Detecting and preventing denial of service attacks due to fraudulent BSS color collision events

An apparatus comprising:

• a communication interface configured to enable network communications;
• and
• a microprocessor coupled with the communication interface, and configured to:
• obtain from a first wireless access point using a first Basic Service Set (BSS) color, a color collision event detected by the first wireless access point, wherein a BSS color is an identifier included in transmissions by the first wireless access point to distinguish different BSSs using a common or overlapped frequency channel and a color collision event occurs when the first wireless access point receives from a device in a BSS of a different physical wireless access point a frame or Physical Protocol Data Unit (PPDU) that includes the first BSS color;
• obtain, from the first wireless access point, an indication of whether the color collision event has been detected for at least one of:
• a time period greater than a predetermined duration threshold, and an airtime percentage of PPDUs greater than a predetermined airtime percentage threshold;
• when the color collision event has been detected for the time period greater than the predetermined duration threshold and/or for the airtime percentage of PPDUs greater than the predetermined airtime percentage threshold, compute a probability of the color collision event;
• and
• determine whether to change the first BSS color of the first wireless access point based on whether the color collision event is benign or malicious according to the probability of the color collision event.

One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

• obtain, at a management entity for a wireless local area network (WLAN) from a first wireless access point using a first Basic Service Set (BSS) color, a color collision event detected by the first wireless access point, wherein a BSS color is an identifier included in transmissions by the first wireless access point to distinguish different BSSs using a common or overlapped frequency channel and a color collision event occurs when the first wireless access point receives from a device in a BSS of a different physical wireless access point a frame or Physical Protocol Data Unit (PPDU) that includes the first BSS color;
• obtain, from the first wireless access point, an indication of whether the color collision event has been detected for at least one of:
• a time period greater than a predetermined duration threshold, and an airtime percentage of PPDUs greater than a predetermined airtime percentage threshold;
• when the color collision event has been detected for the time period greater than the predetermined duration threshold and/or for the airtime percentage of PPDUs greater than the predetermined airtime percentage threshold, compute a probability of the color collision event;
• and
• determine whether to change the first BSS color of the first wireless access point based on whether the color collision event is benign or malicious according to the probability of the color collision event.