending on the technology used.

For example: Message integrity check to identify spoofed frames or hashes in de-authentication / disassociate frames (MFP).

If they have the previous things in place it is more probable that the IDS detects you more based on DOS than successful attack.

You should check the IDS rule to have a better understanding on what it is doing.