On Detecting CTS Duration Attacks Using K-means Clustering in WLANs

IEEE 802.11 based Wireless LAN (WLAN)
standard has been one of the most successful wireless technology
standards with total expected sales rising to a staggering
$6.1Billion by 2015. The proliferation of 802.11 based WLANs
highlights the need to focus on development of new solutions for
security as enterprises and campuses increasingly being covered
by WLANs. Denial of Service (DoS) is one of the popular attacks
that prevents WLAN users from accessing the wireless network
resources. Most DoS attacks such as the Clear-to-Send (CTS)
duration attack is easy to carry out by an attacker. This work
focuses on the use of clustering techniques on wireless traffic
datasets for detecting CTS-based DoS attacks on 802.11 WLANs.
Performance evaluation shows that, under the cases of naïve CTS
duration attacker as well as the sophisticated CTS duration
attacker, the k-means clustering technique is able to achieve high
detection rates and low false positive rates with relatively small
values of k (i.e., number of clusters).