Advanced security through anomaly detection and locating in wireless networks

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process comprising:
• collecting, from each of one or more access points over time within a monitored location, a plurality of hash values, each of the plurality of hash values based on a combination of a plurality of location-related metrics for a respective access point of the one or more access points;
• calculating a baseline hash value for each access point of the one or more access points, each baseline hash value correlated to actual location-related metrics from which each baseline hash value was computed;
• detecting an anomalous change in a particular collected hash value of the plurality of hash values from at least one access point of the one or more access points;
• obtaining, in response to the anomalous change, a plurality of non-hashed location-related metrics from the at least one access point;
• and
• performing a security analysis action based on the plurality of non-hashed location-related metrics.

A system, comprising:

• a controller;
• and
• a plurality of access points communicatively coupled to the controller, wherein the controller is configured to:
• collect, from each of the plurality of access points over time within a monitored location, a plurality of hash values, each of the plurality of hash values based on a combination of a plurality of location-related metrics for a respective access point of the plurality of access points;
• calculate a baseline hash value for each access point of the plurality of access points, each baseline hash value correlated to actual location-related metrics from which each baseline hash value was computed;
• detect an anomalous change in a particular collected hash value of the plurality of hash values from at least one access point of the plurality of access points;
• obtain, in response to the anomalous change, a plurality of non-hashed location-related metrics from the at least one access point;
• and
• perform a security analysis action based on the plurality of non-hashed location-related metrics.