title: A New MAC Address Spoofing Detection Technique Based on Random Forests.
abstract: Media access control (MAC) addresses in wireless networks can be trivially spoofed using off-the-shelf devices. The aim of this research is to detect MAC address spoofing in wireless networks using a hard-to-spoof measurement that is correlated to the location of the wireless device, namely the received signal strength (RSS). We developed a passive solution that does not require modification for standards or protocols. The solution was tested in a live test-bed (i.e., a wireless local area network with the aid of two air monitors acting as sensors) and achieved 99.77%, 93.16% and 88.38% accuracy when the attacker is 8-13 m, 4-8 m and less than 4 m away from the victim device, respectively. We implemented three previous methods on the same test-bed and found that our solution outperforms existing solutions. Our solution is based on an ensemble method known as random forests.
authors.affiliation: Computer Science and Engineering Department, University of Bridgeport, 126 Park Ave, Bridgeport, CT 06604, USA. balotaib@my.bridgeport.edu.
authors.forename: Bandar
authors.initials: B
authors.lastname: Alotaibi
authors.affiliation: Computer Science and Engineering Department, University of Bridgeport, 126 Park Ave, Bridgeport, CT 06604, USA. elleithy@bridgeport.edu.
authors.forename: Khaled
authors.initials: K
authors.lastname: Elleithy
keywords: MAC address; detection; random forests; spoofing; wireless local area networks; wireless sensor networks