Patent ID: 7810154

Claim:
A method for detecting and geographically locating a rogue user accessing a wireless computer network wirelessly, where the wireless computer network comprises a server computer system and a plurality of wireless access points via which a wireless computer workstation accesses the server computer system, the method comprising: deploying a Network Management System (NMS) into the server computer system for collecting Media Access Control (MAC), Internet Protocol (IP) addresses of computer workstations and access points connected onto the network, and the performance characteristics of the computer workstations and access points; detecting a rogue user by comparing the collected MAC and IP addresses with a reference set of valid addresses of authorized users, wherein a user with addresses not on the reference set is considered as the rogue user; determining the nearest wireless access point serving the rogue user by performing a logical AND operation between the collected IP address and the subnet mask of the rogue user; determining the geographical location of the rogue user with reference to the nearest wireless access point by a ranking algorithm that derives at least one performance index for the rogue user from the collected performance characteristics of the rogue user and compares the performance index of the rogue user with the average of the reference performance indices of each island mapped near the nearest access point in a spatial performance model pertinent to the time of day of detection; wherein the spatial performance model having a plurality of islands is constructed dynamically by the following operations, comprising: collecting and mapping out the performance characteristics of wireless computer workstations in the plurality of islands in the area covered by the wireless access points of the network; measuring at least one network performance parameter of the performance characteristics for each island, wherein each island shares the same performance characteristics; and deriving a performance index for each island based on the at least one performance parameter to obtain the spatial performance model; and alerting the administer of the network for taking security measures against the located rogue user.