Context aware intruder detection using WIFI MAC addresses
AssigneeSymantec Corporation
InventorsQiyan Wang, Anand Kashyap
Life of this patent
Estimating the term…
Abstract
A method and system for intruder detection is provided. The method includes generating a whitelist of media access control (MAC) addresses of a plurality of wireless devices that are acceptable in a detection zone of a wireless router and detecting, by the wireless router, a further wireless device. The method includes issuing a notification in response to absence, on the whitelist, of a media access control address of the further wireless device, the notification indicating a physical intruder within the detection zone, wherein at least one action of the method is performed by a processor in or coupled to the wireless router.
Claims20
A method for intruder detection, at least one action of the method performed by a processor in or coupled to a wireless router, the method comprising:
- generating a whitelist of media access control (MAC) addresses of a plurality of wireless devices that are acceptable in a detection zone of the wireless router, wherein the wireless router is configured to route data requested by wireless devices from a network to the wireless devices and route data, specified by users of the wireless devices, from the wireless devices to the network;
- automatically adding a MAC address of a first wireless device to the whitelist responsive to automatically detecting, by the wireless router, a second wireless device listed on the whitelist and the first wireless device not listed on the whitelist both simultaneously accompanying one another in the detection zone of the wireless router for longer than a threshold time period;
- detecting, by the wireless router, a third wireless device;
- and
- issuing a notification in response to absence, on the whitelist, of a MAC address of the third wireless device, the notification indicating a physical intruder within the detection zone.
A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:
- extracting a media access control (MAC) address, via a wireless router, from each of at least one wireless device, during a learning mode, wherein the wireless router is configured to route data from a network to wireless devices and route data from the wireless devices to the network as directed by users of the wireless devices;
- writing the MAC address of each of the at least one wireless device to a whitelist;
- automatically placing the wireless router in an intruder detection mode during a reoccurring time period responsive to automatically detecting, by the wireless router, a first wireless device listed on the whitelist having a pattern of being idle during the reoccurring time period;
- extracting a MAC address, via the wireless router, from a second wireless device, during the intruder detection mode;
- determining whether the MAC address of the second wireless device is included in the whitelist;
- and
- issuing an alert responsive to determining that the MAC address of the second wireless device is not included in the whitelist.
An intruder detection system, comprising:
- a wireless router, configured to route data from a network to wireless devices and route data directed by users of the wireless devices from the wireless devices to the network and configured to detect the wireless devices within a detection zone of the wireless router;
- a media access control (MAC) address monitor, configured to obtain MAC addresses of the detected wireless devices;
- a notification module configured to issue a notification in response to being triggered;
- a memory, configured to store a whitelist;
- and
- an analytics module, configured to:
- add a MAC address of a first wireless device detected within the detection zone during a training time to the whitelist;
- automatically add a MAC address of a second wireless device to the whitelist responsive to automatically detecting, by the wireless router, the first wireless device listed on the whitelist and the second wireless device not listed on the whitelist both simultaneously accompanying one another in the detection zone of the wireless router for longer than a threshold time period;
- automatically place the wireless router in an intruder detection mode during a reoccurring time period responsive to automatically detecting, by the wireless router, the first wireless device listed on the whitelist having a pattern of being idle during the reoccurring time period;
- and
- trigger the notification module responsive to the MAC address monitor obtaining a MAC address of a third wireless device detected within the detection zone during the intruder detection mode and not on the whitelist.
Dependencies are inferred from the claim text.