Wimetrics Corporation

Microsoft Technology Licensing, LLC

Joel Rosenberger

Khawar Zuberi

Mathias Jourdain

Systems and methods for providing improved network security against unauthorized wireless devices are presented. A security component within in a wired portion of a computer network is provided. The security component is configured to control the bridging of network activity between the wireless portion and wired portion of the computer network. Using the security component, network traffic between the wireless and wired portions of the computer network for unknown wireless devices is passively monitored. Upon network traffic between the wireless and wired portions of the computer network for an unknown wireless device, the security component determines at least one identifying characteristic of the unknown wireless device by actively probing the device for an identifying characteristic. The security component determines at least one behavioral characteristic of the device according to the network traffic between the device and devices in the wired portion of the computer network. A device profile for the unknown wireless device is generated according to the identifying and behavioral characteristics, access privileges corresponding to the unknown wireless device according to the device profile are determined, and network traffic from the unknown wireless device is permitted to pass to the computer network according to the determined access privileges.

System and method for wireless local area network monitoring and intrusion detection

A novel packet filtering and processing mechanism solves bandwidth estimation problems related to cross-traffic, host limitations, and fabric-specific issues in order to accurately estimate bottleneck bandwidth in fluctuating environments such as home networks. In particular, the process controls the number of packet train experiments, the size of trains and packets within trains, and other factors to eliminate errors due to cross-traffic, network capture, receiver CPU overload, interrupt moderation, and other networking factors. In an embodiment of the invention, a history window is applied to estimates derived from individual trains to ensure that data used to make a bottleneck bandwidth estimate was taken at a time when the network is relatively stable.

High-accuracy packet pair for network bottleneck bandwidth measurement

Systems and methods for managing network traffic from an unknown wireless device on a computer network are presented. A security component residing in a wired area of the computer network is configured to passively monitor network traffic from a wireless area of the computer network for network traffic from an unknown wireless device. Upon detecting network traffic from an unknown wireless device, the security component probes the unknown wireless device to determine at least one characteristic of the wireless device. After probing the device, the security component generates a device profile of the unknown wireless device according to the at least one determined characteristic. Access privileges are determined to give to the unknown wireless device according to the determined profile and activities exhibited by the wireless device. Thereafter, network traffic from the unknown wireless device is permitted to pass to the computer network according to the determined access privileges.

The present invention provides a system and method for providing real-time wireless network monitoring and intrusion detection. The present invention profiles wireless devices and maintains a database of known/authorized wireless device profiles. Wireless devices are analyzed to determine the threat level they pose to the network, and if the threat level exceeds a predetermined threshold, the invention refuses to bridge the network traffic from the wireless devices to the wired network. The present invention provides reporting of the wireless network activity, the known and unknown wireless devices, and the threat levels posed by the wireless devices. If an unknown wireless device is determined to be, or may be, a wireless access point, an alert is generated, such as notifying a system administrator to take appropriate action.

Growing community of inventors

Fall City, WA, United States of America

Joel Rosenberger