IEEE Consumer Electronics Magazine - March/April 2020 - 35

Media access control (MAC) addresses are
commonly used to control access in wireless
networks (hereafter referred to as MAC-based
access control), where only those devices that
have previously authorized MAC addresses
(i.e., MAC addresses are listed in a whitelist of
known good addresses) can connect to a wireless network. However, MAC-based access control has several limitations. For example,
maintaining an acceptable list of authorized
MAC addresses (i.e., a whitelist of MAC
addresses) is not only a cumbersome and challenging task for casual users, but tech-savvy
users can also change MAC address to bypass
this list quite easily.2
To address these limitations of MAC-based
defense mechanism, several researchers proposed device fingerprinting methods using physical properties of wireless signals, which are
usually hard to imitate. Faria and Cheriton3
describe a method that uses received signal
strength indicator (RSSI) to detect anomalous
access points (APs). They consider RSSI values
as a device specific feature that is hard to arbitrarily forge, and can accurately indicate the
location of a device. There are similar studies
focusing on using different statistical models,
e.g., Gaussian mixture model,4 K-means clustering,5 and spatial correlation property of RSSI.6
Most previous work has focused on developing a
proper probabilistic model to better understand
the actual characteristics of RSSI. However, such
approaches often rely on having access to multiple network traffic monitoring devices to
improve the overall reliability and accuracy.
This requirement might not be acceptable in
small network environments where only one AP
is available.
This article presents a framework to detect
device spoofing attack using the time series
similarity measure between subsequent packet
sequences. Unlike existing proposals (e.g., see
the work done by Faria et al.)3À6 that use fixed
threshold values, our scheme runs on dynamically changing threshold values to deal with
network conditions that change over time. To
demonstrate the effectiveness of our scheme,
we perform experiments with real world traffic
dataset under various conditions, showing the
F-measure accuracy of 0.96 when spoofed

March/April 2020

devices are located five or more meters away
from original devices.

ATTACK SCENARIO
Wireless networking is inherently prone to
cybersecurity threats. Unlike wired networks,
wireless networks can be discovered by anyone
nearby.
Due to such weaknesses in wireless networks, we assume that an attacker is capable of
connecting a malicious device to victim's home
devices (e.g., smart TV) by exploiting the victim's home network. This allows the attacker to
play recorded movies, view pictures, or copy
files from the victim's devices. The attacker may
also try to take control of critical functions on
various network-connected devices such as
CCTV, door locks, and thermostats.7 The data
link layer has security solutions such as WEP
and WPA, but these alone are not sufficient to
properly control access to such devices. Additional security mechanisms are needed at the
application layer to individually manage security
policies for each device.
One possible technique is to perform
access control based on identifiers that are
unique to devices. The most widely adopted
defense mechanism uses access control lists
(ACL) created for the network addresses of
known (authorized) devices. A network administrator defines security policies that allow
only the known devices to connect with their
IP and MAC addresses. MAC addresses are
more frequently used since it is relatively easier to spoof IP addresses.
However, several limitations exist in the
MAC-based access control mechanism. First, for
typical users, it is quite cumbersome and challenging to timely update the ACL with fresh MAC
addresses. If the coverage of the ACL is not sufficient, it can degrade the effectiveness of the ACL
and discourage users from deploying it. Furthermore, the practical security of MAC-based ACL is
weaker than expected because MAC addresses
can be spoofed. "MAC spoofing" can be easily
performed by a tool that experienced users can
download and use. Ahmad8 demonstrated that
an attack device connected to the same wireless
network can spoof and submit address resolution protocol replies to victim devices even if a

IEEE Consumer Electronics Magazine - March/April 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - March/April 2020