# US 2025/0097710 A1 · Defending against wi-fi spoofing attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097710 A1 - Document ID: US20250097710A1 - Status: Published application - Kind: A1 - Application number: 18/892,162 - Filed: 2024-09-20 - Published: 2025-03-20 - Earliest claimed: 2023-09-20 - Assignees: University of South Florida - Applicants: University of South Florida - Inventors: Xiao Han; Yao Liu; Zhuo Lu - Web page: https://patentgrep.com/patent/US20250097710A1 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In accordance with some embodiments, various examples of systems, methods, and media for detecting falsified Wi-Fi signals. A system detects a group of nearby access points (APs) broadcasting Wi-Fi signals. A determination is made whether the group of nearby APs contains at least one falsified Wi-Fi signal. Whenever it is determined that the group of nearby APs does contains at least one falsified Wi-Fi signal, an analysis is performed of each AP of the group of nearby APs. The analysis uses at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs. APs of the group of nearby APs are identified that are falsified. A mitigation action is initiated relative to the falsified APs that are identified. ## Claims ### Claim 1 A system for detecting falsified Wi-Fi signals, comprising: a network interface, including a transceiver configured to communicate via packetized information via a Wi-Fi protocol; a processor; and a memory having stored thereon a set of instructions which, when executed by the processor, cause the system to: detect a group of nearby access points (APs) broadcasting Wi-Fi signals; make a determination whether the group of nearby APs contains at least one falsified Wi-Fi signal; whenever it is determined that the group of nearby APs does contain at least one falsified Wi-Fi signal, perform an analysis of each AP of the group of nearby APs using at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs; identify which APs of the group of nearby APs is falsified; and initiate a mitigating action relative to the falsified APs that are identified. ### Claim 2 (depends on 1) The system of claim 1 wherein the instructions further cause the system to make a request to a localization service in relation to the group of nearby APs. ### Claim 3 (depends on 2) The system of claim 2, wherein the request is made as part of a determination on whether the group of nearby APs contains at least one falsified, and wherein the request includes a group of reference APs located at a known location different from the location of the group of nearby APs. ### Claim 4 (depends on 3) The system of claim 3, where an amount of reference APs in the group of reference APs is one less than an amount of nearby APs in the group of nearby APs. ### Claim 5 (depends on 3) The system of claim 3, wherein the group of reference APs is determined to coordinate with a known protocol of the localization service. ### Claim 6 (depends on 5) The system of claim 5, wherein the group of reference APs comprises a number, a location dispersant, or a signal strength attribute that, when processed by the localization service in combination with corresponding attribute of nearby, will product an expected result if there are no falsified nearby and an unexpected result if there are falsified nearby. ### Claim 7 (depends on 1) The system of claim 1, wherein identifying the false nearby APs is a different process than identifying whether at least one nearby AP is false. ### Claim 8 (depends on 7) The system of claim 7, wherein identifying the false nearby AP comprises performing a pair-wise comparison of locations corresponding to the group of nearby Aps. ### Claim 9 (depends on 8) The system of claim 8, wherein a plurality of AP pairs is grouped and sent to a geolocation server in a set of requests to identify and isolate any deviations from expected location and ascribe the deviations to a specific AP. ### Claim 10 (depends on 7) The system of claim 7, wherein the instructions further cause the system to perform an analysis on one or more physical layer attributes. ### Claim 11 (depends on 10) The system of claim 10, where the instructions further cause the system to identify a Doppler shift in said Wi-Fi signals. ### Claim 12 (depends on 1) The system of claim 1, wherein the mitigation action comprises at least one of: disconnect the transceiver from falsified APs or save information associated with falsified APs. ### Claim 13 A method for detecting falsified Wi-Fi signals, the method comprising: detecting a group of nearby access point (APs) broadcasting Wi-Fi signals; determining whether the group of nearby APs contains at least one falsified Wi-Fi signal; upon determining that the group of nearby APs does contain at least one falsified Wi-Fi signal, performing an analysis of each AP of the group of nearby APs using at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs; identifying which APs of the group of nearby APs is falsified; and initiating a mitigating action relative to the falsified APs that are identified. ### Claim 14 (depends on 13) The method of claim 13, further comprising: initiating a request to a localization servicer in relation to the group of nearby APs, wherein the request is made as a part of a determination on whether the group of nearby APs contains at least one falsified, and wherein the request includes a group of reference APs located at a known location different from the location of the group of nearby APs. ### Claim 15 (depends on 14) The method of claim 14, further comprising: determining the group of reference APs to coordinate with a know protocol of the localization service, wherein the group of reference APs comprises a number, a location dispersant, or a signal strength attribute that, when processed by the localization service in combination with corresponding attribute of nearby, will product an expected result if there are no falsified nearby and an unexpected result if there are falsified nearby. ### Claim 16 (depends on 13) The method of claim 13, wherein identifying the false nearby APs is a different process than identifying whether at least one nearby AP is false. ### Claim 17 (depends on 16) The method of claim 16, further comprising: grouping a plurality of AP pairs; sending the grouped plurality of AP pairs to a geolocation server in a set of requests; and identifying and isolating any deviations from expected location and ascribe said deviations to a specific AP. ### Claim 18 (depends on 16) The method of claim 16, further comprising: performing an analysis on one or more physical layer attributes. ### Claim 19 (depends on 18) The method of claim 18, further comprising: identifying a Doppler shift in said Wi-Fi signals. ### Claim 20 (depends on 13) The method of claim 13, wherein the mitigation action comprises at least one of: disconnecting a transceiver from falsified APs or saving information associated with falsified APs.