Back to results
US 11,122,441 B2Granted
Anomalous access point detection
AssigneeMicrosoft Technology Licensing, LLC
InventorsAmer A. Hassan, Roy Kuntz, Michael Davis
Life of this patent
Estimating the term…
Abstract
Disclosed in some examples are methods, systems, devices, and machine-readable mediums that detect evil twin and other anomalous access points in an IT infrastructure by detecting access points that are not in their expected locations based upon an analysis of access point reports from one or more computing devices.
Claims18
A device for detecting fraudulent network access points, the device comprising:
- a hardware processor;
- a memory, including instructions, which when executed, cause the hardware processor to perform operations comprising:
- determining a set of a plurality of network access points currently in wireless range to a first computing device, the first computing device determining the set by receiving wireless signals from each of the network access points in the set;
- determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location based upon a comparison of the set of network access points that are currently in wireless range to the first computing device and access point positioning data describing position information of the set of network access points that are within wireless range to the first computing device, the access point positioning data comprising, for each particular access point in the set of the plurality of network access points, relative location data that describes probabilities that the particular access point is within wireless range of the first computing device given a set of other access points that are within wireless range of the first computing device;
- storing an indication that the first network access point is suspected as being anomalous based upon the determination that the first network access point is broadcasting from a location that is not an expected location;
- and
- initiating at least one corrective action based upon the indication that the first network access point is anomalous.
4 more elements
A method for detecting fraudulent network access points, the method comprising:
- using one or more hardware processors:
- determining a set of a plurality of network access points currently in wireless range to a first computing device, the first computing device determining the set by receiving wireless signals from each of the network access points in the set;
- determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location based upon a comparison of the set of network access points that are currently in wireless range to the first computing device and access point positioning data describing position information of the set of network access points that are within wireless range to the first computing device, the access point positioning data comprising, for each particular access point in the set of the plurality of network access points relative location data that describes probabilities that the particular access point is within wireless range of the first computing device given a set of other access points that are within wireless range of the first computing device;
- storing an indication that the first network access point is suspected as being anomalous based upon the determination that the first network access point is broadcasting from a location that is not an expected location;
- and
- initiating at least one corrective action based upon the indication that the first network access point is anomalous.
3 more elements
A device for detecting fraudulent network access points, the device comprising:
- means for determining a set of a plurality of network access points currently in wireless range to a first computing device, the first computing device determining the set by receiving wireless signals from each of the network access points in the set;
- means for determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location based upon a comparison of the set of network access points that are currently in wireless range to the first computing device and access point positioning data describing position information of the set of network access points that are within wireless range to the first computing device, the access point positioning data comprising, for each particular access point in the set of the plurality of network access points relative location data that describes probabilities that the particular access point is within wireless range of the first computing device given a set of other access points that are within wireless range of the first computing device;
- and
- means for initiating at least one corrective action based upon the determination that the first network access point is broadcasting from a location that is not an expected location.
1 more element
Dependencies are inferred from the claim text.