JP2022131667A - Wips sensor, wireless communication system, wireless intrusion prevention method, and wireless intrusion prevention program - Google Patents

Abstract

To prevent the intrusion of an unauthorized terminal while suppressing an increase in the processing load of a wireless access point.SOLUTION: A WIPS sensor 1 includes a wireless monitoring unit 13 and a wireless transmission unit 14. The wireless monitoring unit 13 monitors a wireless communication environment. After the wireless monitoring unit 13 detects a probe request transmitted by an unauthorized terminal 60x to attempt wireless connection to a normal wireless access point 50, the wireless transmission unit 14 transmits a false recognition induction probe response for making the unauthorized terminal 60x falsely recognize that connection with the wireless access point 50 is impossible.SELECTED DRAWING: Figure 1

Description

The present invention relates primarily to WIPS sensors. WIPS is an abbreviation for Wireless Intrusion Prevention System.

WIPS sensors are sometimes used to improve the security of wireless networks. A WIPS sensor detects terminals communicating with a wireless access point in violation of security and blocks the communication.

Conventionally, a WIPS sensor could act as a violating terminal and transmit a communication frame indicating a connection termination request to the wireless access point, thereby making the wireless access point cut off the connection to the terminal. As such a communication frame, a deauthentication frame (Deauthentication) or an association release frame (Disassociation) called a management frame is used.

However, in the IEEE 802.11w standard, which has recently emerged, management frames are protected by shared key encryption in communication between wireless access points and wireless communication terminals. Therefore, conventional methods of sending de-authentication or de-association frames cannot be used in the new standard. Note that the IEEE802.11w standard is a communication standard that applies security (encryption) to management frames, which were not subject to encryption and authentication in the past.

This point is also pointed out in Patent Document 1, and the following configuration is proposed to solve this. That is, when the WIPS sensor of Patent Document 1 detects that a violating terminal has connected to a wireless access point, the WIPS sensor sets the MAC address of the violating terminal to its own sensor. Send a connection request. In response to a new connection request from the WIPS sensor, the wireless access point disconnects the existing connection for the MAC address, allocates a new shared key for encrypting communication frames, and starts communication with the WIPS sensor. do. As a result, in the wireless access point, a new shared key is substantially set for the MAC address of the offending terminal. As a result, the connection between the wireless access point and the violating terminal can be cut off.

Japanese Patent Publication No. 2018-511282

In the configuration of Patent Literature 1, a legitimate wireless access point must perform disconnection processing and re-authentication in order to block communication of a violating terminal. Therefore, there is still room for improvement from the viewpoint of reducing the processing load of authorized wireless access points.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and an object of the present invention is to prevent an unauthorized terminal from intruding while suppressing an increase in the processing load of a wireless access point.

Means and Effects for Solving Problems

The problems to be solved by the present invention are as described above. Next, the means for solving the problems and the effects thereof will be described.

A first aspect of the present invention provides a WIPS sensor having the following configuration. That is, the WIPS sensor includes a wireless monitor and a wireless transmitter. The radio monitoring unit monitors a radio communication environment. The wireless transmission unit determines that connection with the wireless access point is impossible after the wireless monitoring unit detects a probe request transmitted by the unauthorized terminal to attempt wireless connection to the authorized wireless access point. Send a misidentification guidance probe response to misidentify an unauthorized terminal.

This makes it possible to prevent unauthorized terminals from intruding into the wireless network with a simple configuration. In addition, since wireless intrusion is prevented by guiding an unauthorized terminal to stop attempting wireless connection with the wireless access point, it is possible to suppress an increase in the processing load on the wireless access point.

In the WIPS sensor, it is preferable that at least one of the SSID and RSNE is missing or false information is described in the misleading probe response transmitted by the wireless transmission unit.

As a result, an unauthorized terminal can be misidentified as to important information related to communication. Therefore, it is possible to reliably prevent unauthorized terminals from intruding into the wireless network.

An SSID different from the SSID of the legitimate wireless access point can be described in the misidentification induction probe response. Alternatively, the SSID information can be substantially omitted.

This makes it possible for the unauthorized terminal to misunderstand that the SSID of the wireless access point does not match the SSID expected by the unauthorized terminal.

In the RSNE of the misleading probe response, a reserved value can be described for at least one of the authentication key management method and the encryption method. Alternatively, an authentication key management method that the authorized wireless access points do not support can be described as an authentication key management method. Also, an encryption method that is not supported by the authorized wireless access points can be described as an encryption method.

As a result, if the authentication key management method or the encryption method that the wireless access point can support is unknown to the unauthorized terminal or does not meet its own expectations, the unauthorized terminal can be misled.

A second aspect of the present invention provides a wireless communication system comprising the WIPS sensor and the wireless access point.

A third aspect of the present invention provides the following wireless intrusion prevention method. That is, this wireless intrusion prevention method includes a monitoring step and a false recognition induction step. The monitoring step monitors the wireless communication environment. In the misidentification inducing step, if the monitoring step detects a probe request sent by an unauthorized terminal to attempt wireless connection to a legitimate wireless access point, it is determined that connection with the wireless access point is impossible. Send a misidentification guidance probe response to misidentify an unauthorized terminal.

According to a fourth aspect of the present invention, there is provided a wireless communication blocking program having the following configuration. That is, this wireless communication blocking program causes a computer having a wireless communication unit to execute a monitoring step and a misrecognition guiding step. The monitoring step monitors the wireless communication environment. In the misidentification inducing step, if the monitoring step detects a probe request sent by an unauthorized terminal to attempt wireless connection to a legitimate wireless access point, it is determined that connection with the wireless access point is impossible. Send a misidentification guidance probe response to misidentify an unauthorized terminal.

1 is a schematic diagram showing the configuration of a wireless communication system according to an embodiment of the present invention; FIG. FIG. 5 is a diagram for explaining an SSID element in a probe response frame; FIG. 10 is a diagram for explaining RSNE in a probe response frame; 4 is a flow chart showing the processing performed in the WIPS sensor.

Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a schematic diagram showing the configuration of a radio communication system 100. As shown in FIG.

A wireless communication system 100 shown in FIG. 1 includes a wireless access point 50 and a plurality of wireless communication terminals 60 . The wireless access point 50 functions as an access point in infrastructure mode defined in IEEE802.11.

The wireless access point 50 forms a wireless network around itself. The wireless access point 50 performs communication using wireless signals (radio waves) with each of the wireless communication terminals 60 existing in the wireless communicable area. This wireless network is used, for example, for wireless LANs. Below, the access point may be abbreviated as AP.

The radio communication terminal 60 is a so-called radio communication station. STA in FIG. 1 is an abbreviation for a station. The wireless communication terminal 60 is configured by, for example, a smart phone, a tablet terminal, or a personal computer. The wireless communication terminal 60 can be realized, for example, by equipping the terminal with a wireless communication module.

A wireless communication system 100 includes a WIPS sensor 1 . The WIPS sensor 1 includes a device information storage section 11 , an AP communication setting storage section 12 , a wireless monitoring section 13 and a wireless transmission section 14 . The wireless monitoring unit 13 and wireless transmission unit 14 function as a wireless communication unit.

Specifically, the WIPS sensor 1 incorporates a known computer. This computer includes a CPU, ROM, RAM, and the like. The ROM and RAM constitute a storage unit that stores various information regarding the wireless communication system 100 . The storage unit consists of a non-volatile memory and a volatile memory. The nonvolatile memory stores a wireless intrusion prevention program and the like for realizing the wireless intrusion prevention method of the present invention. The computer can be operated as the device information storage unit 11, the AP communication setting storage unit 12, the wireless monitoring unit 13, and the wireless transmission unit 14 by cooperation of the above hardware and software.

The non-volatile memory stores information necessary for operating the above program, such as the SSID of the wireless access point 50 and the AP identification number (for example, MAC address). SSID is an abbreviation for Service Set Identifier. MAC is an abbreviation for Media Access Control. Volatile memory mainly stores temporary data for operating programs.

The device information storage unit 11 can store identification information for specifying the authorized wireless access point 50 and the authorized wireless communication terminal 60 . For example, a MAC address can be used as this identification information, but it is not limited to this.

The AP communication setting storage unit 12 can store information related to channels and encryption settings used by the wireless access point 50 . This information is used, for example, to generate a misleading probe response, which will be described later.

The wireless monitoring unit 13 monitors the surrounding wireless environment in compliance with a predetermined wireless communication standard. For example, IEEE802.11ac can be considered as the wireless communication standard, but it is not limited to this. The wireless monitoring unit 13 is configured as a packet capture, and constantly receives packets that are actually wirelessly communicated on the network.

The wireless monitoring unit 13 analyzes the acquired wireless communication packets substantially in real time. This makes it possible to quickly detect unauthorized communication performed by wireless communication terminals that have not been registered in advance. Hereinafter, a terminal that attempts wireless communication with the network of the wireless access point 50 and the wireless communication terminal 60 without prior permission may be referred to as an unauthorized terminal 60x.

The wireless transmission unit 14 generates and transmits a misleading probe response to the unauthorized terminal 60x. A misleading probe response is a special probe response, the details of which will be described later. Originally, the probe response should be transmitted by the wireless access point 50, but the WIPS sensor 1 transmits a misidentification-inducing probe response and causes the unauthorized terminal 60x to receive it. You can encourage them to stop. Communication is performed in a manner conforming to the wireless communication standards described above.

Next, wireless communication between the wireless access point 50 of this embodiment and the authorized wireless communication terminal 60 will be briefly described.

The wireless access point 50 and the wireless communication terminal 60 perform wireless communication by transmitting and receiving radio waves to and from each other after performing connection processing according to normal procedures. The connection process is performed according to IEEE802.11, which is a well-known wireless LAN-related standard. Briefly describing an example of the connection procedure, the wireless communication terminal 60 wirelessly transmits a MAC frame called a probe request to its surroundings in order to learn about wireless communication devices existing in the surroundings. The wireless access point 50 that has received this wirelessly transmits a MAC frame called a probe response as a reply.

Although the details will be described later, the probe response describes the SSID and security method information. Based on the probe response received from the wireless access point 50, the wireless communication terminal 60 determines whether it can connect to the wireless access point.

After that, MAC frames for authentication and association are wirelessly exchanged between the wireless communication terminal 60 and the wireless access point 50 to establish a connection.

Next, operations of the radio monitoring unit 13 and the radio transmitting unit 14 will be described in detail.

Consider a case where an unauthorized terminal 60x attempts to communicate with the wireless access point 50 when a wireless communication network is configured between the wireless access point 50 and the wireless communication terminal 60. FIG. The unauthorized terminal 60x may be brought in from the outside, and its operation is unknown, but it is assumed to operate in the same manner as the authorized wireless communication terminal 60. FIG.

When the unauthorized terminal 60x transmits a probe request to the wireless access point 50, the authorized wireless access point 50 transmits a normal probe response.

The WIPS sensor 1 detects that the unauthorized terminal 60 x has sent a probe request to the wireless access point 50 . Specifically, the WIPS sensor 1 determines whether or not the wireless packet acquired by the wireless monitoring unit 13 is a probe request to the wireless access point 50 . As a result of this determination, if the packet is a probe request, it is determined whether or not the identification information (for example, MAC address) of the requester included in this packet is included in the list of authorized wireless communication terminals 60. judge. This list is stored in the device information storage unit 11 by pre-registering the WIPS sensor 1 . If the identification information of the requesting source of the probe request is not included in the registration list, it can be determined that the probe request is from the unauthorized terminal 60x.

When the transmission of the probe request from the unauthorized terminal 60x is detected, the wireless transmission unit 14 transmits a probe response different from the information expected by the unauthorized terminal 60x to the authorized wireless access point 50. FIG. This probe response is disguised as if at least one of the operations and functions of the wireless access point 50 does not meet the requirements of the unauthorized terminal 60x, and is intended to mislead the unauthorized terminal 60x. is generated by Hereinafter, this probe response may be referred to as a misidentification induction probe response.

The unauthorized terminal 60x receives a normal probe response from the wireless access point 50 and a probe response from the WIPS sensor 1 (misidentification guidance probe response). It is expected that the unauthorized terminal 60x that receives the misleading probe response determines that it cannot connect to the wireless access point 50 and voluntarily cancels the connection to the wireless access point 50. FIG. As described above, communication between the unauthorized terminal 60x and the wireless access point 50 can be substantially blocked.

Various misidentification guidance probe responses that the WIPS sensor 1 transmits to the unauthorized terminal 60x are conceivable. Each of the multiple examples is described below.

[1] By rewriting the SSID element in the probe response frame to a fictitious one that does not uniquely indicate the wireless access point 50, a misidentification-inducing probe response can be generated. The SSID is a well-known identifier (variable-length character string) that is predetermined to uniquely identify the wireless access point 50, although not described in detail.

The specifications of the SSID element are defined as shown in FIG. As shown in FIG. 2, the probe response frame is composed of various frame elements such as Timestamp. The SSID element is a kind of frame element. The SSID element is composed of an "Element ID" field, a "Length" field, and an "SSID" field.

“Element ID” describes a unique value indicating that the frame element is an SSID element. "Length" describes the data length of the "SSID" field, which is the field following the field. In the “SSID” field, a character string of the SSID of the wireless access point 50 is normally written.

In a normal probe response transmitted by the wireless access point 50, the SSID set in the wireless access point 50 is described in the "SSID" field. On the other hand, in the misidentification guidance probe response, a character string different from the SSID set in the wireless access point 50 is described in the "SSID" field. A random character string generated by the WIPS sensor 1, for example, can be used as the SSID of the misleading probe response.

Although FIG. 1 shows a case where there is only one wireless access point 50, a case where a plurality of wireless access points 50 are installed is also conceivable. In order to avoid spreading the influence, it is preferable that the SSID of the misleading probe response does not match the SSID of any wireless access point 50 .

[2] In the SSID element of the probe response, "Length" may be set to 0 and the "SSID" field may be set to an empty string.

[3] The SSID element itself may be removed from the probe response.

In any of the cases [1], [2], and [3] given as examples, the unauthorized terminal 60x that has received this misidentification guidance probe response uses the SSID stored as a connection destination candidate and the misidentification guidance probe and the SSID included in the response. Since the SSIDs do not match, unauthorized terminal 60x will stop trying to connect to wireless access point 50. FIG.

[4] By rewriting the authentication key management method list field of the RSNE in the frame of the probe response to a fictitious one that does not reflect the function of the wireless access point 50 (for example, zero meaning "reserved value"), misidentification A induced probe response can be generated. RSNE is an abbreviation for Robust Security Network Element.

The specifications of RSNE are defined as shown in FIG. RSNE is a kind of frame element, like the SSID element described above. The RSNE includes an "Element ID" field, a "Length" field, a data encryption method list field, an authentication key management method list field, and a management frame encryption method field.

“Element ID” describes a unique value indicating that the frame element is an RSNE. "Length" describes the total value of the data length of each field following the field in question. In the data encryption method list field, a list of numbers indicating data encryption methods (Pairwise Cipher Suite) that the wireless access point 50 is compatible with is normally described. In the authentication key management method list field, a list of numbers indicating authentication and key management methods (Authentication Key Management Suite) that the wireless access point 50 is compatible with is normally described. In the management frame encryption method field, a number indicating the encryption method (Group Management Cipher Suite) used to protect the management frame performed in the wireless access point 50 is normally described.

In a normal probe response transmitted by the wireless access point 50, the authentication key management method list field describes the number of the authentication key management method that the wireless access point 50 can actually support. Then, in the authentication key management method list field, information that is not an authentication key method that the wireless access point 50 can actually support is described. Instead of writing zero, which means a reserved value, in this field, a value indicating another authentication key management method that is not expected by the unauthorized terminal 60x may be written.

[5] In the RSNE of the frame body, zero indicating a reserved value may be described in the data encryption method list field. Instead of the reserved value (zero), a value indicating another encryption scheme that is not expected by the unauthorized terminal 60x may be described.

[6] In the RSNE of the frame body, zero indicating a reserved value may be described in the management frame encryption method field. Instead of the reserved value (zero), a value indicating another encryption scheme that is not expected by the unauthorized terminal 60x may be described.

In any of the cases [4], [5], and [6] given as examples, the unauthorized terminal 60x that has received this misidentification-inducing probe response is unknown to itself, or uses a different authentication key management method or encryption from the request. It is determined that the wireless access point 50 adopts the encryption method. As a result, the unauthorized terminal 60x stops trying to connect to the wireless access point 50. FIG.

The timing at which the WIPS sensor 1 transmits the misidentification guidance probe response to the unauthorized terminal 60x is arbitrary as long as it is after the timing at which the unauthorized terminal 60x transmits the probe request. In this embodiment, the WIPS sensor 1 waits for the wireless access point 50 to send a normal probe response to the unauthorized terminal 60x in response to the probe request from the unauthorized terminal 60x, and immediately after that, sends a misleading probe response. By doing so, the information for connecting to the wireless access point 50 held by the unauthorized terminal 60x is reliably updated to the information (for example, SSID, etc.) included in the misidentification guidance probe response. As a result, the unauthorized terminal 60x will stop trying to connect to the wireless access point 50, and the certainty of blocking the communication of the unauthorized terminal 60x can be increased. After detecting the probe request from the unauthorized terminal 60x, the WIPS sensor 1 does not wait for the probe response to be transmitted from the wireless access point 50, but instead immediately performs multiple (for example, 10) misidentification inductions. A probe response may be sent. According to this, it is possible to increase the arrival rate of the misidentification-inducing probe response to the unauthorized terminal 60x, and to cause the unauthorized terminal 60x to receive the misidentification-inducing probe response both before and after the wireless access point 50 transmits the probe response. It is possible to increase the certainty of blocking the communication of the unauthorized terminal 60x.

Next, the processing performed in the WIPS sensor 1 will be described with reference to the flowchart of FIG.

When the process is started, the wireless monitoring unit 13 captures and analyzes surrounding wireless packets (step S101, monitoring step). Next, referring to the information stored in the device information storage unit 11, it is determined whether the acquired wireless packet is a probe request from the authorized wireless communication terminal 60 or a probe request from the unauthorized terminal 60x. is determined (step S102).

If the wireless packet is a probe request from the unauthorized terminal 60x (Yes in step S102), the WIPS sensor 1 determines whether the wireless monitoring unit 13 has detected a probe response transmitted by the wireless access point 50 in response to this probe request. It is determined whether or not (step S103). On the other hand, if the wireless packet is not a probe request from the unauthorized terminal 60x (No in step S102), the process returns to step S101. Further, in the WIPS sensor 1, when the wireless monitoring unit 13 detects a probe response transmitted by the wireless access point 50 in step S103 (Yes in step S103), the wireless transmission unit 14 immediately transmits a misidentification guidance probe response. (step S104, misrecognition guidance step). On the other hand, when the wireless monitoring unit 13 does not detect the probe response transmitted by the wireless access point 50 (No in step S103), the WIPS sensor 1 returns to step S103, and the wireless monitoring unit 13 detects the probe response from the wireless access point 50. Wait until detected.

With the above configuration, it is possible to block communication from the unauthorized terminal 60x while suppressing the processing load on the authorized wireless access point 50 compared to the conventional technology. Moreover, unauthorized communication can be prevented simply by retrofitting the WIPS sensor 1 without requiring special hardware and software in the existing wireless access point 50 and wireless communication terminal 60 .

As described above, the WIPS sensor 1 of this embodiment includes the wireless monitoring section 13 and the wireless transmission section 14 . The radio monitoring unit 13 monitors the radio communication environment. After the wireless monitoring unit 13 detects a probe request transmitted by the unauthorized terminal 60x to attempt wireless connection to the authorized access point, the wireless transmission unit 14 detects that the unauthorized terminal 60x cannot connect to the access point. generate and send a deceptive probe response to misidentify the

This makes it possible to prevent the unauthorized terminal 60x from intruding into the wireless network with a simple configuration. In addition, since wireless intrusion is prevented by guiding the unauthorized terminal 60x to stop attempting wireless connection with the wireless access point 50, an increase in the processing load on the wireless access point 50 can be suppressed.

In addition, in the WIPS sensor 1 of the present embodiment, at least one of the SSID and RSNE is missing or incorrect information is described in the misidentification induction probe response transmitted by the wireless transmission unit 14 .

As a result, the unauthorized terminal 60x can be misidentified as to important information related to communication, so that the intrusion of the unauthorized terminal 60x into the wireless network can be reliably prevented.

Further, in this embodiment, an SSID different from the SSID of the authorized wireless access point 50 is described in the misidentification induction probe response transmitted by the WIPS sensor 1 . Alternatively, the SSID information is substantially missing in the misleading probe response.

This makes it possible for the unauthorized terminal 60x to misunderstand that the SSID of the wireless access point 50 does not match the SSID expected by the unauthorized terminal 60x.

Further, in the present embodiment, in the RSNE of the misleading probe response transmitted by the WIPS sensor 1, a reserved value is described as a number indicating the authentication key management method or the encryption method. Alternatively, the RSNE describes an encryption method or an authentication key management method that the authorized wireless access point 50 does not support.

As a result, if the authentication key management method or encryption method that the wireless access point 50 is compatible with is unknown to the unauthorized terminal 60x or does not meet its own expectations, the unauthorized terminal 60x can be misidentified.

Although the preferred embodiments of the present invention have been described above, the above configuration can be modified, for example, as follows.

In the above-described embodiment, the misidentification-inducing probe response is obtained by the wireless monitoring unit 13 of the WIPS sensor 1 receiving a normal probe response sent by the wireless access point 50 to the unauthorized terminal 60x, and referring to the content of the normal probe response. It is generated by rewriting the part. This simplifies the processing in the WIPS sensor 1 . However, the WIPS sensor 1 side can also generate a misleading probe response without referring to the contents of a normal probe response.

The WIPS sensor 1 may have the ability to communicate with the wireless access point 50, for example wirelessly. For example, the WIPS sensor 1 may acquire the contents of the device information storage unit 11 and the AP communication setting storage unit 12 (in particular, a list of authorized wireless communication terminals 60) through communication with the wireless access point 50. can be done. In this case, it is possible to reduce the trouble of setting the WIPS sensor 1 .

Further, the WIPS sensor 1 may transmit the misidentification guidance probe response only once, or may transmit it multiple times at appropriate time intervals.

INDUSTRIAL APPLICABILITY The present invention can be applied to existing wireless access points and wireless communication terminals that are widely used in the industry, and can be applied to wireless communication systems that prevent unauthorized communication without requiring special hardware and software. For example, it is useful for wireless intrusion prevention systems.

1 WIPS sensor 13 wireless monitoring unit 14 wireless transmission unit 50 wireless access point 60 wireless communication terminal 60x unauthorized terminal 100 wireless communication system

Claims (10)

a wireless monitoring unit that monitors a wireless communication environment;
To cause the unauthorized terminal to misunderstand that connection with the wireless access point is impossible after the wireless monitoring unit detects a probe request sent by the unauthorized terminal to attempt wireless connection to the authorized wireless access point. A wireless transmission unit that transmits a misidentification induction probe response of
A WIPS sensor comprising: A WIPS sensor according to claim 1, comprising:
A WIPS sensor according to claim 1, wherein at least one of an SSID and an RSNE is missing or incorrect information is described in the misidentification induction probe response transmitted by the wireless transmission unit. A WIPS sensor according to claim 2, wherein
A WIPS sensor according to claim 1, wherein an SSID different from the SSID of the authorized wireless access point is described in the misidentification induction probe response. A WIPS sensor according to claim 2, wherein
A WIPS sensor, wherein SSID information is substantially absent in the misleading probe response. A WIPS sensor according to claim 2, wherein
A WIPS sensor, wherein a reserved value is described for at least one of an authentication key management method and an encryption method in the RSNE of the misleading probe response. A WIPS sensor according to claim 2, wherein
A WIPS sensor, wherein an authentication key management method not supported by the authorized wireless access point is described as an authentication key management method in the RSNE of the misidentification induction probe response. A WIPS sensor according to claim 2, wherein
A WIPS sensor as claimed in claim 1, wherein an encryption method not supported by the authorized wireless access point is described as an encryption method in the RSNE of the misidentification induction probe response. a WIPS sensor according to any one of claims 1 to 7;
the wireless access point;
A wireless communication system comprising: a monitoring step of monitoring the wireless communication environment;
To cause the unauthorized terminal to misunderstand that connection with the authorized wireless access point is impossible when the probe request sent by the unauthorized terminal to attempt wireless connection to the authorized wireless access point is detected in the monitoring step. a misleading step of sending a misleading probe response of
A wireless intrusion prevention method comprising: A computer equipped with a wireless communication unit,
a monitoring step of monitoring the wireless communication environment;
To cause the unauthorized terminal to misunderstand that connection with the authorized wireless access point is impossible when the probe request sent by the unauthorized terminal to attempt wireless connection to the authorized wireless access point is detected in the monitoring step. a misleading step of sending a misleading probe response of
A wireless intrusion prevention program characterized by executing

Images