# US 2019/0357052 A1 · System and method for analyzing properties within a real time or recorded transmissions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0357052 A1 - Document ID: US20190357052A1 - Status: Published application - Kind: A1 - Application number: 16/414,744 - Filed: 2019-05-16 - Published: 2019-11-21 - Earliest claimed: 2018-05-17 - Inventors: Geoffrey E. Korrub - Web page: https://patentgrep.com/patent/US20190357052A1 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04L 63/102: {Entity profiles} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04W 12/08: Access security - H04W 28/10: Flow control {between communication endpoints} - H04W 92/10: between terminal device and access point, i.e. wireless air interface - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system for detecting and remediating unauthorized rouge access point devices and wireless devices in wireless access networks. The system and method are capable of being operated in a standalone manor using self-discovered information about network topologies and other information vectors. The system may be operated stand alone or with other input points to enhance accuracy. ## Claims ### Claim 1 A method for detecting and remediating unauthorized wireless access devices on local area computer networks, the method comprising: detecting, using a wireless network interface all relevant wireless devices and their device metadata within the geographic region; detecting, using any appropriate network interface any relevant network devices to perform detection of unauthorized access wireless devices; extracting, device metadata and or network heuristics data; cataloging, all relevant device data as detected; cataloging all relevant network heuristics data as detected; identifying, devices based on network heuristics' and or device metadata; comparing, identified devices against known heuristics and or device properties to determine remediation action; and remediating identified devices to remove or limit their access. ### Claim 2 (depends on 1) The method as claimed in claim 1 wherein the detected wireless devices have no predetermined type or protocol. ### Claim 3 (depends on 1) The method as claimed in claim 1 wherein the detected wireless devices may be of any type. ### Claim 4 (depends on 1) The method as claimed in claim 1 wherein the detected network devices may be in any geographic location. ### Claim 5 (depends on 1) The method as claimed in claim 1 wherein the network devices may be of any type. ### Claim 6 (depends on 1) The method as claimed in claim 1 wherein the extracted metadata may include any combination of device MAC address, IP address, MLME settings, and or other imbedded data that may be used to narrow and identification of a device. ### Claim 7 (depends on 6) The method as claimed in claim 6 wherein the imbedded data may be vendor generic, or specifically imbedded as a user and or device identifier. ### Claim 8 (depends on 1) The method as claimed in claim 1 wherein the extracted network heuristics data may include any combination of, network layer addressing, network path tracing, and or time through a network. ### Claim 9 (depends on 8) The method as claimed in claim 8 wherein the network layer addressing may differ to include any addressing relevant to the protocol in use at any layer of the OSI model. ### Claim 10 (depends on 8) The method as claimed in claim 8 wherein the network path tracing may be to a single endpoint or multiple endpoints. ### Claim 11 (depends on 10) The method as claimed in claim 10 where the endpoints may be installed without limitation for type or reusability. ### Claim 12 (depends on 8) The method as claimed in claim 8 wherein the time through the network may be measured to any level of accuracy as needed. ### Claim 13 (depends on 1) The method as claimed in claim 1 wherein the cataloging of relevant data may be stored in a local database and or loaded into memory and/or uploaded off the system. ### Claim 14 (depends on 1) The method as claimed in claim 1 wherein devices and network paths are identified within the catalog later comparison. ### Claim 15 (depends on 1) The method as claimed in claim 1 wherein identified devices are compared to a ruleset of evaluation of remediation action potential. ### Claim 16 (depends on 1) The method as claimed in claim 1 wherein the remediation actions are performed against identified actionable devices. ### Claim 17 (depends on 16) The method as claimed in claim 16 where remediation may include transition of deauthorization packets, ### Claim 18 (depends on 17) The method as claimed in claim 17 where the deauthorization packets may contain forged headers and may be sent to any number or type of recipient as needed to remediate. ### Claim 19 (depends on 16) The method as claimed in claim 16 where remediation may include locally blocking access. ### Claim 20 A system for detecting and remediating unauthorized wireless access devices comprising: a processor; a network communication interface; and a memory coupled to the processor; wherein the processor is configured to detect wireless devices and their metadata properties within transmission, as well as the detection of network heuristics for proposes of detecting and identifying rouge wireless device and performing remediation actions as appropriate. ### Claim 21 (depends on 20) A system as claimed in claim 20 consisting of at least one wireless interface for detecting device metadata and network heuristics to determine if a wireless device. ### Claim 22 (depends on 21) A system as claimed in claim 21 where a physical network interface may be used in conjunction with or in place of the wireless interface for detection of network heuristics. ### Claim 23 (depends on 20) A system for using metadata and network heuristics as claimed in claim 20 where the analysis of those is used at least to derive a result in the identification of rouge devices. ### Claim 24 (depends on 20) A system as claimed in claim 20 capable of performing remediation actions including but not limited to, blocking traffic or electronicky alerting other systems for enforcement. ### Claim 25 (depends on 24) A system as claimed in claim 24 where blocking of traffic my include halting traffic from a network interface on the local system, triggering an upstream system to halt traffic and or interacting with the data session. ### Claim 26 (depends on 25) A system as claimed in claim 25 where interacting with the data session may include sending session reset packets, sending deauthorization packets and or other equants. ### Claim 27 (depends on 26) A system as claimed in claim 26 where sending of packets may be sent with a forged source and or destination as needed to achieve the effect.