Rogue Access Point Detection Using Peripheral Beacon Frame Cyclical Fingerprint in Real-time

Abstract

We propose a method to detect a rogue AP without any additional hardware in real-time. Differences beacon frame cycles between the access AP and other peripheral APs can be used to determine whether or not a rogue AP exists. Also, we describe how to find numerically the rogue APs. By using Mahalanobis distance, we show that it is possible to seperate them because normal beacon frames are distributed in the range 0 to 0.5, and rogue beacon frames are over the range 1.8 to 2.2.