Anomaly Detection and Modeling in 802.11 Wireless Networks
  IEEE 802.11 Wireless Networks are getting more and more popular at university
campuses, enterprises, shopping centers, airports and in so many other public
places, providing Internet access to a large crowd openly and quickly. The
wireless users are also getting more dependent on WiFi technology and therefore
demanding more reliability and higher performance for this vital technology.
However, due to unstable radio conditions, faulty equipment, and dynamic user
behavior among other reasons, there are always unpredictable performance
problems in a wireless covered area. Detection and prediction of such problems
is of great significance to network managers if they are to alleviate the
connectivity issues of the mobile users and provide a higher quality wireless
service. This paper aims to improve the management of the 802.11 wireless
networks by characterizing and modeling wireless usage patterns in a set of
anomalous scenarios that can occur in such networks. We apply time-invariant
(Gaussian Mixture Models) and time-variant (Hidden Markov Models) modeling
approaches to a dataset generated from a large production network and describe
how we use these models for anomaly detection. We then generate several common
anomalies on a Testbed network and evaluate the proposed anomaly detection
methodologies in a controlled environment. The experimental results of the
Testbed show that HMM outperforms GMM and yields a higher anomaly detection
ratio and a lower false alarm rate.
