Abstract:
An analytics containment system store RSSI values of connected stations and corresponding time stamps. If two or more stations have RSSI values within a certain proximity within a certain time period, a first condition for identifying analytics poisoning has been satisfied. Additionally, if RSSI values for the two or more stations changes at similar rate, the stations have satisfied a second optional condition.

Description:
FIELD OF THE INVENTION 
       [0001]    The invention relates generally to Wi-Fi computer networking, and more specifically, to transferring calls between a cellular network to a Wi-Fi network at a specified quality. 
       BACKGROUND 
       [0002]    Mobile devices are becoming a standard accessory for people in commercial and business environments, as much as car keys and purses. In contrast to conventional accessories, mobile devices have the ability to communicate with WLANs and other networks while on the move. This communication allows entities to collect analytics about, for example, consumer behavior while in a store, from both an individual level and an aggregate level. As a result, WLAN powered analytics is a booming resource. 
         [0003]    Of course, new fronts in network technology also open up new vulnerabilities for exploitation from malicious hackers and processes. For example, one computing device can be configured to appear as several different stations by emulating multiple Wi-Fi network interface cards that are actually virtual. Each NIC card, having its own MAC address, can appear as a separate device to the network. In turn, analytics can be poisoned with the injection of false data. 
         [0004]    What is needed is a robust technique for detecting analytics poisoning attacks by identifying emulated stations from tracking RSSI (received signal strength indicator) values. 
       SUMMARY 
       [0005]    The above-mentioned shortcomings are addressed by an analytics containment system, methods and computer-readable media for tracking RSSI values of stations to identify emulated stations from multiple flows. 
         [0006]    In one embodiment, an analytics containment system store RSSI values of connected stations and corresponding time stamps. If two or more stations have RSSI values within a certain proximity within a certain time period, a first condition for identifying analytics poisoning has been satisfied. Additionally, if RSSI values for the two or more stations changes at similar rate, the stations have satisfied a second optional condition. 
         [0007]    A third optional condition is satisfied by observing RSSI values after handoffs between network devices. As a user moves between coverage ranges of different access points, the emulated stations will be handed off to different access points for reaching the backbone network. A centralized Wi-Fi controller in contact with each of the access points can detect movements between access points. In response, the analytics containment system can identify that the two or more stations are handed off around the same time which serves as additional evidence of emulated stations on a single physical device. 
         [0008]    A fourth optional condition is satisfied by applying heuristics to the data being collected. For example, if each of the two or more stations are injecting the same data into the system, for example, by all being associated with a single user account, all meeting the same requirement or goal, or any other situation in which multiple stations would skew analytics, the data injection can be suspicious. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]    In the following drawings, like reference numbers are used to refer to like elements. Although the following figures depict various examples of the invention, the invention is not limited to the examples depicted in the figures. 
           [0010]      FIG. 1  is a block diagram illustrating an analytics containment system for tracking RSSI values of stations to identify emulated stations for analytics poisoning, according to an embodiment. 
           [0011]      FIG. 2  is a more detailed block diagram illustrating an analytics server of  FIG. 1 , according to an embodiment. 
           [0012]      FIG. 3  is a flow chart illustrating a method tracking RSSI values of stations to identify emulated stations for analytics poisoning, according to an embodiment. 
           [0013]      FIG. 4  a more detailed flow chart illustrating the step of  FIG. 3  for tracking RSSI values to identify suspiciously correlated RSSI values between different stations, according to an embodiment. 
           [0014]      FIG. 5  is a block diagram illustrating an exemplary computing device, according to one embodiment. 
       
    
    
     DETAILED DESCRIPTION 
       [0015]    An analytics containment system, methods and computer-readable medium for tracking RSSI values of stations to identify emulated stations, is disclosed. 
         [0016]    Analytics Containment System ( FIGS. 1-2 ) 
         [0017]      FIG. 1  is a block diagram illustrating an analytics containment system  100  for tracking RSSI values of stations to identify emulated stations for analytics poisoning, according to an embodiment. The system  100  comprises an access points  110 A- 110 B, a Wi-Fi controller  120 , and stations  130 A- 130 B, each coupled to a network  199 . Additional network components can also be part of the system  100 , such as firewalls, virus scanners, routers, switches, application servers, databases, as well as additional controllers, access points, access switches, stations, SDN (Software-Defined Networking) controllers, Wi-Fi controllers, and the like. For instance, embodiments of the system  100  can be implemented in conjunction with a network security system, for example, the FortiGate Network Security platform by Fortinet of Sunnyvale, Calif. The network components can be implemented as hardware, software, or a combination of both. 
         [0018]    The access points  110 A- 110 B handle network traffic exchanges between the stations  130 A- 130 B (and other devices) and other network devices in communication with the network  199 . The access points  110 A- 110 B receive, store and analyze analytics data collected from the stations  130 A- 130 B, such as location. Other stored data can be related to station characteristics, capabilities, behaviors (e.g., user purchases and URL visits), and the like. RSSI values for different stations  130 A- 130 B are also collected and tracked, in particular, changes in RSSI values are tracked. When the RSSI values of two different stations remain connected, the access points  110 A- 110 B can raise a flag so that analytics data is treated suspiciously. As a result, corresponding analytics data can be ignored, discounted, quarantined, deleted, or allowed to process as usual. 
         [0019]    Another optional indicator of analytics poisoning is revealed by applying heuristics to the data being collected. For example, if each of the two or more stations are injecting the same data into the system, for example, by all being associated with a single user account, all meeting the same requirement or goal, or any other situation in which multiple stations would skew analytics, the data injection can be suspicious. 
         [0020]    In other operations, the access point  110  can perform standard operations such as BSSID (Blind Service Set Identifier) advertisement beacons. When a station responds to the beacon, as indicated by returning the BSSID, a connection request initiates a Wi-Fi connection between the access point  110  and station. In some network architectures, the controller  120  manages the multiple access points from a network-wide perspective, and provides network-wide tracking of RSSI data for stations. 
         [0021]    Physically, the access point  110  include one or more individual access points implemented in any of the computing devices discussed herein (e.g., see  FIG. 5 ). For example, the access point  110  can be an AP  110  or AP  433  (modified as discussed herein) by Meru Networks of Sunnyvale, Calif. A network administrator can strategically place the access point  110  for optimal coverage area over a locale. The access point  110  can, in turn, be connected to a wired hub, switch or router connected to the enterprise network (or an external network). In embodiment, access point functionality is incorporated into a switch or router. In another embodiment, the access point  110  is a virtual device. The access point  110  is set forth in more detail below with respect to  FIG. 2 . 
         [0022]    In other embodiments, the techniques described herein are implemented in a network device, which could be an access point. However, the network device can also be a controller, a router, a gateway, a server, or any other processor-driven device configured as described herein. 
         [0023]    The controller  120  provides a network-wide tracking of RSSID values for stations that move from access point to access point. For example, if the station  130 A moves from access point  110 A to access point  110 B, the latter does not have information from the former unless a bridge is completed by the controller  120 , having management processes over both devices. In one embodiment, the controller  120  can force a hand-off or roam of a suspicious station and reconfirm the closeness or RSSI values. 
         [0024]    The stations  130 A- 130 B are preferably mobile devices connected with a user (e.g., shopper), and can more generally comprise a smart phone, a personal computer, a network-enabled television or other appliance, tablet devices, and the like. Any processor-driven device capable of receiving multicast video streaming can also be a station. Of note, station  130 A includes two MACs  131 A and  132 , which can be two physical MAC cards or virtual MAC addresses implemented in software. The duality allows the station  130 A double up the analytics data, or with more MACs to triple, quadruple, or even worse. A user in conspiracy to collect additional data or who is unintentionally collecting additional data, degrades the integrity of aggregate data collections. On the other hand, the station  110 B has just a single MAC  131 B. One mechanism of poisoning attacks is guest Wi-Fi access which uses captive portal authentication at a maximum. 
         [0025]    Wireless components preferably use communication protocols such as IEEE 802.11 n and IEEE 802.11 ac wave 2, in addition to other protocols such as other IEEE 802.11s, IEEE 802.3, Bluetooth, 3G and 4G. The network can serve, for example, a business enterprise, a hospital or system of hospital, school, building, a private network, or the like. The enterprise network can provide access to a wide area network or the Internet in some embodiments. Alternatively, the network can be distributed over the Internet, in other embodiments. A combination of wired and wireless devices can be connected, as well as only wireless devices or only wired devices. The network can be, for example, the Internet, a cellular network, a larger wide area network to which the enterprise network is a smaller component of, or a combination of network types. 
         [0026]      FIG. 2  is a more detailed block diagram illustrating an analytics server of  FIG. 1 , according to an embodiment. The access point  110  (generically representing the access point  110 A and the access point  110 B) comprises an analytics collection module  210 , an RSSI tracking module  220 , and an analytics containment module  230 . Many other configurations are possible. Other modules and electronics can be included, such as those components shown in  FIG. 5 . The components can be implemented in hardware, software, or a combination of both. 
         [0027]    The analytics collection module  210  collects analytics data for various situations. One use case is tracking location. For example, locations of a user device can be tracked through a mall. Information is collected on, for example, how long the user device was located in certain stores. The data is valuable marketing data and behavior data for the store owners, that is more valuable as pristine data that has not been manipulated. The data can be locally or remotely stored and analyzed for various purpose. In one embodiment, the analytics collection module  210  is communicatively coupled to a processor, a network interface, and a memory of the access point  110 . 
         [0028]    The RSSI tracking module  220  receives RSSI values from stations connected to access points, along with a time stamp. The RSSI value is used as an indicator of distance away from access points because the RSSI value typically drops as stations move away and the RSSI value typically raises as stations move closer. If two stations that are supposed to be representative of different users with two physically independent devices, only in rare cases would RSSI values be tied together. In one case, a single user can carry two smartphones, or two users can remain in close proximity. Over time, however, there should be slight variations on RSSI values that exemplify the physical independence of devices. On the other hand, a single device, emulating multiple devices through multiple MAC cards or the like will retain closely correlated RSSI values virtual devices. A predetermined RSSI proximity threshold can determine the sensitivity of tracking (e.g., an RSSI difference of −1 dbm to −3 dbm can indicate suspicious activity), set either manually or automatically. In one example, the devices are tracked after being handed-off from one access point to another access point, as further verification of physical unity. If the suspicious condition is detected, a bit or signal is generated. In one embodiment, the RSSI tracking module  220  is communicatively coupled to the processor, and the analytics collection module  210 . 
         [0029]    In other embodiments, suspicion can be raised by a data flow from a station. In particular, a flow changing above a predetermined rate can be suspicious. A device type can indicate application access to flows, and more access can raise greater suspicion (e.g., laptop creating flow which is marked as Fitbit app). If a total invalid protocol or destination numbers is greater than a threshold for a given MAC address, its reliability can be reduced. An alternative RSSI value can be determined by using multiple RF chains. In more detail, many access points are now 3×3 and can be used to derive RSSI values to confirm suspicions. 
         [0030]    The analytics containment module  230  acts to prevent contamination of the analytics collected by the analytics collection module  210 . Responsive to detection of suspicious RSSI value correlations, the corresponding analytics data from the two or more suspicious devices can be ignored, discounted, quarantined, or deleted. A notification can be sent to an administrator. In one embodiment, the analytics containment module  230  is communicatively coupled to the processor, and the RSSI tracking module  220 . 
         [0031]    Methods for Analytics Containment ( FIGS. 3-4 ) 
         [0032]      FIG. 3  is a flow chart illustrating a method  300  tracking RSSI values of stations to identify emulated stations for analytics poisoning, according to an embodiment. The process at a high-level is implementable by computer hardware, wherein individual components can perform individual steps of a method. 
         [0033]    In method  300 , analytics data is collected for several stations along with RSSI measurements and time stamps (step  310 ). RSSI values are tracked to identify suspiciously correlated RSSI values between different stations (step  320 ), an example of which is set forth below with respect to  FIG. 4 . An action is performed on analytics data corresponding to the suspiciously correlated RSSI values (step  330 ). 
         [0034]    One of ordinary skill in the art will recognize that the method  300  (and others) is non-limiting as other embodiments can have more or less steps and can be performed in a different order. The method  300  can be implemented in the system  100  of  FIG. 1  or in other components. 
         [0035]      FIG. 4  a more detailed flow chart illustrating the step  320  of tracking RSSI values to identify suspiciously correlated RSSI values between different stations, according to an embodiment. 
         [0036]    RSSI values for at least two stations is identified as being within a predetermined RSSI proximity threshold (step  410 ). The threshold can be different for different types of device pairs, and can be manually or automatically set. Changes in RSSI values are tracked (step  420 ). If the RSSI value changes remain within the predetermined RSSI proximity threshold (step  430 ), analytics data received from the at least two stations is identified (step  440 ). Otherwise the process continues. 
         [0037]    In some embodiments, the transmissions can switch if the number of multicast members crosses a threshold. In other embodiment, the threshold is automatically determined by an amount of processing resources necessary for a network device to maintain unicast conversions. In other words, processor loads, memory storage and packet latency can become strained with too many unicast conversions for a multicast stream. 
         [0038]    Generic Computing Device ( FIG. 5 ) 
         [0039]      FIG. 3  is a block diagram illustrating an exemplary computing device  300  for use in the system  100  of  FIG. 1 , according to one embodiment. The computing device  300  is an exemplary device that is implementable for each of the components of the system  100 , including the access points  110 A- 110 B, the controller  120  and the stations  130 A- 130 B. The computing device  300  can be a mobile computing device, a laptop device, a smartphone, a tablet device, a phablet device, a video game console, a personal computing device, a stationary computing device, a server blade, an Internet appliance, a virtual computing device, a distributed computing device, a cloud-based computing device, or any appropriate processor-driven device. 
         [0040]    The computing device  300 , of the present embodiment, includes a memory  310 , a processor  320 , a storage drive  330 , and an I/O port  340 . Each of the components is coupled for electronic communication via a bus  399 . Communication can be digital and/or analog, and use any suitable protocol. 
         [0041]    The memory  310  further comprises network applications  312  and an operating system  314 . The network applications  312  can include the modules of the access point  110  or other components. Other network applications  312  can include a web browser, a mobile application, an application that uses networking, a remote application executing locally, a network protocol application, a network management application, a network routing application, or the like. 
         [0042]    The operating system  314  can be one of the Microsoft Windows® family of operating systems (e.g., Windows 95, 98, Me, Windows NT, Windows 2000, Windows XP, Windows XP x64 Edition, Windows Vista, Windows CE, Windows Mobile, Windows 3 or Windows 8), Linux, HP-UX, UNIX, Sun OS, Solaris, Mac OS X, Alpha OS, AIX, IRIX32, or IRIX64. Other operating systems may be used. Microsoft Windows is a trademark of Microsoft Corporation. 
         [0043]    The processor  320  can be a network processor (e.g., optimized for IEEE 802.11), a general purpose processor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a reduced instruction set controller (RISC) processor, an integrated circuit, or the like. Qualcomm Atheros, Broadcom Corporation, and Marvell Semiconductors manufacture processors that are optimized for IEEE 802.11 devices. The processor  320  can be single core, multiple core, or include more than one processing elements. The processor  320  can be disposed on silicon or any other suitable material. The processor  320  can receive and execute instructions and data stored in the memory  310  or the storage drive  330   
         [0044]    The storage drive  330  can be any non-volatile type of storage such as a magnetic disc, EEPROM, Flash, or the like. The storage drive  330  stores code and data for applications. 
         [0045]    The I/O port  340  further comprises a user interface  342  and a network interface  344 . The user interface  342  can output to a display device and receive input from, for example, a keyboard. The network interface  344  (e.g. RF antennae) connects to a medium such as Ethernet or Wi-Fi for data input and output. 
         [0046]    Many of the functionalities described herein can be implemented with computer software, computer hardware, or a combination. 
         [0047]    Computer software products (e.g., non-transitory computer products storing source code) may be written in any of various suitable programming languages, such as C, C++, C#, Oracle® Java, JavaScript, PHP, Python, Perl, Ruby, AJAX, and Adobe® Flash®. The computer software product may be an independent application with data input and data display modules. Alternatively, the computer software products may be classes that are instantiated as distributed objects. The computer software products may also be component software such as Java Beans (from Sun Microsystems) or Enterprise Java Beans (EJB from Sun Microsystems). 
         [0048]    Furthermore, the computer that is running the previously mentioned computer software may be connected to a network and may interface to other computers using this network. The network may be on an intranet or the Internet, among others. The network may be a wired network (e.g., using copper), telephone network, packet network, an optical network (e.g., using optical fiber), or a wireless network, or any combination of these. For example, data and other information may be passed between the computer and components (or steps) of a system of the invention using a wireless network using a protocol such as Wi-Fi (IEEE standards 802.11, 802.11a, 802.11b, 802.11e, 802.11g, 802.11i, 802.11n, and 802.11ac, just to name a few examples). For example, signals from a computer may be transferred, at least in part, wirelessly to components or other computers. 
         [0049]    In an embodiment, with a Web browser executing on a computer workstation system, a user accesses a system on the World Wide Web (WWW) through a network such as the Internet. The Web browser is used to download web pages or other content in various formats including HTML, XML, text, PDF, and postscript, and may be used to upload information to other parts of the system. The Web browser may use uniform resource identifiers (URLs) to identify resources on the Web and hypertext transfer protocol (HTTP) in transferring files on the Web. 
         [0050]    This description of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form described, and many modifications and variations are possible in light of the teaching above. The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications. This description will enable others skilled in the art to best utilize and practice the invention in various embodiments and with various modifications as are suited to a particular use. The scope of the invention is defined by the following claims.