Identifying unlabeled WiFi devices with zero-shot learning

• NCJ Number: 305717
• Date Published: April 2020
• Author(s): Logan Smith; Nicholas Smith; Daniel Rayborn; Bo Tang; John E. Ball; Maxwell Young
• Grant Number(s): 2018-75-CX-K002
• Agencies: NIJ-Sponsored
• Publication Type: Research (Applied/Empirical)

Annotation

This conference presentation discusses a two-stage Zero-Shot Learning approach to classify a received signal originating from either a legitimate or unauthorized device in order to circumvent the threat posed by MAC-address spoofing attacks.

Abstract

The authors present a paper that describes a two-stage Zero-Shot Learning (ZSL) approach to classify a received signal originating from either a legitimate or unauthorized device. This device is used to circumvent the threat of MAC-address spoofing, which is a common attack on wireless networks that allows adversaries to gain system access. Instead of relying on MAC addresses for admission control, fingerprinting allows devices to be classified before being granted access. With the ZSL approach, the classifier is first trained for classifying legitimate devices, where it learns discriminative features and the outlier detector uses those features to classify whether a new signature is an outlier. During the testing stage, an online clustering method is applied for grouping those identified unauthorized devices. The researchers’ approach allows 42% of unauthorized devices to be correctly identified and clustered.