Heuristics-based identification of IoT (internet of things) attacks in Wi-fi

A non-transitory computer-readable medium storing source code that, when executed by a processor, performs a method in an access point of a data communication network, for heuristics-based identification of IoT attacks in wireless communication from data, the method comprising the steps of:

• transmitting beacons for setting-up a wireless communication connection with an IoT device utilizing a BSSID (Basic Service Set Identifier);
• wherein the IoT device comprises a non-computerized physical device that is retrofitted for a network presence;
• detecting wireless communication frames transmitted from the IoT device to the access point over a window of time;
• applying a heuristic analysis to identify whether the IoT device is malicious by:
• processing the wireless communication frames to expose IoT application data from the wireless communication frame over the time window in conjunction with a wireless communication controller having network-wide visibility of the IoT device interactions from at least one other access point;
• identifying deviations in the IoT application data to detect malicious activity from the IoT device by comparing the IoT application data from at least a first time and a second time within the time window at least partially based on the network-wide visibility of the IoT device interactions from the at least one other access point;
• and
• responsive to the IoT application data comparison detecting a malicious activity from the IoT device, performing a network security action in reference to the IoT device, the network security action to prevent the malicious activity.