Analysis of deauthentication attack in IEEE 802.11 networks and a proposal for its detection

Abstract

The article issues related to IEEE 802.11 technology are considered, described in detail the vulnerability that allows an attacker to perform a deauthentication attack. Analysis and practical experiments have shown that the existing vulnerability of Wi-Fi technology still remains dangerous to legitimate users, and using it, an attacker can send deauthentication frames, which results in disruption of communication between clients and the access points to which they are connected. For research were used Kali Linux OS, Aircrack-ng tool to launch attacks and Wireshark to capture and analyze IEEE 802.11 frames. Experimental studies allowed to identify anomalies during the attack and based on them, an algorithm for detecting deauthentication attacks was offered. The proposed solution uses a combination of three parameters (reason code, timestmap, RSSI signal strength level), which in our opinion will reduce the frequency of false positives. It is proposed to use the DDA (Detector of Deauthentication Attack), which will scan and analyze wireless traffic, and issue warnings in the event of an attack.