Identifying and trapping wireless based attacks on networks using deceptive network emulation

A data processing system for preventing attacks on an active wireless network, the system comprising:

• a processor;
• and
• a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations, the operations including:
• identifying nodes and connections of the active wireless network;
• emulating a deceptive network including the nodes and connections of the active wireless network and a pseudo-access point, wherein the emulated deceptive network further includes a firewall having a discoverable point of weakness;
• establishing radio frequency coverage of a protected area including the active wireless network to detect radio frequency activity in the protected area;
• establishing authorized security protocols and access behavior patterns for access to the active wireless network;
• continuously monitoring radio frequency activity over a range of radio frequency spectrum within the protected area;
• identifying from the monitored radio frequency activity suspicious radio activity based on the established authorized security protocols or the authorized access behavior patterns for access to the active wireless network;
• re-routing the identified suspicious radio activity to the pseudo-access point of the deceptive network for access into the deceptive network;
• exposing the discoverable point of weakness of the firewall included in the deceptive network to lure an unauthorized attacker associated with the suspicious radio activity to gain access to the deceptive network;
• capturing activity data of the unauthorized attacker while the attacker accessing the deceptive network;
• extracting threat information from the captured activity data on a modality of attack of the unauthorized attacker and an identity of the unauthorized attacker by performing header inspection and deep packet inspection on the captured activity data;
• further extracting a signature of the unauthorized attacker from the captured activity data;
• and
• developing a response for a recovery from the attack and for prevention of future attacks using the extracted threat information and signature of the unauthorized attacker.

A non-transitory computer-readable storage medium storing computer-executable instructions, which when executed by a processor, cause the processor to perform operations for protecting an active wireless network, the operations comprising:

• identifying nodes and connections of the active wireless network;
• emulating a deceptive network including the identified nodes and connections of the active wireless network and a pseudo-access point, wherein the emulated deceptive network further includes a firewall having a discoverable point of weakness;
• establishing radio frequency coverage of a protected area including the active wireless network to detect radio frequency activity in the protected area;
• establishing authorized security protocols and access behavior patterns for access to the active wireless network;
• continuously monitoring radio frequency activity over a range of radio frequency spectrum within the protected area;
• identifying from the monitored radio frequency activity suspicious radio activity based on the established authorized security protocols or the authorized access behavior patterns for access to the active wireless network;
• re-routing the identified suspicious radio activity to the pseudo-access point of the deceptive network for access into the deceptive network;
• exposing the discoverable point of weakness of the firewall included in the deceptive network to lure an unauthorized attacker associated with the suspicious radio activity to gain access to the deceptive network;
• capturing activity data of the unauthorized attacker while the attacker accessing the deceptive network;
• extracting threat information from the captured activity data on a modality of attack of the unauthorized attacker and an identity of the unauthorized attacker by performing header inspection and deep packet inspection on the captured activity data;
• further extracting a signature of the unauthorized attacker from the captured activity data;
• and
• developing a response for a recovery from the attack and for prevention of future attacks using the extracted threat information and signature of the unauthorized attacker.

A computer-implemented method of protecting an active wireless communication network by establishing a deceptive network that emulates the active wireless communication network, the method being performed by a data processing system, the method comprising:

• generating the deceptive network, wherein the generated deceptive network emulates nodes and connections of the active wireless communication network including a firewall having a discoverable point of weakness;
• continuously monitoring, using a plurality of access points, radio frequency activity over a range of radio frequency spectrum within a protected area having the active wireless communication network;
• re-routing, using a wireless risk audit tool on the data processing system, suspicious radio activity identified from the monitored radio frequency activity to the deceptive network via a pseudo-wireless access point to allow access into the deceptive network;
• collecting activity data of an unauthorized user associated with the suspicious radio frequency activity, using a data capture and forensic analysis and reporting tool on the data processing system, on an activity of attack by the unauthorized user within the deceptive network and an identity of the unauthorized user;
• extracting, using the data capture and forensic analysis and reporting tool, a signature of the unauthorized user and a modality of attack by the unauthorized user from the collected activity data;
• developing a response for a recovery from the attack and for prevention of future attacks using the collected activity data and extracted signature;
• and
• providing the developed response to a threat intelligence established by the data capture and forensic analysis and reporting tool to ensure the recovery.