Patent ID: 8752175
Filing Date: 2014-06-10
Classification: H04L,H04W

Abstract:
1. A method to detect network intrusion comprising: collecting a first log of packets in wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points (APs) and a second log of packets in network traffic from a switch port connected to the area, the first and second logs comprise at least one captured packet representing network traffic; pre-processing the first and second logs, including removing protocol overhead from the at least one captured packet in the first log and the at least one captured packet in the second log to obtain payload contents of the captured packets in the first and second logs; analyzing the payload contents of the captured packets in the pre-processed first log and the pre-processed second log to identify matching patterns, wherein sub-sequences of the at least one captured packet in the pre-processed first log are matched to sub-sequences of the captured at least one packet in the pre-processed second log; and generating a response based on a set of rules in response to an identification of matching patterns in the sub-sequences.