The hardware & software sensor for wireless security monitoring based on a single-board computer and a set of Wi-Fi adapters

Abstract

If Wi-Fi technology is used in an information system, according to Art. 16 of Russian Federal Law No. 149-FZ dated 27.07.2006, the owner of the information system must implement protection against wireless network threats. The owner also must ensure timely threat detection and logging. Common Wi-Fi security solutions have a few disadvantages. They may require replacing existing access points that enable the Wi-Fi network by single vendor models featuring an attack detection module. Other disadvantage may be the challenge of using autonomous sensors together to detect distributed attacks. To address these disadvantages, the author designed a hardware & software sensor. It supports pairwise network operation mode and centralized management. These features let it detect attacks across a geolocation without replacing Wi‑Fi equipment. The sensor is modular. It scales by changing its hardware and software. This allows it to improve performance and add new features. The paper describes in detail the design of the hardware and software, which include a single-board computer, a set of network interfaces (represented by Wi-Fi adapters in monitor mode), as well as an integrated multithreaded control module in Python. The server side of the solution and the attack detection technique are described in general terms and are within the scope of other author’s papers. The solution is novel. It uses a set of Wi-Fi adapters, allowing the sensor to work on several channels in different modes simultaneously. This ensures timely attack detection. It also uses a system approach to manage the scanning process, allowing for centralized management of such devices. This increases the coverage of attack detection. The designed elements had been patented in Rospatent (Federal Service for Intellectual Property).