臺灣博碩士論文加值系統

無線網路技術近幾年逐漸成熟，構成無線網路的兩大類裝置：無線區域網路存取點（Access Point）以及遠端無線裝置（Remote Device），在所有學校或企業組織當中也越來越普及。
這使得這些無線裝置的安全管理，成為一個迫切而且重要的研究課題。
非法無線區域網路存取點問題，便是其中一個備受矚目的問題。
非法無線區域網路存取點，指的是未經管理者允許，而由一般使用者或駭客，自行設立的無線區域網路存取點。
這些非法無線區域網路存取點，很容易造成網路安全的重大危害。
針對這個問題，有兩項功能對網路管理是特別有用的。第一項是非法無線區域網路存取點的偵測，第二項是遠端無線裝置的定位。


傳統上，要偵測非法無線區域網路存取點的存在，網管人員必須帶著無線電波偵測器，一一掃描管理區域的每一個角落。
這樣的工作方式，不但需要額外的硬體，又非常辛苦且沒有效率。
本論文提出一種基於網路封包分析，且不需要額外硬體的新方法。
這個方法藉由封包對技術，分析某個連線的客戶端瓶頸頻寬，藉此可以判斷該連線是否來自於非法無線區域網路存取點。
網管人員將可以在辦公室中藉由監控封包，輕鬆的完成非法無線區域網路存取點偵測的工作。
在我們的實驗當中，本論文所提出的方法，可以達到99\%以上的準確率。
實驗結果顯示，本方法確實可以減輕網管人員的負擔，並增加網路的安全性。


在找出非法無線區域網路存取點後，管理者可能需要找出透過非法無線區域網路存取點連線上來的遠端無線裝置的位置，以作進一步的處裡。
要達到這個目的，我們便需要遠端無線裝置的定位的功能。
而事實上，無線裝置的定位技術，除了能在解決非法無線區域網路存取點問題，扮演重要的角色，這技術更是情境感知服務的重要基礎。
在定位技術的研究當中，定位準確度是一個非常重要的課題。
傳統的定位演算法，只藉由感測到的訊號強度來定位。
本研究提出一個，藉由訊號強度以及偵測使用者方向，來改善準確度的方法。
理論上，若能掌握使用者的正確方向，我們便可以在預測位置時，只使用該方向的訓練資料來作為預測的依據。
因此，可以增加預測的準確度。
然而實務上，若方向性資訊，也是經由預測得知；那麼，在使用該方向性資訊時，便要非常小心。
因為，不正確的方向性資訊，反而會降低預測準確度。
為了能夠避免誤用方向性資訊的傷害，本研究提出一項假設。
我們假設，當方向預測錯誤時，該錯誤將不會偏於特定方向。
基於這個假設，本研究提出一個累進方向性強度演算法。
這個演算法，能夠讓我們恰當的使用正確的方向性資訊，並且避免使用錯誤的方向性資訊。
藉此，我們可以改善位置預測的整體準確度。
我們使用貝氏模型，來實做該系統，並以中興大學理學院大樓七樓為測試環境，來檢驗我們的假設及該演算法的效能。
實驗數據顯示，我們提出的方法，確實能夠改善準確度。
這將可以為解決非法無線區域網路存取點問題，以及建立情境感知服務，提供更有力的幫助。

The wireless LAN (WLAN), which contains Access Points (AP) and
remote devices, has become increasingly popular due to its low
price and easy installation. However, the popularity of the WLAN
increases the threat of network security. One of the important
security problems is the rogue AP problem. In unprotected areas,
an unauthorized AP can be plugged into the LANs of most
organizations quickly and easily, the matter which results in
serious security problems. Network managers always look at two
useful functions on the AP and the remote device to resist the
invasion of the rogue AP. One is to detect whether illegal APs are
deployed on the managed area. The second is to predict the
position of a remote device from the rogue AP.


To detect an AP, the network manager traditionally takes an
electric wave sensor across the whole protected place. This method
of detection is very difficult and inefficient. This study
presents a new method to detect an AP without additional hardware
and intense effort. This new method determines whether the network
packets of an IP are routed from APs according to client-side
bottleneck bandwidth. The network manager can then perform his job
from his office by monitoring the packets passing through the core
switch. The experimental results indicate that the accuracies of
this method constantly remain above 99%. The proposed method can
effectively reduce the detailed labor of the network manager and
increase the network security.

Once a rogue AP is detected, the next task is to find the location
of the illegal user. Due to the rogue AP problem and the demand
for context-aware services inside buildings, the WLAN-based
location determination has emerged as a significant research
topic.
However, prediction accuracy remains a primary issue in the
practicality of WLAN-based location determination systems. This
study proposes an innovative scheme that utilizes mobile user
orientation information to improve prediction accuracy.
Theoretically, if the precise orientation of a user can be
identified, then the location determination system can predict
that user''s location with a high degree of accuracy by using the
training data of this specific orientation. In reality, a mobile
user''s orientation can be estimated only by comparing variations
in received signal strength; and the predicted orientation may be
incorrect. Incorrect orientation information causes the accuracy
of the entire system to decrease. Therefore, this study presents
an accumulated orientation strength algorithm which can utilize
uncertain estimated orientation information to improve prediction
accuracy. Implementation of this system is based on the Bayesian
model, and the experimental results show the effectiveness of the
proposed approach.

1. Introduction 1
1.1. Research Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2. Objectives and Main Contributions . . . . . . . . . . . . . . . . . . . 2
1.3. Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2. Related Work 9
2.1. Research on Rogue AP Detection . . . . . . . . . . . . . . . . . . . . 9
2.2. Research on Localization . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.2.1. Location Determination Systems . . . . . . . . . . . . . . . . 11
2.2.2. Impact of the Orientation on RSS . . . . . . . . . . . . . . . . 13
3. Algorithm for Rogue AP Detection 16
3.1. Detecting AP based on Client-side Bottleneck Bandwidth . . . . . . . 16
3.1.1. Client-side Bottleneck Bandwidth . . . . . . . . . . . . . . . 16
3.1.2. Measuring Bottleneck Bandwidth by Packet Pair Technique . 18
3.1.3. Generating Stable Features by Sliding Window Technique . . 19
3.1.4. Rogue AP Detection as a Classi‾cation Problem . . . . . . . . 20
3.2. Testbed and Experimental Analysis . . . . . . . . . . . . . . . . . . 21
3.2.1. Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2.2. E®ectiveness of Inter-Packet Space and Client-side Bottleneck
Bandwidth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.2.3. Prediction Accuracy of Client-side Bottleneck Bandwidth with
Sliding Window . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.3. Contributions and Limitations . . . . . . . . . . . . . . . . . . . . . . 27
3.3.1. Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.3.2. Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
4. Algorithm for Improving Localization Accuracy 29
4.1. Bayesian Estimation Model . . . . . . . . . . . . . . . . . . . . . . . 29
4.2. Using Orientation Information to Improve Accuracy . . . . . . . . . . 32
4.2.1. Orientation Information by RSS Variance . . . . . . . . . . . . 32
4.2.2. Accumulated Orientation Strength . . . . . . . . . . . . . . . 34
4.3. RSS Data Set Generation and E®ects of Orientation . . . . . . . . . . 37
4.3.1. RSS Data Set Generation . . . . . . . . . . . . . . . . . . . . 37
4.3.2. Distribution of the RSS . . . . . . . . . . . . . . . . . . . . . 40
4.3.3. Bene‾t and Loss of Using Orientation Information . . . . . . . 43
4.3.4. Distribution of Incorrect Estimated Locations . . . . . . . . . 44
4.4. Evaluation of AOS Algorithm . . . . . . . . . . . . . . . . . . . . . . 46
4.4.1. Generation of Walking Path Data . . . . . . . . . . . . . . . . 46
4.4.2. Choosing the Parameters . . . . . . . . . . . . . . . . . . . . . 47
4.4.3. Accuracy of Localization . . . . . . . . . . . . . . . . . . . . . 51
4.5. Contributions and Limitations . . . . . . . . . . . . . . . . . . . . . . 56
4.5.1. Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
4.5.2. Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
5. Conclusions and Future Work 59
5.1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
5.2. Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

[1] AirDefense, Wireless LAN Security. http://airdefense.net.
[2] AirMagnet, AirMagnet Distributed System. http://airmagnet.com.
[3] AirWave, AirWave Management Platform. http://airwave.com.
[4] Paramvir Bahl and Venkata N. Padmanabhan. Enhancements to the RADAR
user location and tracking system,". Tech. Rep. MSR-TR-2000-12, Microsoft
Research, February 2000.
[5] Paramvir Bahl and Venkata N. Padmanabhan, RADAR: An in-building RF-
based user location and tracking system," in Proceedings of IEEE Infocom,
pp. 775{784, March 2000.
[6] Anand Balachandran, Geo®rey M. Voelker, Paramvir Bahl, and P. Venkat Ran-
gan, Characterizing user behavior and network performance in a public wire-
less lan," in SIGMETRICS ''02: Proceedings of the 2002 ACM SIGMETRICS
international conference on Measurement and modeling of computer systems,
pp. 195{205, New York, NY, USA, 2002. ACM Press.
[7] Suman Banerjee, Sulabh Agarwal, Kevin Kamel, Andrzej Kochut, Christo-
pher Kommareddy, Tamer Nadeem, Pankaj Thakkar, Bao Trinh, Adel Youssef,
Moustafa Youssef, Ronald L. Larsen, A. Udaya Shankar, and Ashok Agrawala,
Rover: Scalable location-aware computing," Computer, vol. 35, no. 10, pp. 46{
53, 2002.
[8] Roberto Battiti, Thang Le Nhat, and Alessandro Villani. Location-aware
computing: a neural network model for determining location in wireless LANs,".
Tech. Rep. DIT-5, Informatica e Telecomunicazioni, University of Trento, 2002.
[9] Raheem Beyah, Shantanu Kangude, George Yu, Brian Strickland, and John
Copeland, Rogue access point detection using temporal tra±c characteristics,"
in IEEE GLOBECOM 2004, December 2004.
[10] Bhagyavati, Wayne C. Summers, and Anthony DeJoie, Wireless security tech-
niques: an overview," in InfoSecCD ''04: Proceedings of the 1st annual confer-
ence on Information security curriculum development, pp. 82{87, New York,
NY, USA, 2004. ACM Press.
[11] Jean-Chrysotome Bolot, End-to-end packet delay and loss behavior in the
internet," in SIGCOMM ''93: Conference proceedings on Communications ar-
chitectures, protocols and applications, pp. 289{298, New York, NY, USA, 1993.
ACM Press.
[12] Huiping Cao, Shan Wang, and Lingwei Li, Location dependent query in a
mobile environment," Information Sciences, vol. 154, no. 1-2, pp. 71{83, 2003.
[13] Antonio Capone, Luigi Fratta, and Fabio Martignon, Bandwidth estimation
schemes for TCP over wireless networks," IEEE Transactions on Mobile Com-
puting, vol. 3, 2004.
[14] Robert L. Carter and Mark E. Crovella, Measuring bottleneck link speed in
packet-switched networks," Perform. Eval., vol. 27-28, pp. 297{318, 1996.
[15] Paul Castro, Patrick Chiu, Ted Kremenek, and Richard R. Muntz, A proba-
bilistic room location service for wireless networked environments," in Proceed-
ings of the 3rd International Conference on Ubiquitous Computing, pp. 18{34,
2001.
[16] Chih-Yung Chang, Kuei-Ping Shih, Chung-Hsien Hsu, and Hung-Chang Chen,
A location-aware multicasting protocol for bluetooth location networks," In-
formation Sciences, vol. 177, no. 15, pp. 3161{3177, 2007.
[17] Guanling Chen and David Kotz. A survey of context-aware mobile computing
research,". Tech. Rep. TR2000-381, Dept. of Computer Science, Dartmouth
College, November 2000.
[18] Cisco, Cisco wireless location appliance," http://www.cisco.com/en/US/ prod-
ucts/ps6386/index.html.
[19] Lu³s Felipe M. de Moraes and Bruno Astuto A. Nunes, Calibration-free WLAN
location system based on dynamic mapping of signal strength," in MobiWac
''06: Proceedings of the International Workshop on Mobility Management and
Wireless Access, pp. 92{99, 2006.
[20] Constantinos Dovrolis, Ravi Prasad, Margaret Murray, and Kc Cla®y, Band-
width estimation: metrics, measurement techniques, and tools," Network,
IEEE, vol. 17, 2003.
[21] Constantinos Dovrolis, Parameswaran Ramanathan, and David Moore, What
do packet dispersion techniques measure?," in INFOCOM, pp. 905{914, 2001.
[22] Richard O. Duda, Peter E. Hart, and David G. Stork, Pattern Classi‾cation,
Second Edition. Hoboken, NJ, USA: Wiley, 2000.
[23] Ekahau, Ekahau positioning engine," http://www.ekahau.com/.
[24] Youngjune Gwon and Ravi Jain, Error characteristics and calibration-free
techniques for wireless LAN-based location estimation," in MobiWac ''04: Pro-
ceedings of the Second International Workshop on Mobility Management &
Wireless Access Protocols, pp. 2{9, 2004.
[25] Youngjune Gwon, Ravi Jain, and Toshiro Kawahara, Robust indoor location
estimation of stationary and mobile users," in Proceedings of IEEE Infocom,
pp. 1032{1043, March 2004.
[26] Andreas Haeberlen, Eliot Flannery, Andrew M. Ladd, Algis Rudys, Dan S.
Wallach, and Lydia E. Kavraki, Practical robust localization over large-scale
802.11 wireless networks," in MOBICOM: Proceedings of the Tenth ACM In-
ternational Conference on Mobile Computing and Networking, pp. 70{84, Sep
2004.
[27] Jiawei Han and Micheline Kamber, Data Mining Concepts and Techniques. San
Francisco, CA, USA: Morgan Kaufmann, 2001.
[28] Andy Harter, Andy Hopper, Pete Steggles, Andy Ward, and Paul Webster,
The anatomy of a context-aware application," in Proceedings of the 5th Annual
ACM/IEEE International Conference on Mobile Computing and Networking,
pp. 59{68, 1999.
[29] HighHall, WLAN Monitoring, Intrusion Prevention and Rogue Detection.
http://www.highwalltech.com/.
[30] Je®rey Hightower and Gaetano Borriello. A survey and taxonomy of location
systems for ubiquitous computing,". Tech. Rep. UW-CSE 01-08-03, Dept. of
Computer Science and Engineering, University of Washington, 2001.
[31] Andrew Howard, Sajid Siddiqi, and Gaurav S. Sukhatme, An experimental
study of localization using wireless Ethernet," in Proceedings of the Interna-
tional Conference on Field and Service Robotics, pp. 201{206, Jul 2003.
[32] Eija Kaasinen, User needs for location-aware mobile services," Personal Ubiq-
uitous Comput., vol. 7, no. 1, pp. 70{79, 2003.
[33] Kamol Kaemarungsi and Prashant Krishnamurthy, Properties of indoor re-
ceived signal strength for WLAN location ‾ngerprinting," in MobiQuitous ''04:
Proceedings of the 1st Annual International Conference on Mobile and Ubiqui-
tous Systems: Networking and Services, pp. 14{23, August 2004.
[34] Srinivasan Keshav, A control-theoretic approach to °ow control," in SIG-
COMM ''91: Proceedings of the conference on Communications architecture &
protocols, pp. 3{15, New York, NY, USA, 1991. ACM Press.
[35] P. Krishnan, A. S. Krishnakumar, Wen-Hua Ju, Colin Mallows, and Sachin
Ganu, A system for lease: Location estimation assisted by stationery emitters
for indoor rf wireless networks," in Proceedings of IEEE Infocom, 2004.
[36] Andrew M. Ladd, Kostas E. Bekris, Algis Rudys, Lydia E. Kavraki, and Dan S.
Wallach, Robotics-based location sensing using wireless Ethernet," Wireless
Networks, vol. 11, no. 1, 2005.
[37] Andrew M. Ladd, Kostas E. Bekris, Algis Rudys, Guillaume Marceau, Lydia E.
Kavraki, and Dan S. Wallach, Robotics-based location sensing using wireless
Ethernet," in MOBICOM: Proceedings of the Eighth ACM International Con-
ference on Mobile Computing and Networking, pp. 227{238, 2002.
[38] Kevin Lai and Mary Baker, Nettimer: A tool for measuring bottleneck link
bandwidth," in USENIX Symposium on Internet Technologies and Systems,
2001.
[39] Yui-Wah Lee, Eric Stuntebeck, and Scott C. Miller, MERIT: Mesh of RF
sensors for indoor tracking," in SECON2006: Proceedings of the Third An-
nual IEEE Communications Society Conference on Sensor, Mesh, and Ad Hoc
Communications and Networks, pp. 545{554, 2006.
[40] I-En Liao, Kuo-Fong Kao, and Ke-An Chen, WLAN location-aware appli-
cation based on accumulated orientation strength algorithm," in Proceedings
of First European Conference on Smart Sensing and Context (Paul Havinga,
Maria Lijding, Nirvana Meratnia, and Maarten Wegdam, eds.), vol. 4272 of
LNCS, pp. 204{217. Springer, 2006.
[41] Chih-Chieh Ling, Detection of unlawful wireless access point based on network
packet analysis," in Master Thesis of National Chung Hsing University, Taiwan,
June 2005.
[42] Tom Logsdon, Understanding the NAVSTAR: GPS, GIS, and IVHS ,Second
Edition. Dordrecht, The Netherlands: Kluwer Academic, 1995.
[43] MICA2, Crossbow wireless sensor networks," http://www.xbow.com/Products/
productdetails.aspx?sid=174.
[44] K. Muthukrishnan, M. E. M. Lijding, and P. J. M. Havinga, Towards smart
surroundings: Enabling techniques and technologies for localization," in LoCA:
Proceedings of the 1st Int. Workshop on Location- and Context-Awareness
(T. Strang and C. Linnho®-Popien, eds.), vol. 3479 of LNCS, pp. 350{362,
Berlin, May 2005. Springer-Verlag.
[45] Kavitha Muthukrishnan, Nirvana Meratnia, Georgi Koprinkov, Maria Lijding,
and Paul Havinga, Demonstrating FLAVOUR: Friendly Location-aware con-
ference Assistant with priVacy Observant architectURe," in ICSOC 2005: Pro-
ceedings of the 3rd International Conference on Service Oriented Computing,
pp. 13{16, 2005.
[46] NetStumbler. http://www.netstumbler.com.
[47] Lionel M. Ni, Yunhao Liu, Yiu Cho Lau, and Abhishek P. Patil, LAND-
MARC: Indoor location sensing using active RFID," Wirel. Netw., vol. 10,
no. 6, pp. 701{710, 2004.
[48] Galo Nu~no-Barrau and Jose M. Paez-Borrallo, A new location estimation sys-
tem for wireless networks based on linear discriminant functions and hidden
markov models," EURASIP Journal on Applied Signal Processing, vol. 2006,
pp. Article ID 68154, 17 pages, 2006.
[49] Nissanka B. Priyantha, Anit Chakraborty, and Hari Balakrishnan, The cricket
location-support system," in Proceedings of the 6th Annual International Con-
ference on Mobile Computing and Networking, pp. 32{43, 2000.
[50] Maya Rodrig, Charles Reis, Ratul Mahajan, David Wetherall, and John Za-
horjan, Measurement-based characterization of 802.11 in a hotspot setting,"
in E-WIND ''05: Proceeding of the 2005 ACM SIGCOMM workshop on Ex-
perimental approaches to wireless network design and analysis, pp. 5{10, New
York, NY, USA, 2005. ACM Press.
[51] C. Philipp Schloter and Hamid Aghajan, Wireless symbolic positioning using
support vector machines," in IWCMC ''06: Proceeding of the 2006 International
Conference on Communications and Mobile Computing, pp. 1141{1146, 2006.
[52] T.S. Seidel, S.Y.; Rappaport, 914 mhz path loss prediction models for indoor
wireless communications in multi°oored buildings," IEEE Transactions on An-
tennas and Propagation, vol. 40, no. 2, pp. 207{217, 1992.
[53] Vinay Seshadri, Gergely Zaruba, and Manfred Huber, A bayesian sampling ap-
proach to in-door localization of wireless devices using received signal strength
indication," in PerCom 2005: Proceedings of the Third IEEE International
Conference on Pervasive Computing and Communications, pp. 75{84, March
2005.
[54] Asim Smailagic, Daniel P. Siewiorek, Joshua Anhalt, David Kogan, and Yang
Wang, Location sensing and privacy in a context aware computing environ-
ment," IEEE Wireless Communications, vol. 9, no. 5, pp. 10{17, 2002.
[55] Jacob Strauss, Dina Katabi, and Frans Kaashoek, A measurement study of
available bandwidth estimation tools," in IMC ''03: Proceedings of the 3rd ACM
SIGCOMM conference on Internet measurement, pp. 39{44, New York, NY,
USA, 2003. ACM Press.
[56] Andy Ward, Alan Jones, and Andy Hopper, A new location technique for the
active o±ce," IEEE Personal Communications, vol. 4, no. 5, pp. 42{47, 1997.
[57] Wavelink, Rogue Access Point Dection. http://www.proxim.com/learn/library
/whitepapers.
[58] Jay Werb and Colin Lanzl, Designing a positioning system for ‾nding things
and people indoors," IEEE Spectrum, vol. 35, pp. 71{78, September 1998.
[59] Wimetrics, WiSentry. http://www.wimetrics.com/.
[60] Ian H. Witten and Eibe Frank, Data Mining: Practical machine learning tools
and techniques, 2nd Edition. San Francisco, CA, USA: Morgan Kaufmann,
2005.
[61] Alec Woo, Terence Tong, and David Culler, Taming the underlying challenges
of reliable multihop routing in sensor networks," in SenSys ''03: Proceedings
of the 1st International Conference on Embedded Networked Sensor Systems,
pp. 14{27, 2003.
[62] Ronald R. Yager, An extension of the naive bayesian classi‾er," Information
Sciences, vol. 176, no. 5, pp. 577{588, 2006.
[63] Moustafa Youssef and Ashok Agrawala, The Horus WLAN location determina-
tion system," in MobiSys ''05: Proceedings of the 3rd International Conference
on Mobile Systems, Applications, and Services, pp. 205{218, 2005.
[64] Moustafa A. Youssef, Ashok Agrawala, and A. Udaya Shankar, WLAN loca-
tion determination via clustering and probability distributions," in Proceedings
of the First IEEE International Conference on Pervasive Computing and Com-
munications, pp. 143{150, 2003.
[65] Yasir Zahur and T. Andrew Yang, Wireless lan security and laboratory de-
signs," J. Comput. Small Coll., vol. 19, no. 3, pp. 44{60, 2004.
[66] Jerry Zhao and Ramesh Govindan, Understanding packet delivery perfor-
mance in dense wireless sensor networks," in SenSys ''03: Proceedings of the
1st International Conference on Embedded Networked Sensor Systems, pp. 1{
13, 2003.
[67] Gang Zhou, Tian He, Sudha Krishnamurthy, and John A. Stankovic, Impact
of radio irregularity on wireless sensor networks," in MobiSys ''04: Proceed-
ings of the 2nd International Conference on Mobile Systems, Applications, and
Services, pp. 125{138, 2004.
[68] Rui Zhou, Enhanced wireless indoor tracking system in multi-°oor buildings
with location predication," in EUNIS 2006: Proceedings of the Conference on
European University Information Systems, pp. 448{453, June 2006.
[69] Rui Zhou, Wireless indoor tracking system (WITS)," in Proceedings of doIT
Conference on Software Research, pp. 163{177, July 2006.