System and method for wireless local area network monitoring and intrusion detection

A computer-implemented method for detecting intrusions to a computer network, comprising:

• passively monitoring for network traffic received from an unknown wireless device, and upon detecting network traffic from the unknown wireless device:
• creating a device profile of the unknown wireless device;
• determining whether the unknown wireless device is an authorized device according to the device profile;
• and
• if the unknown wireless device is determined to be an authorized device, permitting the network traffic from the unknown wireless device to pass to the computer network.

A computer-readable medium having computer-executable instructions which, when executed, carry out the method for monitoring for detecting intrusions to a computer network, comprising:

• passively monitoring for network traffic received an unknown wireless device, and upon detecting network traffic from the unknown wireless device:
• creating a device profile of the unknown wireless device;
• determining whether the unknown wireless device is an authorized device according to the device profile;
• and
• if the unknown wireless device is determined to be an authorized device, permitting the network traffic from the unknown wireless device to pass to the computer network.

A system for detecting unauthorized wireless access points on a computer network, the system comprising:

• a security component residing on the computer network that:
• passively monitors for network traffic from an unknown wireless device;
• creates a device profile of the unknown wireless device;
• determines whether the unknown wireless device is, or may be, a wireless access point according to the device profile;
• if the unknown wireless device is, or may be, a wireless access point, compares the device profile of the unknown wireless device against device profiles of authorized wireless access points to determine whether the unknown wireless device is an authorized wireless access point;
• and
• if the unknown wireless device is not determined to be an authorized wireless access point, generates an alert that the unknown wireless device is or may be an unauthorized wireless access point.

A computer implemented method for detecting unauthorized wireless access points on a computer network, the method comprising:

• passively monitoring for network traffic from an unknown wireless device;
• and
• upon detecting network traffic from the unknown wireless device:
• creating a device profile of the unknown wireless device;
• determining whether the unknown wireless device is or may be a wireless access point according to the device profile;
• and
• if the unknown wireless device is or may be a wireless access point:
• comparing the device profile of the unknown wireless device against device profiles of authorized wireless access points to determine whether the unknown wireless device is an authorized wireless access point;
• and
• generates an alert that the unknown wireless device is, or may be, an unauthorized wireless access point if the unknown wireless device is not determined to be an authorized wireless access point.

A computer-readable medium having computer-readable instructions which, when executed, carry out a method for monitoring for and detecting unauthorized wireless access points, the method comprising:

• passively monitoring for network traffic from an unknown wireless device;
• and
• upon detecting network traffic from an unknown wireless device:
• creating a device profile of the unknown wireless device;
• determining whether the unknown wireless device is or may be a wireless access point according to the device profile;
• and
• if the unknown wireless device is or may be a wireless access point:
• comparing the device profile of the unknown wireless device against device profiles of authorized wireless access points to determine whether the unknown wireless device is an authorized wireless access point;
• and
• notifying a system administrator that the unknown wireless device is or may be an unauthorized wireless access point if the unknown wireless device is not determined to be an authorized wireless access point.