Protecting 802.11 ax networks from qos null attacks

An access point, comprising:

• a processor;
• a memory, storing instructions which, when executed by the processor, cause the processor to:
• receive a plurality of Single User (SU) Quality of Service (QOS) NULL frames from a station;
• track, as the plurality of SU QOS NULL frames are received, a variable in one or more of the plurality of SU QOS NULL frames;
• determine, based on tracking the variable, the station is suspicious;
• send, in response to determining the station is suspicious, a request to check a status of the variable;
• determine, based on a response to the request, the station is under attack;
• and
• flag the station as under an attack.

A non-transitory computer readable medium comprising instructions which, when executed by at least one processor of an access point, causes the at least one processor to:

• receive a plurality of Single User (SU) Quality of Service (QOS) NULL frames from a station;
• track, as the plurality of SU QOS NULL frames are received, a variable in one or more of the plurality of SU QOS NULL frames;
• determine, based on tracking the variable, the station is suspicious;
• send, in response to determining the station is suspicious, a request to check a status of the variable;
• determine, based on a response to the request, the station is under attack;
• and
• flag the station as under an attack.