Back to results
US 2022/0070684 A1Published application
Anomalous access point detection
AssigneeMicrosoft Technology Licensing, LLC
InventorsAmer Aref Hassan, Roy D. Kuntz, Michael Davis
Life of this patent
Estimating the term…
Abstract
Disclosed in some examples are methods, systems, devices, and machine-readable mediums that detect evil twin and other anomalous access points in an IT infrastructure by detecting access points that are not in their expected locations based upon an analysis of access point reports from one or more computing devices.
Claims20
A first computing device for detecting fraudulent network access points, the first computing device comprising:
- a hardware processor;
- a memory, including instructions, which when executed, cause the hardware processor to perform operations comprising:
- receiving identification information on a first set of a plurality of wireless access points from a second computing device, the second computing device currently within simultaneous wireless range of the first set of the plurality of wireless access points;
- based on the received identification information on the first set of the plurality of wireless access points simultaneously within wireless range of the second computing device, accessing, from a data store, pre-stored co-occurrence information that describes a likelihood of two or more wireless access points in the first set being in a same transmission range simultaneously;
- based on the accessed pre-stored co-occurrence information, determining a likelihood of a first wireless access point in the first set being in the same transmission range with one or more wireless access points in the first set simultaneously;
- evaluating if the determined likelihood meets a threshold security condition;
- responsive to the determined likelihood failing to meet the threshold security condition, determining that a first wireless access point in the first set of the plurality of wireless access points is suspicious;
- storing an indication that the first wireless access point is suspicious;
- and
- initiating at least one corrective action based upon the indication that the first wireless access point is suspicious.
7 more elements
A method for detecting fraudulent network access points, the method comprising:
- at a first computing device:
- receiving identification information on a first set of a plurality of wireless access points from a second computing device, the second computing device currently within simultaneous wireless range of the first set of the plurality of wireless access points;
- based on the received identification information on the first set of the plurality of wireless access points simultaneously within wireless range of the second computing device, accessing, from a data store, pre-stored co-occurrence information that describes a likelihood of two or more wireless access points in the first set being in a same transmission range simultaneously;
- based on the accessed pre-stored co-occurrence information, determining a likelihood of a first wireless access point in the first set being in the same transmission range with one or more wireless access points in the first set simultaneously;
- evaluating if the determined likelihood meets a threshold security condition;
- responsive to the determined likelihood failing to meet the threshold security condition, determining that a first wireless access point in the first set of the plurality of wireless access points is suspicious;
- storing an indication that the first wireless access point is suspicious;
- and
- initiating at least one corrective action based upon the indication that the first wireless access point is suspicious.
6 more elements
A first computing device for detecting fraudulent network access points, the first computing device comprising:
- means for receiving identification information on a first set of a plurality of wireless access points from a second computing device, the second computing device currently within simultaneous wireless range of the first set of the plurality of wireless access points;
- means for, based on the received identification information on the first set of the plurality of wireless access points simultaneously within wireless range of the second computing device, accessing, from a data store, pre-stored co-occurrence information that describes a likelihood of two or more wireless access points in the first set being in a same transmission range simultaneously;
- means for, based on the accessed pre-stored co-occurrence information, determining a likelihood of a first wireless access point in the first set being in the same transmission range with one or more wireless access points in the first set simultaneously;
- means for evaluating if the determined likelihood meets a threshold security condition;
- means for, responsive to the determined likelihood failing to meet the threshold security condition, determining that a first wireless access point in the first set of the plurality of wireless access points is suspicious;
- means for storing an indication that the first wireless access point is suspicious;
- and
- means for initiating at least one corrective action based upon the indication that the first wireless access point is suspicious.
5 more elements
Dependencies are inferred from the claim text.