Detecting malicious device

A method for detecting a malicious device in a wireless local area network (WLAN) network by a wireless access point, the method comprising:

• initiating a malicious device detection mode;
• transmitting a test message to neighbor devices located within a service area of the wireless access point;
• determining whether a test response message is received from the neighbor devices in response to the test message;
• and
• if so, determining a corresponding neighbor device transmitting the test response message as a non-malicious device;
• otherwise, determining the corresponding neighbor device as a malicious device,
• wherein the transmitting a test message includes:
• detecting, among the neighbor devices, candidate devices that transmit a signal with a specific service set identifier (SSID);
• generating a predefined test bit sequence as the test message;
• including the predefined test bit sequence in an associate request message;
• and
• transmitting the associate request message to the detected candidate devices.

A wireless access point comprising:

• a controller configured to initiate a malicious device detection mode regularly at predefined intervals;
• a search unit configured to detect candidate devices broadcasting a signal with a first specific service set identifier (SSID) from neighbor devices in an associated network;
• a message generation unit configured to generate a predetermined test bit sequence as a test message in the malicious device detection mode, include the predetermined test bit sequence in an associated request message, and transmit the associated request message as the test message to the detected candidate devices;
• a determination unit configured to determine a corresponding device in the candidate device as a malicious device when a test response message is not received from the corresponding device in response to the test message;
• and
• a notification unit configured to notify the determined malicious device to a related server so as to block the determined malicious device from access to the associated network.