Patent ID: 7808958

Claim:
A computer-implemented method of detecting a security threat in an organization, comprising: detecting a plurality of wireless access points with wireless interfaces of a plurality of local computing endpoints of the organization, wherein the wireless access points allow computing devices to access one or more networks; building fingerprint logs to detect abnormal wireless activity by the plurality of detected wireless access points; determining whether the fingerprint logs indicate abnormal wireless activity by the wireless access points; responsive to a fingerprint log for a detected wireless access point indicating abnormal wireless activity by the wireless access point, monitoring the wireless access point to detect data patterns associated with the abnormal wireless activity; determining, based at least in part on the detected data patterns, whether the wireless access point is a rogue wireless access point not sanctioned by the organization; and removing wireless access points being redundantly represented from a mapping of possible locations, wherein the redundancy is caused by detection of a set of possible locations of a single wireless access point by two or more of the plurality of local computing endpoints.