Patent ID: 8000698

Claim:
A method of detecting rogue wireless network connections to a specific wired network, the method comprising the steps of: storing a listing of authorized Service Set Identifiers (SSIDs) and authorized Basic Service Set Identifiers (BSSIDs) for legitimate access points; storing historical information comprising signal strengths at which the authorized SSIDs and the authorized BSSIDs were heard by a set of air monitors when broadcast by the legitimate access points; detecting an observed Service Set Identifier (SSID) and an observed Basic Service Set Identifier (BSSID) broadcast by a device on a wireless network; comparing the observed SSID and the observed BSSID broadcast by the device with the listing of authorized SSIDs and authorized BSSIDs to check whether the observed SSID and the observed BSSID broadcast by the device are authorized; if the observed SSID and the observed BSSID broadcast by the device appear in the listing of authorized SSIDs and authorized BSSIDs, testing for a false negative by: determining an observed signal strength at which the device is broadcasting the observed SSID and the observed BSSID, accessing the stored historical information to determine the signal strengths at which the observed SSID and the observed BSSID have been heard before by the set of air monitors when broadcast by a legitimate access point, and indicating that the device is a rogue wireless device when the observed signal strength at which the device is broadcasting the observed SSID and the observed BSSID does not match any of the signal strengths at which the observed SSID and the observed BSSID have been heard before by the set of air monitors when broadcast by a legitimate access point; and if one or more of the observed SSID and the observed BSSID broadcast by the device do not appear in the listing of authorized SSIDs and authorized BSSIDs, testing for a false positive by: prior to generating an alarm, determining whether the device is connected to the wired network, and indicating that the device is a rogue wireless device when it is determined that the device is broadcasting one or more of an unauthorized SSID and an unauthorized BSSID and is connected to the wired network.