Intrusion detection method of wireless local area network MAC layer based on hidden Markov model

The packet field of wireless local area network (WLAN) medium access control (MAC) layer is taken for the analytical object of detecting intrusion. An intrusion detection method of WLAN MAC layer is proposed based on the hidden Markov model(HMM). A three layers frame including console, server and agents is given; the data of WLAN MAC layer is used to model the HMM; then the normal data of WLAN is used to train the HMM and to memorialize the normal action of WLAN. An intrusion will be detected when the occurring probability of a packet data or a sequence of packet data is smaller than a given threshold. Experimental results show that the proposed method has low false positive rate and missing report rate when detecting the known attacks on WLAN MAC layers, and also detects unknown attacks.