Patent Description:
An evil twin access point impersonates a legitimate access point by copying the identifier of the legitimate access point. For example, the evil twin may copy and broadcast a MAC address and/or SSID of the legitimate access point on the network. Because the evil twin is designed to blend in with legitimate network infrastructure, they are often difficult for network administrators to discover. The evil twin may also periodically shift which legitimate access point it is impersonating to further frustrate detection attempts. Finally, the evil twin may be transitory - that is, the nefarious user behind the evil twin may leave the area with the evil twin to avoid detection after securing the information they are looking for. The difficulty in mitigating these attacks is exacerbated in large corporate environments where there may be hundreds or thousands of access points to monitor over a large area. Documents <CIT>, <CIT> constitute relevant prior art in this field.

Disclosed in some examples are methods, systems, devices, and machine-readable mediums that detect evil twin and other anomalous access points in an IT infrastructure by detecting access points that are not in their expected locations based upon an analysis of access point reports from one or more computing devices. Computing devices may be end user computing devices that send access point reports to a network-accessible fraud detection service as they move from place to place or as they scan for access points. The reports may comprise a list of access points scanned by the computing devices and in some examples, measurements of the radio signal broadcast from those access points and/or the location of the computing device.

The fraud detection service may maintain access point positioning data that describes positioning information (such as an expected position) of each access point in the network. The positioning data of each access point may be a specific location such as geolocations or may be less specific locations such as probabilities of observing a particular access point given that one or more other access points are observed. The positioning data may be entered by an administrator or created automatically from a plurality of reports from a plurality of computing devices. Based upon the access point reports and the positioning data, the fraud detection service may determine that an observed location of an access point does not match an expected location of the access point. Access points where the observed location does not match an expected location may be flagged as potentially anomalous (e.g., the identification seen may indicate an evil twin is operating on the network). Computing devices that provide reports may be wireless stations or other access points.

In some examples, the reports sent by the computing devices may include measurements of the radio channel between the computing devices and the access points as well as a geolocation of the computing device. Using these measurement reports, the system may calculate observed locations of the access points visible to a computing device. To determine these locations, multiple computing devices may send reports to a fraud detection device. Each report may include the location of the computing device (e.g., obtained from a Global Navigation Satellite System (GNSS) such as a Global Positioning System (GPS) sensor, or other location based technology), the list of access points that are visible from the computing device, and a measurement of the signal or channel between the computing device and the access point (e.g., a Received Signal Strength - RSSI - a round trip time (RTT), and the like). Using these reports the fraud detection service may utilize trilateration to determine an observed position of the access points. The observed locations of the access points may be compared to an expected location from the access point positioning data. The expected location may be entered by an administrator or determined through reports from users during an initial learning period when the system (or an access point) comes online. For each visible access point a variance of the observed position to the expected position that is greater than a threshold may be flagged as anomalous.

In other examples, the reports may not include the measurements of the radio channel between the computing device and the visible access points. The location of the computing device in the report may be utilized to create a set of access points from the access point positioning data that are likely to be visible from the location of the computing device. Access points that are visible but are not in the set of access points that are likely to be visible may be flagged as potentially anomalous. The set of access points that are likely visible may be created in a number of ways. For example, by including access points in the list of access point locations that are within a threshold distance of the computing device.

In other examples, the report may not include the measurement data or the position of the computing device. The access point positioning data may include data that allows for determining a probability that a given access point is visible given a set of other visible access points (e.g., access point co-occurrence). The access point positioning data may be created based upon past reports from computing devices. The current set of visible access points may be utilized along with the access point positioning data to calculate a set of current probabilities. For example, if a computing device reports access points A, B, C, and D as visible from the computing device's current location, the system may calculate the probabilities of: seeing A given B, C, and D (e.g., P(A|B,C,D); seeing B given A, C, and D (e.g., P(B|A,C,D); seeing C given A, B, and D (e.g., P(C|A,B,D); seeing D given A, B, and C (P(D|A,B,C)). Any probability of seeing a particular access point that is below a threshold probability may cause the particular access point to be flagged. Thus, if P(C|A,B,D) < threshold, C may be labeled as anomalous.

In still other examples, the reports may include the positioning of the computing device, no measurement data, and the access point positioning data may include geolocations. The fraud detection system may calculate a center access point (e.g., a centroid of the cluster of access points reported as visible) of the set of visible access points and a set of expected access points may include all access points in the set of access points that are within a predetermined threshold distance of the center access point. Access points in the visible set of access points but not the expected set may be flagged as potentially anomalous.

For situations in which the computing device cannot position itself (e.g., in a building or other structure), but can provide measurement data and where the access point positioning data includes geolocations, the fraud detection system may calculate a position by iteratively using all combinations of three of the set of visible access points in a trilateration algorithm. A particular access point that is not where it is expected to be may be determined based upon an error of the trilateration equations such as where the trilateration does not converge on a solution, or where the error exceeds a threshold. For example, if A, B, C, and D are visible to the computing device, and the solutions for A, B, and C converge (or the error is acceptable), but the solutions for any trilateration involving D do not converge or have error that is above a threshold may indicate that D is anomalous.

In some examples, the error may be based upon the trilateration equations, but in other examples, the error may be based upon the positions calculated by the fraud detection system. For example, if A, B, C, and D are visible, then there are four combinations of three access points: (A, B, C); (A, B, D); (A, C, D); (B,C,D). A position may be calculated using trilateration for each combination of three access points. An average or centroid position among the four positions may be calculated and the error may be the distance between each position and the average or centroid. If this distance exceeds a threshold the access point may be labeled as anomalous.

As previously noted, the access point positioning data may store specific locations (e.g., a specific geolocation, a building, an address, or the like) or may store relative locations (e.g., access points A and B are near each other, or probabilities of access point co-occurrences). The access point locations may be input by an administrator (e.g., a table of access point identifiers and locations), may be determined by crowd-sourced scans taken by computing devices, and the like. For example, as computing devices (STA or other APs) scan for other access points, they may send reports of the list of access points that are visible to the fraud detection service. The fraud detection system may use these scans to train a model that determines probability associations or clusters that indicate the probability that an access point would be visible given that other access points are visible.

Additionally, other indicators of anomalous access points may be monitored, such as multiple access points with the same identifier seen in a scan. For example, if the computing device determines that multiple access points having a same identifier are present in the scan, the fraud detection service may mark both as potentially anomalous.

In some examples, a fraud score may be tabulated for each access point. Every time the access point is marked as anomalous, the fraud detection system may increase the fraud score of the associated access point identifier. If the fraud score passes a particular threshold fraud score the access point may be labelled as compromised and corrective action may be taken.

In some examples, the fraud detection service may take one or more confirmation actions upon determining that an AP is anomalous or compromised. For example, through wired communication with the legitimate access point with the same identifiers as the anomalous or compromised AP, the fraud detection service may request the legitimate AP to broadcast a code in its beacon. The computing device that reported the anomalous AP may be requested to scan for the beacon from the potentially anomalous AP and may pass the beacon or code to the fraud detection service. The code may be a random number, an OAUTH code (either Time Based One-Time Password Algorithm (TOPT) or HMAC-based One-Time Password Algorithm (HOTP)), a digital signature (signed with the access point's private key) or the like. If the code matches the code that is expected, the access point may be labelled as not anomalous. The access point positioning data may be updated to include this location to prevent future reports from labelling the access point as potentially anomalous. If the code does not match the code that is expected (or does not include the code), the fraud detection service may label the access point as anomalous.

Example corrective actions include changing an identifier (SSID, MAC address, or both) on the legitimate access point. This is accomplished by the fraud detection service contacting the legitimate access point using a known internal network address of the legitimate access point nodes (e.g., a wired Internet Protocol (IP) address). The legitimate access point may then switch to a new SSID and/or MAC address and new whitelists with the updated SSID and MAC address may be sent out to computing devices to prevent any devices from connecting to the rogue access point. In other examples, the access point identifier may be blacklisted until the rogue access point is removed.

In some examples, the determination of whether an access point is anomalous may be done on a fraud detection service in the network based upon reports from computing devices - such as mobile devices using the access points. In other examples, the computing devices may be other access points. In still other examples, the determination of whether the access point is anomalous may be done in a distributed, P2P manner by the computing devices themselves. For example, the computing devices may receive a periodically updated list of expected access point locations. The computing device may compare its location to the list to determine which access points are expected at a particular location. If the computing device detects an access point that is not in the expected location, or detects access points with duplicate identifiers, it may refuse to connect to those access points and may send a report to a fraud detection service (which may then warn other devices). Reports from computing devices may be sent periodically (e.g., every predetermined amount of time) or may be sent when a certain percentage of access points that are visible changes, or when a new access point becomes visible.

In some examples, in addition to updating the white lists, upon determining that an access point is anomalous or potentially anomalous, the fraud detection service may instruct the computing device to disconnect from the anomalous access point, if the computing device was connected to the anomalous access point. The computing device may be configured to prevent any network access or any access to any unencrypted sites prior to receiving an indication from the fraud detection service that the access point it has connected to is not suspected to be anomalous.

The present disclosure thus solves a problem with computer networking in which access points are easily impersonated by malicious actors. These malicious actors setup an access point with a same identity as a legitimate access point in order to steal data from unsuspecting client computing devices. This problem is solved by utilizing the client devices as network scanners that pass reports of visible access points (and other information) to a fraud detection service that compares expected locations of access points to the actual access point locations as observed by computing devices that are utilizing the network. The fraud detection system thus improves the security of the computing system by detecting and responding to threats such as evil twin access points without costly or difficult signal monitoring operations by an IT support professional. As previously noted, the locations of the access points are determined through observed scanning by computing devices and provided to a network-accessible fraud detection service. Once threats are found, the system may take technical measures to eliminate false alarms and to protect network users from those threats. The disclosed techniques improve the functioning of the computer system by securing the network from intrusions. The disclosed techniques are fundamentally rooted in computing technology - specifically the field of network security. As used herein, access points which potentially have evil twin access points operating using a same identity nearby are termed anomalous access points.

<FIG> illustrates an example use case <NUM> of a fraud detection service <NUM> according to some examples of the present disclosure. Computing device <NUM>, shown as a cellular telephone, may move throughout a corporate or other network provided by various access points such as network access points (APs) <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>-R. Anomalous access point <NUM>-F may impersonate legitimate access point <NUM>-R by broadcasting a same identity. For example, by broadcasting a same beacon frame, utilizing a same Media Access Control (MAC) address, and/or a same Service Set Identifier (SSD). While computing device <NUM> may have been provisioned with a white list of permissible access points, that white list may utilize identities of access points, which as noted, may be impersonated by <NUM>-F. Should computing device <NUM> connect to access point <NUM>-F, the data sent over any network connection provided by <NUM>-F may be compromised.

Computing device <NUM> may scan for beacons broadcast by the access points. The computing device <NUM> may then connect to one of the access points through an association and authentication process (e.g., as outlined by the Institute for Electrical and Electronics Engineers (IEEE) <NUM> family of standards). After connecting to the access point, software on the computing device <NUM> may restrict network access to applications on the computing device temporarily.

The computing device <NUM> may establish an encrypted tunnel and send an access point report with scan results showing nearby access points to the fraud detection service <NUM>. In some examples, the access point report may include a geolocation of the computing device <NUM> and/or measurements of a radio signal from the access points. The fraud detection service may utilize the information provided by the computing device <NUM> to determine an observed location (according to one or more computing devices) of the access points in the report. This may be utilized by the fraud detection service along with the access point positioning data that indicates the expected locations of the access points.

The fraud detection service <NUM> may store a plurality of reports from a plurality of computing devices, including computing device <NUM> for later use to detect anomalous access points. For example, the computing device <NUM> may provide the fraud detection service <NUM> its geolocation, measurement data, and the scan results. The fraud detection service <NUM> may utilize stored one or more other previously received reports from other computing devices to calculate a location of the access points that were scanned by the computing device <NUM>.

For example, the computing device <NUM> may receive beacon frames from access points <NUM>, <NUM>, <NUM>, and <NUM>-F. Based upon measurements taken of these signals by the computing device (e.g., a RSSI, a round trip time, a time of flight measurement, or the like) and the geolocation of the computing device <NUM>, the fraud detection service may compute a distance between the computing device and each access point. Using additional reports from additional computing devices, the fraud detection service <NUM> may employ a trilateration algorithm to calculate an observed position of the access points.

In some examples, to differentiate between sightings by the computing devices of legitimate access points and anomalous access points, the stored reports may be clustered based upon the location of the computing device. For example, reports from computing devices that are within a locational proximity of each other may be clustered. This allows the trilateration algorithm to compute a solution by preventing reports from the legitimate access points and reports of the anomalous access point being used at the same time in the equations (and thus preventing the trilateration algorithm from computing a solution). In other examples, instead of the clustering algorithm, the inability to compute a solution may be used as evidence that the access point is anomalous.

For example, a report from computing device <NUM> as stored by the fraud detection service <NUM> may be:.

Another computing device within a predetermined proximity to the computing device <NUM> may also be in a position cluster A, and the measurements of the signals taken by that computing device may be utilized along with the measurements of computing device <NUM> to calculate a position of the access points. Another position cluster, position cluster B is represented by computing device <NUM>, which is shown as a laptop computing device. Computing device <NUM> may also provide reports to the fraud detection service <NUM>. Computing device <NUM> may provide its location and a list of the access points it sees (access points <NUM>, <NUM>, and <NUM>-R) and in some examples the measurements of the signals received from the access points. The fraud detection service may utilize the location of the computing device <NUM> to determine that computing device <NUM> is in a location cluster B. The report from computing device <NUM> may be stored as:.

Using reports from other computing devices in cluster A together with the report from computing device <NUM>, the fraud detection system may produce access point positioning information of:.

Fraud detection service may conclude that the position of AP <NUM> at Latitude A and Longitude C is not consistent with the position as specified in the access point positioning data. For example, the access point positioning data may be:.

When computing device <NUM> reports an access point identifying itself as access point <NUM>, the fraud detection service may determine that its position does not match the expected position of an access point with these identifiers and may label it as potentially anomalous.

While the above description utilized computing device positions and measurements to determine access point locations, in other examples, other methods may be utilized. For example, the computing device may not report its position, but may report the identifiers of access points that it sees and the measurements of the radio signals of these access points. In <FIG>, computing device <NUM> would report the identifiers of access points <NUM>, <NUM>, <NUM>, and <NUM>-F. Similarly, computing device <NUM> would report identifiers of access points <NUM>, <NUM>, and <NUM>-R.

The fraud detection service may utilize the access points visible to the computing device and the measurements to determine what other access points should be visible to the computing device based upon the access point positioning data. For example, a position of the computing device may be ascertained from the measurements and the known positions of the access points from the access point positioning data. In the case of a fraudulent access point, one or more measurements may be incorrect - that is, the distance between the location of the access point from the access point positioning data may be different than the distance measured (as it is actually measuring a distance to an imposter).

In some examples, each combination of three distances and access point locations for all visible access points may be computed using trilateration. The position of the computing device may be the position that has the least amount of error (or that actually produces a position solution). The fraud detection system may identify that particular access points that cause high error, or cause the position not to converge in the trilateration equations, by correlating common access points in the various high error or non-converging solutions. For example, if the access point combination of APs <NUM>, <NUM>, and <NUM>, when combined in a trilateration equation produce a solution, but when utilizing access point <NUM>-F, the system may not be able to produce a solution (or may produce a solution with a high error) to the trilateration equation. Access points that cause failures to position the computing device may be marked as anomalous.

In other examples, the fraud detection service may use only the visible access points communicated by the computing device. The access point positioning data may be a model that, when given a list of one or more visible access points, outputs a probability that another given list of one or more access points would be visible. In this example, the computing device may calculate the probabilities of each visible access point given all other visible access points and then those probabilities that are below a predetermined threshold may be labeled as potentially anomalous. This model may be created based upon a plurality of reports from a plurality of other computing devices.

For example, in <FIG>, the computing device <NUM> sees access points <NUM>, <NUM>, and <NUM>, and <NUM>. These access point identifiers may be reported to the fraud detection service. The fraud detection service may produce a list of probabilities P(x|y) for each access point reported as visible. P(x|y) in probability notation is the probability of x given y. So the probabilities calculated may be P(<NUM>|<NUM>, <NUM>, <NUM>), P(<NUM>|<NUM>, <NUM>, <NUM>), P(<NUM>|<NUM>, <NUM>, <NUM>), P(<NUM>|<NUM>, <NUM>, <NUM>). As noted these probabilities may be calculated using other reports from other computing devices in the same area as computing device <NUM>. The P(<NUM>|<NUM>, <NUM>, <NUM>), P(<NUM>|<NUM>, <NUM>, <NUM>), and P(<NUM>|<NUM>, <NUM>, <NUM>) may be greater than a lower threshold as these APs are often reported together and so AP <NUM>, <NUM>, and <NUM> may not be marked anomalous. However, P(<NUM>|<NUM>, <NUM>, <NUM>) may be low as AP <NUM> may not be reported often with APs <NUM>, <NUM>, and <NUM>. Indeed, AP <NUM> would more likely be reported with AP <NUM>, and AP <NUM>. AP <NUM>-F may be labelled as anomalous.

In examples in which the access point positioning data is a geolcation, a threshold distance may be utilized from a central access point reported by the computing device. The central access point may be determined by clustering the set of visible access points based upon the location in the access point positioning data and taking a centroid. For example, in <FIG>, a distance threshold from access point <NUM> may be utilized. Any access point that has a location in the access point positioning data that is over a determined threshold distance from this central access point may be considered potentially anomalous.

Turning now to <FIG>, a method <NUM> of a detecting an anomalous access point is illustrated according to some examples of the present disclosure. Method <NUM> may be performed by a fraud detection service, a computing device, or the like. At operation <NUM>, a set of network access points visible to a first computing device may be determined. For example, the computing device may scan one or more frequencies for beacon or other broadcast frames that advertise access points. These beacon frames may include an access point identifier or identifiers such as a Service Set Identifier (SSID), a MAC address of the access point, and the like. In some examples, in addition to scanning one or more channels for one or more access points, the computing device measures a metric corresponding to the channel that is indicative of a distance between the computing device and the access point. For example, a received signal strength, a round trip time, a time of flight measurement, or the like.

At operation <NUM>, the system may determine that a first network access point in the set of network access points is broadcasting from a location that is not an expected location the system may determine that a particular access point is not broadcasting from an expected location. This determination may be based upon the set of network access points visible to the first computing device and access point positioning data describing position information of the set of access points visible to the first computing device. This may be done for example, by utilizing one of the previously discussed methods utilizing the set of access points visible to the computing device. <FIG> describe additional methods for performing operation <NUM>. Each of the methods of <FIG> may utilize different information available to the system, such as different types of access point positioning data and whether measurement and/or computing device locations are available. At operation <NUM>, the system may store an indication that the first access point is anomalous. For example, a data structure may store one or more of: the access point identifier, how many times they have been reported as anomalous, when it was reported, and other information about the report, including data used to make the decision (e.g., the contents of the report from the computing device), and the like.

A determination is made at <NUM> whether an action threshold is met. For example, the indication may be a fraud score that may be incremented each time the access point is detected as anomalous. When the fraud score exceeds a determined threshold score, the action threshold may be met. In some examples, the threshold may be a single report, in which case the check at operation <NUM> may be optional. In other examples, the threshold may be more than one report. At operation <NUM>, the fraud detection system may initiate one or more corrective actions. Examples of corrective actions include adding the particular access point to a blacklist, instructing the legitimate access point to change its identifier, performing a denial-of-service attack on the illegitimate access point, instructing computing devices to utilize a Virtual Private Network (VPN) when connecting to an access point matching the identifier of the particular access point labeled as anomalous, or any other measure designed to prevent computing devices from connecting to the illegitimate access point or having their data compromised.

<FIG> illustrates a flowchart of a method <NUM> of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure. Method <NUM> is one example method of operation <NUM>. At operation <NUM> a location of the computing device may be identified. For example, the computing device may utilize a Global Navigation Satellite System (GNSS) to determine its geolocation. The geolocation of the computing device may be provided to the fraud detection service in the reports along with the set of visible access points. At operation <NUM> the system may identify measurement reports of the access points visible to the computing device. In some examples, the measurements may be collected during the access point scanning. In other examples, the computing device may temporarily connect to the access points to collect the measurements. Example measurements include a Received Signal Strength Indicator (RSSI), Round Trip Time (RTT), and the like.

At operation <NUM> the system may, for one or more access points in the set of visible access points, determine observed positions of the access points. For example, using the measurements determined at operation <NUM> and a plurality of other measurements from other computing devices, a distance between at least three computing devices and each access point may be determined. This distance may be utilized as input to a trilateration algorithm that outputs an observed position of the access point.

At operation <NUM> the system may determine whether any observed access point positions differ from that of the access point position data. The difference may utilize a threshold to allow for some natural variance as the observed location may not be as accurate as that determined and stored in the access point position data. For example, a threshold difference may be employed such that if a difference between the observed and expected locations (from the access point position data) differ greater than the threshold, the access point may be labeled as anomalous. At operation <NUM>, access points whose observed location and expected location differ by an amount greater than the threshold may be marked as anomalous.

<FIG> illustrates a flowchart of a method <NUM> of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure. Method <NUM> is one example method of operation <NUM>. The method of <FIG> may be utilized in examples in which the computing device's position is known, the access point positioning data comprises geolocations of where the access points were deployed, and where the computing device does not supply measurement data. At operation <NUM> the system may identify a location of the computing device. For example, the computing device may utilize a GNSS, calculate its location using a cellular positioning method, inertial navigation, or the like. At operation <NUM>, the system may determine the set of one or more access points using the access point positioning data that is within a threshold distance radius from the computing device's reported position. Any access point that is reported by the computing device that is not in this set may be labeled anomalous. The threshold may be set by an administrator, or the like. The threshold may be specific to particular areas and may be adjusted up or down based upon detection of false positives (e.g., by the confirmation processes discussed).

<FIG> illustrates a flowchart of a method <NUM> of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure. Method <NUM> is one example method of operation <NUM>. In the example of <FIG>, the system does not have, or utilize, the computing device's location, measurements, or geolocations of the access points in the access point positioning data. In the example in <FIG>, the access point positioning data comprises a probability model that outputs a probability of a computing device seeing a particular access point given that other access points are visible. Prior to the operations of <FIG>, the system determines the probability model from a plurality of reports of computing devices. For example, each time a group of access points is visible together, the probability of seeing one of the group when the other is visible is increased.

At operation <NUM> the system may utilize the determined probabilities of the access point positioning data to determine the probability that a particular access point would be visible based upon the presence of the other access points. At operation <NUM>, if the probability is lower than a defined threshold, the system may mark the particular access point as anomalous at operation <NUM>. The threshold may be set by an administrator. In some examples, the threshold may be adjusted up or down based upon the results of any confirmation methods utilized as described above. Thus, for example, if an access point is marked as anomalous but is confirmed by one of the confirmation methods above, the system may decrease the probability threshold. In other examples, if the system does not mark an access point as anomalous and it turns out to be anomalous then the system may lower the threshold. At <NUM>, if additional access points are present in the list of visible access points, then control may pass to operation <NUM> to process the next access point in the list of visible access points.

<FIG> illustrates a flowchart of a method <NUM> of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure. Method <NUM> is one example method of operation <NUM>. In the example of <FIG>, the system may have access to geolocation data of the access points, but not geolocation data of the computing device or measurement data. At operation <NUM>, the system may determine a center access point in the list of visible access points. For example, the access points may be clustered based upon location (e.g., using a k-nearest clustering algorithm). The system may determine a centroid of the cluster and the access point nearest the centroid may be utilized as the center access point.

At operation <NUM> the system may identify the location of the center access point using the access point positioning data. At operation <NUM>, the system may determine access points in the set of visible access points that are not within a threshold distance of the center access point position. These access points may be marked as anomalous by the system at operation <NUM>.

<FIG> illustrates a flowchart of a method <NUM> of determining that a first network access point in the set of network access points is broadcasting from a location that is not an expected location according to some examples of the present disclosure. Method <NUM> is one example method of operation <NUM>. In the example of <FIG>, the system may have access to geolocation data of the access points and measurement data, but not geolocation data of the computing device. At operation <NUM> the system may identify a measurement report measuring a strength of signal between the computing device and access points in the visible list. At operation <NUM>, the system may utilize the measurements along with the access point positioning data to attempt to geolocate the computing device using a trilateration algorithm using various combinations of three access point measurement and location data. The trilateration algorithm may not compute a position when an anomalous node is included in the calculation or an error may be above a predetermined threshold. In these cases, the node that causes the failure may be marked as anomalous at operation <NUM>.

<FIG> illustrates a block diagram of a fraud detection service <NUM> and a computing device <NUM> according to some examples of the present disclosure. Fraud detection service <NUM> may be an example of fraud detection service <NUM>. Computing device <NUM> may be an example of computing device <NUM> and <NUM>. The components shown in <FIG> and <FIG> may be performed in hardware, software, or any combination thereof. The functionality of each component is one example arrangement of functionality and one of ordinary skill with the benefit of the present disclosure will appreciate that other organizations are possible. For example, one or more of the functions of one or more components of the fraud detection service <NUM> may be performed by one or more of the other components. Likewise, one or more of the functions of one or more components of the computing device <NUM> may be performed by one or more of the other components. Fraud detection service <NUM> may execute on a network accessible computing device, such as a server, a desktop, a laptop, or the like. Computing device <NUM> may be any computing device that is capable of performing instructions and connecting to one or more wireless access points. Example computing devices include desktops, laptops, tablets, smartphones, other access points (e.g., performing the role of a computing device), and the like.

Computing device <NUM> may include a network interface <NUM>. The network interface <NUM> may provide one or more software and/or hardware components to enable the computing device to associate, authenticate, and connect to a wireless access point. This includes network stacks, such as Transmission Control Protocol (TCP), Internet Protocol, Ethernet, one or more protocol layers specified by the an <NUM> family of standards promulgated by the Institute for Electrical and Electronics Engineers (IEEE), and the like. As used herein, access points and computing devices may communicate, authenticate, associate, connect and otherwise operate according to an IEEE <NUM> family of standards, such as <NUM>.

Network interface <NUM> may also include a whitelist <NUM> that identifies one or more access points that the computing device is authorized to connect with. The whitelist may be a list of access points in a particular network, such as a corporate network. In some examples, the network interface <NUM> may limit the scan for access point beacon frames of access points identified in the whitelist <NUM>. Whitelist <NUM> may identify access points by an access point identifier that may comprise one or more of: an SSID, a MAC address, or the like.

Network scanner <NUM> of network interface <NUM> may scan for one or more access points. For example, by listening at designated frequencies and according to designated protocols such as an <NUM> protocol for beacon frames sent by access points. In some examples, the network scanner <NUM> may filter out access points that are not in the whitelist based upon the identification of the access point in the white list. In some examples, the network scanner <NUM> may perform one or more measurements of the radio interface between the access points that are scanned and the computing device. For example, a received signal strength (which may be described by a received signal strength indicator or RSSI), a round-trip time, and the like. In some examples, the network scanner <NUM> may associate and/or authenticate with one or more access points to perform the measurements.

Once the computing device is connected to an access point (e.g., associated and/or authenticated), the network access restrictor <NUM> may restrict the network access of the computing device <NUM> until the fraud detection process has completed and the access point that the computing device <NUM> is connected to is cleared as being non-anomalous, e.g., by fraud detection service <NUM>.

Fraud detection interface <NUM> may receive the whitelist <NUM> from the fraud detection service <NUM> or from another component and store it on the computing device <NUM>. Fraud detection interface <NUM> may send reports to the fraud detection service <NUM> comprising the list of access points detected (e.g., that are visible) by the computing device <NUM> (e.g., by network scanner <NUM> of computing device <NUM>) and in some examples, one or more of: measurement reports; a geolocation; or an approximate location of the computing device <NUM>. Fraud detection interface <NUM> may also receive an indication of whether or not the access point that the computing device <NUM> is currently connected to is considered anomalous. If the current access point is not anomalous, then the fraud detection interface <NUM> may instruct the network access restrictor <NUM> to allow full access. Otherwise, the fraud detection interface <NUM> may connect to a different access point or maintain the restricted access. Fraud detection interface <NUM> may also handle any requested verification from fraud detection service <NUM>. For example, fraud detection service <NUM> may request that computing device <NUM> verify an access point. The computing device may receive the beacon frames from the access point and forward them to the fraud detection service <NUM> for analysis.

Positioner <NUM> may include hardware and/or software for determining a geolocation of the computing device <NUM>. For example, a GNSS receiver and corresponding software to compute a position of the computing device. Other position calculations may include use of cellular networks to trilaterate the position of the computing device.

Fraud detection service <NUM> may include a fraud detector <NUM> which may receive reports from computing devices, compute the access point positioning data (if needed - e.g., for probabilistic modeling), determine if an access point is anomalous, compute fraud scores, and the like. For example, fraud detector <NUM> may perform any one of the methods of <FIG>. Fraud verifier <NUM> may verify whether an access point that was labeled as anomalous by the fraud detector <NUM> is being impersonated. For example, the fraud verifier <NUM> may have a network address of the legitimate access point and may send a request to the access point to broadcast a code or other message within its beacon frame. This code may be a cryptographic code, such as an HMAC or other key that may include a time value or counter value to prevent duplication. This time value and/or counter may be encrypted to prevent snooping. If the computing device reports that the secret value is present in the beacon, the access point may be labeled as not anomalous.

Fraud remediator <NUM> may take one or more corrective actions to remediate any potential anomalous access points. For example, by commanding a legitimate access point that is being impersonated to change the identification of the legitimate access point, updating the white list with the legitimate access point, and propagating the updated white list to the computing devices, such as computing device <NUM>. Other corrective actions include informing an administrator, including a location of the imposter access point, and the like. In some examples, the fraud detection service <NUM> may instruct another device to issue a denial of service attack on the illegitimate access point so as to use up the resources of the illegitimate access point and prevent legitimate clients from connecting and potentially sending sensitive data that may be intercepted. Database <NUM> may store the access point positioning data, measurement reports, and the like.

<FIG> illustrates a more detailed example schematic of a fraud detector <NUM> according to some examples of the present disclosure. In some examples, the components of the fraud detector <NUM> may vary depending upon the implementation. For example, fewer, greater, or different components than illustrated may be utilized. Access point locator <NUM> may utilize the list of visible access points <NUM>, the positioning data <NUM> of the computing device, measurement data <NUM> of the visible access points <NUM> and the AP positioning data <NUM> to calculate access points that are visible that should not be visible by calculating an observed position of each visible access point and then comparing that with the AP positioning data <NUM> which indicates expected positions. For example, according to <FIG>. The output is the anomaly determination <NUM>.

Probabilistic determiner <NUM> may utilize the list of visible access points <NUM> and the access point positioning data <NUM> (in the form of a probability model) to determine whether a visibility of a particular access point in the list of visible access points is not probable. If the probability of the access point being visible given the other access points is below a threshold probability, the access point may be marked as anomalous. For example, probabilistic determiner <NUM> may implement the method of <FIG>.

Threshold radius determiner <NUM> may utilize the access point positioning data <NUM> and positioning data <NUM> of the computing device and the visible access points <NUM> to determine a set of access points that should be visible given a current location of the computing device and the AP positioning data <NUM> by selecting access points in the visible list that are within a threshold distance of the computing device. APs in the visible access points <NUM> that are not in the set of access points that should be visible may be marked as anomalous. In some examples, instead of utilizing a position of the computing device, the threshold radius determiner may calculate a center access point and utilize a threshold distance from the location of that access point to determine the set of access points that should be visible to the computing device. For example, threshold radius determiner <NUM> may implement <FIG>. In some examples, the threshold radius determiner <NUM> may also implement <FIG> and may not take as input the location of the computing device.

Computing device locator <NUM> may utilize the AP positioning data <NUM>, measurement data <NUM> and the list of visible access points <NUM> to attempt to determine a position of the computing device. The trilateration equations used may have an error value or may not converge on a solution if an access point in the visible list is not where the data in the AP positioning data indicates it is. Access points that cause a failure or high error rate of the trilateration equations may be labeled as anomalous. Computing device locator <NUM> may implement the method of <FIG>.

AP locator <NUM>, probabilistic determiner <NUM>, threshold radius determiner <NUM> and computing device locator <NUM> may return anomaly determination results <NUM> which may be utilized with other components of fraud detection service to mitigate and/or confirm a designation that an access point is anomalous. In some examples, one or more of these methods may be run depending on the data available to the fraud detector <NUM>. In some examples, one, more, or all of them may be run and the anomaly determination results from multiple of the components may be combined. For example, each result may be weighted and summed. Weights maybe determined based upon an administrator, or may be determined based upon a regression machine learned model (e.g., logistic regression) that is trained with historical or determined reports from computing devices and labelled with indications of whether or not the access point is fraudulent.

<FIG> illustrates a block diagram of an example machine <NUM> upon which any one or more of the techniques (e.g., methodologies) discussed herein may perform. The machine <NUM> may be a computing device such as a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile telephone, a server implementing a fraud detection service, a smart phone, a web appliance, a network router, an access point, switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine. Machine <NUM> may implement the methods of <FIG>, implement the components of fraud detection service <NUM>, and computing device <NUM> and fraud detector <NUM> of <FIG>.

Examples, as described herein, may include, or may operate on, logic or a number of components, modules, or mechanisms (hereinafter "modules").

The term "machine readable medium" may include any medium that is capable of storing, encoding, or carrying instructions for execution by the machine <NUM> and that cause the machine <NUM> to perform any one or more of the techniques of the present disclosure, or that is capable of storing, encoding or carrying data structures used by or associated with such instructions. Non-limiting machine readable medium examples may include solid-state memories, and optical and magnetic media. Specific examples of machine readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., Electrically Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; Random Access Memory (RAM); Solid State Drives (SSD); and CD-ROM and DVD-ROM disks. In some examples, machine readable media may include non-transitory machine readable media. In some examples, machine readable media may include machine readable media that is not a transitory propagating signal.

Claim 1:
A method for detecting fraudulent network access points, the method comprising:
determining (<NUM>) a set of a plurality of network access points currently visible to a first computing device;
determining (<NUM>) that a first network access point in the set of network access points is broadcasting from a location that is not an expected location based on:
identifying (<NUM>) a measurement report measuring a strength of signal between the first computing device and the network access points visible to the first computing device;
calculating (<NUM>) a plurality of positions of the first computing device using trilateration calculations on various combinations of three access points in the set of network access points visible to the first computing device; and
determining (<NUM>), based upon results of the trilateration calculations, that inclusion of the first access point of the set of access points in the trilateration calculations causes the trilateration calculation to fail to produce a geolocation or to have an error that is above a threshold; and
responsive to determining that inclusion of the first access point in the trilateration calculations causes the trilateration calculation to fail to converge or to have an error value that is above the threshold, marking the first access point as anomalous; and
initiating (<NUM>) at least one corrective action based upon marking that the first network access point is anomalous.