WO2007142798A2 - Methods and apparatuses for detecting deviations from legitimate operation on a wireless network - Google Patents

Abstract

Methods and apparatuses for detecting deviations from legitimate operation on a wireless network. The method includes detecting a sequence of observable events related to operation of an entity in the wireless network, and determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events to provide a first output. The method further includes obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol, and comparing a function of the first output with a function of the second output to determine whether or not the particular entity is deviating from legitimate operation of the network transmission protocol.

Description

Methods and Apparatuses for Detecting Deviations from Legitimate Operation on a Wireless Network

CROSS REFERENCE TO RELATED CASES This application claims priority to, and the benefit of, Provisional U.S. Patent

Application Serial No. 60/810,002 filed May 31, 2006, the entirety of which is incorporated herein by reference.

BACKGROUND OF THE INVENTION 1. Field of the Invention

The disclosed subject matter relates to methods and apparatuses for detecting deviations from legitimate operation on a wireless network. For example, the disclosed methods and apparatuses can detect an entity in a wireless network that deviates from legitimate operation' of a network transmission protocol used on the wireless network.

2. Description of the Related Art

The carrier-sense multiple-access with collision avoidance (CSMA/CA) protocol relies on the random deferment of packet transmissions for contention resolution and efficient use of the communication channel that is shared among many terminals (i.e., nodes) in a network. This contention resolution typically is based on cooperative protocols, such as IEEE 802.11 distributed coordination function (DCF), which is a popular protocol for wireless networks.

The operation of the DCF protocol is based on time multiplexing access of the terminals to the network, and it is assumed that all the terminals in the network will obey the protocol guidelines. However, the pervasive nature of wireless networks together with the requirement for flexible and readily reconngurable protocols has resulted in wireless network devices becoming easily programmable. Wireless interface software, such as MadWifi for the Atheros chipsets (http://madwifi.org/ ) or the ipw series for the Intel PRO/Wireless chipsets (e.g. http://ipw2100.sourceforge.net/), can be easily modified and the protocol parameters can be changed by users so that one particular network terminal is capable of deviating from legitimate operation of a network transmission protocol in order to gain an advantage over other network terminals (i.e., referred to as selfish misbehavior), or to disrupt the network operation (i.e., referred to as malicious misbehavior). Therefore, it is necessary to have a mechanism to detect when a network terminal is deviating from legitimate operation under the protocol rules. Unfortunately, detecting such deviation is difficult due to the random operation of the CSMA/CA protocol and the nature of the wireless medium itself, where network channel impairment and interference make network conditions appear different for different terminals.

Deviation from legitimate protocol operation in wireless networks has received considerable attention. Most of the current research focuses on malicious misbehavior, in which terminals do not obey the protocols with the sole objective of disrupting the operation of the network, even to the deviating terminal's own determent. Malicious misbehaviors of this kind are often referred to as denial-of- service (DoS) attacks.

While malicious misbehavior is abundant, it is usually limited to a small percentage of users. Selfish misbehavior, on the other hand, is employed by users who wish to increase their own share of the common network transmission resources.

Selfish misbehaviors on network terminals are often analyzed in the framework of game theory, as such terminals compete to maximize their own utilities, such as allowed bandwidth, for example. An example of selfish misbehavior involves a network terminal refusing to forward data packets on behalf of other hosts to conserve energy. Another example of selfish misbehavior involves a user knowingly modifying protocol parameters to allow a network terminal to obtain unfair access to a network communication channel, such as a greater data transmission bandwidth, for example.

Selfish misbehavior has been studied in various scenarios in different communication layers and under several mathematical frameworks. Most notably, a heuristic set of conditions has been proposed for testing the extent to which Medium Access Control (MAC) protocol parameters have been manipulated. The heuristic nature of this method limits its application to specific protocols and the technique can be compromised by any terminal that knows those conditions.

A modification to the IEEE 802.11 MAC protocol has been proposed to detect selfish misbehavior. This approach assumes a trustworthy receiver, which assigns to a sender a back-off value to be used. Relying on the receiver and modifying the IEEE 802.11 protocol are drawbacks to this approach. In another approach, a detection framework has been employed to analyze the instance of theoretical worst-case attacks. This approach is more robust. However, no operational method to detect misbehavior is offered. The prompt detection of misbehaving network terminals is a significant security issue. It has been shown that an IEEE 802.11 DCF can be designed with complete stability (i.e., free of misbehavior) if a way to detect terminals that deviate from the IEEE 802.11 protocol can be found. See Toledo, Alberto Lopez, et al., "Adaptive Optimization of IEEE 802.11 DCF Based on Bayesian Estimation of the Number of Competing Terminals," IEEE Transactions in Mobile Computing, Volume 5, No. 9, pp 1283 - 1296, September 2006.

SUMMARY OF THE INVENTION

Methods and apparatuses are disclosed for detecting deviations from legitimate operation on a wireless network. For example, the disclosed methods and apparatuses can detect an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network.

One aspect is directed to a method for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, comprising: detecting a sequence of observable events related to operation of an entity in the wireless network; determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and comparing a function of the first output with a function of the second output to determine whether the particular entity is deviating from legitimate operation of the network transmission protocol.

Another aspect is directed to an apparatus for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, comprising: means for detecting a sequence of observable events related to operation of an entity in the wireless network; means for determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; means for obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and means for comparing a function of the first output with a function of the second output to determine whether the particular entity is deviating from legitimate operation of the network transmission protocol. Another aspect is directed to an apparatus for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, comprising: a detector coupled to the wireless network and configured to detect a sequence of observable events related to operation of an entity in the wireless network; a first calculation module configured for determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; a second calculation module configured for obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and a comparator configured for comparing a function of the first output with a function of the second output to determine whether or not the particular entity is deviating from legitimate operation of the network transmission protocol.

Another aspect is directed to an apparatus for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, the apparatus comprising: a data input module configured to communicate with a router and receive data related to transmissions of terminals; and a digital data processing device. The digital data processing device is configured to: receive the data from the input module; detect a sequence of observable events related to operation of an entity in the wireless network; determine from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; obtain a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and compare a function of the first output with a function of the second output to determine whether or not the particular entity is deviating from legitimate operation of the network transmission protocol.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. IA is an illustrative graph of observed collision probabilities with one misbehaving terminal in an IEEE 802.11 DCF network.

Fig. IB is an illustrative graph of observed transmission probabilities with one misbehaving terminal in an IEEE 802.11 DCF network, according to one embodiment of the disclosed subject matter.

Fig. 2 is an illustrative graph of a probability density function and a histogram of the number of idle slots between successful transmissions in an IEEE 802.11 DCF network with ten saturating terminals.

Fig. 3 is an illustrative graph of the average number of network terminals involved in a collision in a standard IEEE 802.11 DCF network when all the terminals are not deviating from the 802.11 protocol. Fig. 4 is an illustrative graph of an estimated collision probability determined using the collision factor for fifteen competing terminals.

Fig. 5 is an illustrative block diagram of a wireless network employing a system and method to detect a network terminal that deviates from legitimate operation of a network transmission protocol, according to one embodiment of the disclosed subject matter.

Fig. 6 is an illustrative flow diagram of a batch Kolmogorov-Smirnov (K-S) algorithm for detecting a terminal that deviates from legitimate operation of the IEEE 802.11 DCF protocol, according to one embodiment of the disclosed subject matter.

Figs. 7A and 7B are illustrative flow diagrams of an N-truncated sequential K-S algorithm for detecting a terminal that deviates from legitimate operation of the IEEE 802.11 DCF protocol, according to another embodiment of the disclosed subject matter.

Fig. 8 is an illustrative graph of the observed difference in probability of collision by a misbehaving terminal for a network with twenty terminals.

Fig. 9 is an illustrative graph of the cumulative distribution function (cdf) for various misbehavior strategies compared to a strategy of a legitimate terminal.

Fig. 10 is an illustrative graph of a comparison of the probability of detection with the batch K-S detector and the optimal Neyman-Pearson detector for a network of ten terminals, according to one embodiment of the disclosed subject matter.

Fig. 11 is an illustrative graph of the number of samples needed to detect a misbehaving terminal for different contention window (CW_m\^) strategies.

Fig. 12 is an illustrative graph of the performance of the batch K-S detector for an IEEE 802.11 DCF network with one misbehaving terminal using strategies CW_m\n = 8, CW_mi_n = 16 and CW_m\n = 2O₃ according to one embodiment of the disclosed subject matter. Fig. 13 is an illustrative graph of a significance level of the N-truncated sequential K-S test for misbehavior patterns CW_m\_n = 8 and CW_m\π = 16, legitimate strategy CW_mi_n = 32, and legitimate strategy CW_m\n - 40, according to one embodiment of the disclosed subject matter.

Fig. 14 is an illustrative graph of average stopping times of N-truncated sequential K-S tests for different misbehavior strategies compared to an optimal sequential probability ratio test (SPRT) at a probability density (Pp) = 0.99, according to one embodiment of the disclosed subject matter.

Fig. 15 is an illustrative graph of an average number of samples taken by a 1000-truncated sequential K-S test compared with a batch K-S test, according to one embodiment of the disclosed subject matter.

DETAILED DESCRIPTION OF THE PRESENTLY PREFERRED EMBODIMENTS The disclosed subject matter provides, among other things, a method and apparatus for detecting an entity (e.g., a network terminal) in a wireless network that deviates from legitimate operation of a network transmission protocol (i.e., a misbehaving terminal) on the wireless network. In some embodiments, the system and method are used to detect misbehaving terminals in a CSMA/CA network by measuring/observing the number of idle slots between successful transmissions of terminals in communication with the network. The Kolmogorov-Smirnov (K-S) test is employed to determine whether the measurements/observations are consistent with a hypothesis that a particular terminal is abiding by the CSMA/CA protocol rules. Two misbehaving terminal detection algorithms are described. Specifically, a batch K-S detection algorithm and a N-truncated sequential K-S detection algorithm are described and used to detect misbehaving terminals in an IEEE 802.11 DCF network.

The CSMA/CA protocol is designed under the assumption that all participant terminals (i.e., nodes) abide by the protocol rules. This is of particular importance in distributed protocols such as the IEEE 802.11 DCF, in which network terminals (i.e., network nodes) control their own back-off window. The disclosed subject matter provides a method and system to detect network terminals that have had their back-off windows deliberately modified to obtain unfair access to network resources, such as data transmission bandwidth, for example. The method and system involves non-parametric batch and N-truncated sequential detection algorithms based on the Kolmogorov-Smirnov (K-S) statistics that do not require any modification of the existing CSMA/CA protocol. Further, in one embodiment, the method and system is implemented to detect network terminals that deviate from legitimate operation in an IEEE 802.11 DCF network.

The CSMA protocol is a contention-based MAC protocol in which a transmitting terminal detects and scans the shared wireless medium before transmitting. The rationale behind this transmission protocol is to avoid more than one terminal transmitting data at the same time, hence avoiding data collisions. If a channel is determined to be busy or a collision occurs, the terminal waits for a randomly chosen period of time (i.e. back-off interval). The back-off interval is the number of contention slots the terminal waits before re-transmitting. This randomly chosen period of time is selected from a range of times (i.e., range of numbers of contention slots (the back-off window)), The terminal then checks again to see if the communication channel is clear. Collision avoidance (CA) is used to improve the performance of CSMA by attempting to reserve the network for a single transmitter. This is important for systems in which collisions are very costly, such as in wireless networks, where they cannot be detected by the terminals producing them.

The IEEE 802.11 DCF protocol is a CSMA/CA protocol that defines two distinct techniques to access the wireless medium. The two techniques include basic access and request to send/clear to send (RTS/CTS) access. In basic access, network terminals implement a two-way handshake mechanism. A terminal scans a communication channel and detects if the channel is idle before starting a transmission. If the channel is idle for at least a period of distributed interframe space (DIFS), then the terminal is allowed to transmit. If during this detecting time the channel appears to be busy at any time, the terminal defers the transmission and enters into the collision avoidance (CA) mode. In CA mode the terminal generates a random back-off interval during which it waits before attempting another transmission. This random back-off interval is used to minimize the probability of collision between terminals accessing the wireless medium. The idle time after waiting a DIFS interval is slotted, and the terminals are only allowed to transmit at the beginning of the slot.

The random back-off interval is uniformly chosen between [0, v] (in the sense that a uniform probability distribution is used to randomly pick a value between 0 and v with equal probability), where v is called the contention window, and satisfies the function: v * e [CW_mi_n,CW_maχ], where CW_mi_n and CW_max are called the minimum and maximum contention windows respectively. Typically, CW_mi_n = 32 and CW_max = 1024. At the first transmission attempt, v is set to CW_min. The back-off timer is decremented while the channel is idle (i.e., the timer only counts the idle time). If at any time the terminal detects that the channel is busy, the backoff timer is paused until the terminal detects that the channel is idle again after the corresponding DIFS time. When the back-off timer reaches 0, the terminal is allowed to transmit.

Following the successful reception of the data, the receiving terminal waits for a short interframe space (SIFS) interval and transmits an acknowledge signal (ACK) to the transmitting terminal. As the SIFS interval is shorter than the DEFS interval, the destination terminal has priority in sending the ACK. The other terminals would wait for a DIFS time before transmitting, and hence will find the medium busy while they wait. Such a two-way handshake-based ACK is necessary because the CSMA/CA protocol does not assume that the terminals have the capability to detect collisions. Upon reception of the ACK, the back-off timer is reset to 0 and v = CW_mi_n.

If the transmitting terminal does not receive the ACK signal after a timeout period (i.e., ACK timeout) or it detects the transmission of any other frame in the channel (i.e., a collision), the frame is assumed to be lost. After each unsuccessful m transmission, the value of v is doubled up to a maximum of CW_max —2 CW_mj_n where m is typically referred to as the maximum back-off stage. This mode of operation is typically referred to as a binary exponential scheme. The values of CW_mi_n, CW_max, and the slot size (i.e. duration of the slot) are determined by the characteristics of the physical layer of the network.

RTS/CTS access is similar to basic access. However, it makes use of a four- way handshake protocol in which, prior to data transmission, a terminal transmits a special short request-to-send frame (RTS) to try to reserve the transmission window and reduce the cost of collisions. Given its distributed nature, the operation of the IEEE 802.11 DCF protocol is based on the premise that individual terminals correctly assign their respective back-off intervals according to the protocol. In the absence of a central controlling unit enforcing this policy, a terminal that deviates from legitimate operation (i.e., a "deviating " or "misbehaving" terminal) might try to select back-off intervals that are smaller than allowed by the protocol to gain a significant advantage in channel access probability over time. By increasing their transmission probabilities, misbehaving terminals produce an increase in the number of collisions in the network, forcing the rest of the legitimate terminals (i.e., terminals that abide by the protocol, or "non-misbehaving" terminals) to increment their back-off intervals, further increasing the advantage for the misbehaving terminals.

Typical techniques implemented to create a misbehaving terminal include: reducing the terminal's contention window, selecting a smaller minimum window size for the terminal, or using a different scheme instead of the binary exponential scheme (i.e., waiting for a fixed amount of time).

Referring to Figs. IA and IB, illustrative graphs of observed collision probabilities and observed transmission probabilities with one misbehaving terminal in an IEEE 802.11 DCF network are shown. Each point is calculated by a terminal listening to all the transmissions in the network and calculating the proportion that resulted in a collision. Any terminal can observe any transmission and determine if it is successful or if it is a collision, and this is a capability inherent in any wireless card. For Fig. IA, the graph shows the calculation result of number-of- collisions/number-of-total-transmissions. For Fig. IB, the graph shows the calculation result of number-of-successful-transmissions/time.

The effect of a misbehaving terminal can be significant to the operation of the DCF protocol, especially for the legitimate terminals. The one misbehaving terminal uses either a fixed back-off window with CW_mi_n = CW_maχ = 8 (i.e., an intense misbehavior), or uses the binary exponential protocol with CW_mi_n = 16 and CWmax = 1024 (i.e., a moderate misbehavior). It can be seen that the misbehaving terminal will observe a much reduced collision probability, which results in a share of the medium (i.e. transmission probability) that can be even higher than five times that of the legitimate terminals. The difference is notable even for more moderate misbehaviors, hence there is a strong incentive for a terminal to misbehave, as the potential benefit in terms of increased throughput is high even for a small deviation from the DCF protocol.

It is important to note that a misbehaving terminal is completely unpredictable. This uncertainty makes detecting misbehaving terminals difficult. The method and system described in the subject matter disclosed below involves detecting when a terminal is misbehaving by observing the operation of the misbehaving terminal in the network.

Let χ _ls ..., χ _n be a sequence of observations related to the operation of a CSMA/CA terminal. There are two hypotheses that are made. They include a null hypothesis Ho and an alternate hypothesis Hi . The null hypothesis Ho corresponds to a situation when the observed terminal is not misbehaving (i.e., a legitimate terminal). The alternate hypothesis Hi corresponds to a situation when the observed terminal is misbehaving. The null hypothesis HQ is selected to the hypothesis of the terminals not misbehaving (and hence it is favored relative to Hi) because the cost of a false alarm (i.e., incorrectly determining that a terminal is misbehaving) is high (e.g., disconnecting a legitimate terminal from the network). It is important to guarantee that the legitimate terminals are not incorrectly determined to be misbehaving and thereby potentially leading to their being disconnected from the network. The problem is written as: H₀: χι, ..., Xn~fo (Eq. Ia),

where yό and// are the respective probability distributions of the observations when a terminal is not misbehaving and when it is misbehaving. These probability distributions are referred to as the "strategy" of a terminal.

The IEEE 802.11 DCF protocol defines the method to select the back-off intervals. It is useful to know the sequence of back-off intervals selected by a given terminal. In particular, it is useful to know how many idle slots the terminal waited since its last transmission before attempting a new transmission, so that it can be determined if that sequence corresponds to a binary exponential increase with the correct CW_mi_n and CW_max parameters. However, the sequence of back-off intervals selected by a terminal is not directly observable in a CSMA/CA system, and in particular in an IEEE 802.1 1 DCF system, because the only observable transmissions from a terminal are successful transmissions. Attempted transmissions that result in collisions can be observed, but it is not possible to distinguish which terminals are involved in the collisions. Therefore, the observable events are the specific times at which a given terminal transmits.

Because the terminals only decrement their back-off counters when the channel is idle, the number of idle slots between two consecutive successful transmissions of a certain terminal is calculated. The procedure described with respect to Eq. Ia and Eq. Ib is used to obtain the number of idle slots in the network. For example, consider the RTS/CTS access in a IEEE 802.11 DCF network. Let t_t., be the end time of the last transmission of any terminal and let tj be the time of a current RTS packet reception. It is assumed that these events are observable from all the terminals within range of the wireless transmissions (i.e. two terminals are within range of each other if they can detect each other's transmissions). The number of idle slots between those events can. be calculated as follows: X i - (U - U-I - TDIFS - ToiHER^/σ, i >1 (Eq. 2), where T_DI_FS is the duration of the DIFS frame, σ is the duration of an idle slot, and T_OTHERS is the duration of transmissions from other terminals and collisions, including their interframe times. More detail regarding T_OTHERS IS available, for example, in the above-mentioned Toledo et al. article relating to Fig. 1 thereof.

A terminal that is not directly within range of the terminal that transmits the RTS frame can also compute the back-off interval by using as a reference the tune of reception of the overheard ACK from the receiver of the previous data segment as follows: X , = (t', - T_Acκ,,-i - TDIFS - T_RTS - T_SIFS -T₀THERS)/O, / >1 (Eq 3), where t \ is the time of reception of the CTS packet, T_AC_K I-I is the duration of the previous ACK frame, and TD_IFS, T_SIFS, and T_RTS are the durations of a DIFS and SIFS peπods, and the RTS frame respectively. The number of idle slots for the case of basic access can be obtained similarly. To calculate the distribution of the observations χ , under Ho, a typical IEEE

802.11 DCF network, where CW_mm = 32 and CW_max = 1024, is considered. The distribution /o of the number of idle slots a terminal would wait between successful transmissions is derived as descπbed below. Although the possible back-off values are discrete, for simplicity, continuous distributions are used to facilitate mathematical treatment. Assume that the legitimate terminal is saturating (i.e., it always has a packet to send), and let/>_cbe the probability that the terminal will experience a collision if it transmits in the current slot. After a successful transmission by a terminal, the next attempt to transmit will happen after r_/ idle slots where ry ~ U[O, 32] and U denotes the uniform probability distribution The probability that a transmission will be successful is (1 -ρ_c ), and hence χ, = T_/

If there is a collision, with probability p_c, then the terminal would double its window size and make another attempt after τ^ ~ U[O, 64] slots. If the last transmission is successful, then the number of idle slots after the last successful transmission is χ , = (ti + τ₂) ~ (U[O, 32] + U[O, 64]) with probability p_c (1- p_c ). Following the above argument the distribution of the number of idle slots between successful transmissions, fo(χ_x) can be obtained according to the following equation (assuming p_c does not vary between successful transmissions):

P«"0 -A)

(Eq. 4), where U₀ < I_max is the number of collisions that the transmission undergoes and I_max is the maximum allowable number of collisions. Referring to Fig. 2, in one embodiment, a graph of the probability density function (pdf) (see Eq. 4) and the histogram of the number of idle slots between successful transmissions in an IEEE 802.11 DCF network with ten saturating terminals is shown.

The pdf fo calculated above is referred to as the "strategy" of a saturating legitimate terminal. In other words, it is a terminal that follows the IEEE 802.11 DCF protocol and always has a packet to send. The calculation of fo utilizes an estimation of the collision probability/^ for the legitimate terminals, which is discussed in detail below.

Unlike the strategy of a legitimate terminal, the unknown strategy of a (potentially) misbehaving terminal is not unique. Assume/} is the unknown strategy of the observed potentially misbehaving terminal. In order to characterize and quantify the misbehavior, the strategy /_/ is compared to the strategy fo of the legitimate terminal. Fj(χ) and F₀(χ) denote the cumulative distribution functions (cdf) for/} and fo, respectively. For a terminal that abides by transmission protocol rules and is saturating, the relationship Fj(χ) = Fo(χ) applies. If the terminal is not saturating (e.g., the terminal rests for an unknown time Δ > 0 after each transmission or after some transmissions), then the terminal's cdf satisfies the expression: F](χ) < Fo(χ), Vχ ■ In general, for any terminal using the correct protocol, either saturating or not, then Vj, Fj(χ) <_Fo(γ). If the cdf of a terminal is always on or below the cdf of a well-behaved terminal that is always transmitting, then the terminal is not misbehaving.

Therefore, a terminal using an unknown strategy fj with cdf Fj is misbehaving, if 3χ, s.t. F_/(χ) >Fo(χ), where FQ is the cdf of the strategy of a legitimate terminal that is saturating. It should be noted that the definition of misbehavior does not take into account the transmission probability (and hence, the throughput) of the terminals. It is common to find a terminal for which there exists one point a such that Fj(a) >Fo(a), where \fχ ≠ a Fj(χ)≤Fo(χ), and that has a transmission probability lower than that of the legitimate saturating terminal, and therefore appears non-misbehaving. However, the CSMA/CA protocol is designed so that the transmissions of a terminal are distributed as uniformly as possible in time to avoid collisions. Fairness is achieved as long as every terminal uses the same strategy. A terminal transmitting less than a legitimate terminal but using a different strategy may produce a disruption in the service during its transmission attempts, perturbing the normal operation of the protocol. Those terminals should be considered as misbehaving terminals.

The following is a discussion regarding a detection algorithm that can discriminate between a legitimate terminal using a strategy fo and a misbehaving terminal that does not. A non-parametric test based on the Kolmogorov-Smirnov statistic is used to perform the detection. In order to obtain the probability distribution function fo of the idle slots between successful transmissions for a saturating legitimate terminal, the probability of collision p_c in the network is estimated. A terminal can keep track of its own transmissions and count how many of its transmissions resulted in collisions. An estimate of the collision probability is given by the following equation: p_e = £ (Eq. 5), where T is the number of transmission attempts and C is the number of transmission attempts resulting in collisions. The terminal may increase or decrease the observation interval by changing the number of transmission attempts T to estimate the varying collision probability^ more accurately. The above approach requires the measuring/observing terminal to transmit in order to count the number of transmission attempts that result in a collision, which makes this approach unsuitable for terminals that do not have anything to transmit. Moreover, if a misbehaving terminal is present in the network, the transmission rate of a legitimate terminal could be much lower than that of the misbehaving terminal, so the above estimator could be too slow compared to the transmission rate of a misbehaving terminal. A faster estimate can be obtained if a terminal does not count how many of its own transmissions resulted in collisions, but instead how many of the total number of transmissions in the network resulted in collisions. While it is not possible to observe how many terminals attempted a transmission for any given collision because the identity and the number of the colliding terminals is hindered by the collision itself, the average number of terminals colliding (i.e., collision factor) r is a function of the protocol and the number of terminals competing in the network. The collision factor F is obtained counting the number of terminals involved for each collision, and then taking an average over the number of

JC -\-X + .. +X collisions. Thus, for n collisions, T = - — — - , where x,- is the number of n terminals involved in the i-th collision.

For example, Fig. 3 shows the average number of terminals involved in a collision in a standard IEEE 802.11 DCF network with CW_min = 32 and CW_mBX = 1024 when all the terminals are well behaved. The estimate of the collision probability is given by the following equation: CF

'^{• =}Tϊcr ^{(Eq 6)}' where C is the number of collisions, T' is the number of successful transmissions observed by the terminal in the network, and F is the collision factor. Note that T' +

CF is the average number of transmission attempts in the network, and CF is, on average, how many of the transmissions resulted in collisions. As before, the measuring/observing terminal may increase or decrease the observation interval T'.

The estimate p_e includes F, which corresponds to the number of competing terminals N. While N can be estimated with various techniques known to those skilled in the art, in an IEEE 802.11 DCF network with N < 25 (i.e., terminals that are simultaneously transmitting at any given point in time, not the total number of terminals in the network), it is possible to select a fixed F = 2.14, which corresponds to N = 15, such that (p_c -p_c ) < 0.001, and (p_c -p_c ) < 0.004 for any given N, as shown in Fig. 4. The small error in the estimation of the collision probability has virtually no effect on the false alarm probability of the detectors, and its simplicity comes at the cost of reducing the probability of detection, although only for misbehavior cases that are extremely close to the legitimate operation of the protocol.

It is expected that the true collision probability p_c varies slowly with respect to the time scale of the transmissions by any terminal in the network. The noise in the estimates p_c and p_c may overshoot p_Q so that a legitimate terminal may appear as misbehaving. This is of little concern when there is a misbehaving terminal in the network because the difference in collision probability is larger than the noise.

However, the noise affects the false alarm probability. Because the cost of a false alarm is very high, the collected data is filtered to reduce the noise by using a robust locally weighted polynomial regression model with a smoothing parameter of five.

Let pl^l) ,..,plⁿ⁾ be the sequence of collision probabilities estimated using Eq.

6 and let the collision probabilities then be filtered as described above. The cdf of the number of idle slots between successful transmissions for a legitimate saturating terminal can be calculated as the average of the cdfs for each of the observed /j*° , as shown by the following equation:

where Fo(p^) is the cdf calculated using Eq. 4 with the collision probability p^ .

The Kolmogorov-Smirnov (K-S) test is a widely used goodness-of-fϊt test for continuous data. It is based on an empirical distribution function (edf), which converges uniformly to the real population cdf (Glivenko-Cantelli Theorem), and is known to those skilled in the art. The K-S test is used to determine whether the distribution f_\, from which samples are drawn, differs from a hypothesized distribution yjj. The K-S test compares an edf Fx obtained from the data samples with the hypothesized cdf Fo, and determines whether Fi = FQ, F₁ <FQ, or Fi >Fo. A null hypothesis Ho is defined as an event where a node is not misbehaving, and is used in the one-sided test shown below:

Ho : Fi < F₀ (not misbehaving) (Eq. 8a),

Hr- F_x > F₀ (misbehaving) (Eq. 8b).

Let Xi,..., X_N be the observations of the number of idle slots between successful transmissions from a terminal using an unknown strategy f_\. Also, let fo be the known probability distribution of a saturating legitimate terminal as specified in Eq. 4. The edf of the observations is given by the following equation:

where IT ( ) is the indicator function. A one-sided K-S test statistic D is defined as the maximum value of the difference between the two cdfs, as shown by the following equation: DA max {Fι(χ) - Fo(χ)} (Eq. 10) and is calculated as shown in the following equation: D = max JF₁(J,) - Fo( χ>)} (Eq. 11), where F₀ and F_/ are calculated using Eq. 7 and Eq. 9, respectively.

The null hypothesis Ho is rejected at a significance level α if P (D >D) < a according to the following equation:

P(D > D) = _e ^~2λφΫ (Eq. 12), where λ(D) is obtained using the following equation:

(Eq. 13).

Using the equations described above, two detection algorithms are derived, which can be used to detect if a terminal is deviating from legitimate operation of a network transmission protocol (i.e., misbehaving) in a wireless network, and are discussed in detail below. The first algorithm is referred to as a batch K-S detection algorithm (i.e., a batch K-S test), and the second algorithm is referred to as a N- truncated sequential K-S detection algorithm (i.e., a sequential K-S test).

In one embodiment, the batch or N-truncated sequential detection algorithm is implemented in software that resides and executes on an observing terminal (i.e., a terminal that observes the other terminals in communication with the wireless network) that is in communication with the wireless network. In another embodiment, the software resides and executes on an access point that is part of the wireless network. In still another embodiment, the software resides and executes on each terminal in communication with the wireless network and each terminal observes any neighboring terminals. In yet another embodiment, the software resides and executes on a digital data processing device (e.g., a computer) in communication with a server and a router. The digital data processing device receives data from the router that is analyzed and used to identify misbehaving terminals. After the misbehaving terminals are identified, the digital data processing device transmits information regarding the misbehaving terminals to the server.

It is readily apparent that software incorporating an embodiment of the present invention can be, for example, part of the Wi-Fi connection software, i.e. it is included in the driver provided by the card manufacturer. However a third party could modify a driver and put in on the web, so the user can voluntarily go and install this misbehavior-enabled driver instead of the one provided by the manufacturer. In the case of a router or access point, the manufacturer could implement an embodiment of the present invention on its own software.

Referring to Fig. 5, in one embodiment an illustrative block diagram of a wireless network employing a system and method to detect a network terminal that deviates from legitimate operation of a network transmission protocol (i.e., a misbehaving terminal) is shown. The wireless network includes a wireless access point 102, which provides connectivity to a network 104 (e.g., local area network, wide area network, World Wide Web, or the Internet). The wireless network further includes wireless terminals 106, 108, 110, 112, 114, which wirelessly connect to the access point 102.

In this illustrative embodiment, wireless terminals 106, 108, and 110 are terminals that do not deviate from legitimate operation of the IEEE 802.11 DCF protocol, wireless terminal 112 is a terminal that is observed for the purpose of determining if it deviates from legitimate operation of the IEEE 802.11 DCF protocol (i.e., observed terminal), and wireless terminal 114 is an observing terminal on which the software (i.e., either the batch detection algorithm or the N-truncated sequential detection algorithm) resides and executes, and which observes the other terminals in the wireless network.

Referring to Fig. 6, in one embodiment, a flow diagram of a batch K-S detector algorithm for detecting a terminal that deviates from legitimate operation of the IEEE 802.11 DCF protocol is shown. First, the observing terminal 114 calculates K observations of the number of idle slots between successful transmissions of the observed terminal 112 (x\, ..., x_κ ) using Eq. 2 or Eq. 3 (Block 602). The observing terminal 114 also calculates the edf Fi from the observations of the observed terminal 112 using Eq. 9 (Block 604). The observing terminal 114 calculates new estimates of the collision probabilities pj.^l), .., p^ using Eq. 6, every T¹ successful transmissions in the network (from any terminal) (Block 606). The observing terminal 114 filters the estimates of the collision probabilities as previously described (Block 608). The observing terminal 114 then calculates the cdf of a legitimate terminal Fo using Eq. 7 (Block 610).

Implementation of the above-described operations can be done sequentially, with the time relationship being: 602->604. 606->(608)->610. {604,610}->612. In other words, for 604, only 602 is needed. For 610, only 608 is needed, and for 608 only 606 is needed. However, for 612, both 604 and 610 are needed. Operations 602 and 606 can be performed in any order.

It should be noted that filtering per block 608 is regarded as being optional.

After the K-th successful transmission of the observed terminal 112, the observing terminal 114 uses the collected sequence of idle slots between successful transmission x\, ..., xκ and the calculated sequence of estimates of the probability of collision p™, .., pl^q) to perform the one-sided K-S test (with a false alarm probability P_FA — α) for Fi > Fo to obtain the significance level P using Eq. 12 (Block 612). The observing terminal 114 then compares P to α (Block 614). If P < α, then according to the Eqs. 8a and 8b, Hb is rejected and the observed terminal 112 is misbehaving (Block 616). If P > α, then according to Eqs. 8a and 8b, Ho is not rejected and the observed terminal 112 is not misbehaving (Block 618).

As previously mentioned, in other embodiments, the software (i.e., the detection algorithm) can be executed by any (or all) terminal(s) in the wireless network. In still another embodiment, the IEEE 802.11 DCF network access point 102 (AP) executes the algorithm and collects samples x_\ and observes each terminal 106, 108, UO₅ 112, 114. Upon the detection of a misbehaving terminal, the access point 102 can take appropriate actions, such as disconnecting the misbehaving terminal from the network for a period of time. In the case of an ad-hoc network, each terminal may implement the algorithm and observe neighboring terminals. If one terminal discovers an offending terminal, the discovering terminal can deny forwarding privileges to the discovered misbehaving terminal. In still other embodiments, terminals may monitor other neighboring terminals and implement a Nash equilibrium punishing strategy to dissuade other terminals from misbehaving.

The observing terminal in a wireless network makes the above-described calculations in a sequential manner. Therefore, instead of using a fixed number of observations for the K-S test (as described with respect to the batch K-S detection algorithm), in another embodiment, some calculations can be made after a few samples while other calculations are made after many samples. This embodiment is referred to as the N-truncated sequential K-S detection algorithm. As previously described, the batch K-S detection algorithm involves using a fixed number of samples. However, the significance values of the K-S statistic (see Eq. 12) enable sequential decisions to be made on the null hypothesis. With each new sample, the edf F₁ is updated and the K-S statistic (Eq. 12) is reevaluated.

In one embodiment, an N-truncated sequential K-S detection algorithm is formed by concatenating N K-S tests, starting with one sample and adding one sample at each subsequent stage up to N stages, where N is the truncation point of the test. The false alarm probability of the N-truncated sequential K-S detection algorithm is fixed to /V_A ⁼ <*■• Because the N-truncated sequential K-S test is composed of N tests, the false alarm probability of each of the N stages is calculated in order to achieve the overall P F_A- If β be the false alarm probability of each stage, then the resulting Pp^ of the N-truncated sequential K-S detection algorithm is calculated using the following equation:

P*? = /3 + (l - /?)/? + (l- /?⁾²/? + ... + (l - /?)"^"' β = \~(l - β)^N = a (Eq.14). In order to obtain /V_A = oc in the N-truncated sequential K-S detection algorithm, each individual K-S test uses the threshold/? where

Referring to Figs. 7A and 7B, in one embodiment, a flow diagram of a N- truncated sequential K-S detector algorithm for detecting a terminal that deviates from legitimate operation of the IEEE 802.11 DCF protocol is shown. First, an observing terminal (e.g., terminal 114 of Fig. 5) selects the maximum number of observations N (Block 702). Next, the observing terminal 114 sets a counter "n" to zero (Block 704). The observing terminal 114 next calculates an observation of the number of idle slots x_\, ..., x,,.j, between transmissions of the observed terminal (e.g., terminal 112) using Eq. 2 or Eq. 3 (Block 706). The observing terminal 114 then calculates the edf Fi with the observation of the observed terminal 112 using Eq. 9 (Block 708). The observing terminal 114 calculates estimates of the collision probabilities p^\ • • ■ P ~ ^ using Eq. 6 (Block 710). The observing terminal 114 filters the estimates of the collision probabilities as previously described (Block 712). The observing terminal 114 then calculates the cdf of a legitimate terminal F₀WiIh. the estimates of the collision probabilities using Eq. 7 (Block 714). The observing terminal 114 then calculates threshold/? according to Eq. 15 (Block 716). The observing terminal 114 increments the counter n by one (i.e., n = n + 1) (Block 718).

The observing terminal 114 next calculates a new observation x_a of the number of idle slots between transmissions of the observed terminal (e.g., terminal 112) using Eq. 2 or Eq. 3 (Block 720). The observing terminal 114 then updates the edf Fi with the observation x_n of the observed terminal 112 using Eq. 9 (Block 722).

The observing terminal 114 then calculates new estimates of the collision probabilities /?_c ^(r+1), p^^r+2\ ... p^ since the last observation X_n-I (using Eq. 6) every T successful transmissions in the network (from any terminal), where p^^r) is the last estimate from stage rø-1 (Block 724). The observing terminal 114 then updates the cdf of a legitimate terminal F₀ with the estimates of the collision probabilities using Eq. 7 (Block 726).

When the next successful transmission of the observed terminal 112 occurs, the observing terminal 114 calculates the number of idle slots x_n since the last transmission (Block 728), and then uses the collected sequences of idle slots since stage one (x_I} ..., x_n) and the calculated sequence of estimates of the probability of collision P_c \ --,pl^g) to perform the one sided K-S test (with a false alarm probability P_FA = β) for Fi > Fo to obtain the significance level P using Eq. 12 (Block 730). The observing terminal 114 then compares P to β (Block 732). If P < β, then according to the Eqs. 8a and 8b, HQ is rejected and the observed terminal 112 is misbehaving (Block 734). If P > β, then observing terminal 114 checks to see if n = N (Block 736). If n = N₅ then Hb is not rejected and the observed terminal 112 is not misbehaving (Block 738). If n ≠ N, then the observing terminal 114 returns to Block 716 (Block 740). This process continues until a misbehaving terminal is detected or n = N.

In order to avoid having too few estimates of the collision probability (e.g., when n is small), a minimum of ten estimates of the collision probability are obtained before the beginning of the detection steps. These estimates are discarded as new estimates are collected. The detection methods described above were tested using a simulated IEEE

802.11 DCF network, where a legitimate terminal was assumed to have CW_mm ~ 32 and CJF_max = 1024. An ad-hoc based IEEE 802.11 DCF simulator written in MATLAB was used to obtain and verify the cdf of the saturating legitimate terminals (as shown in Eq. 4), and to implement the detectors. Other aspects of the simulations were implemented using a ns-2 network simulator (version 2.28 available as open source).

The simulated IEEE 802.11 DCF network was modified to implement the misbehaving terminal, e.g., changing parameters as described below, and also to implement the misbehavior-detecting terminals, e.g., implementing the Eq. (2) and (3) measurements, and everything else needed to perform the operations depicted in Figs. 6, 7A and 7B. With these modifications, the network terminals can measure the idle slots between successful transmissions for estimating the collision probabilities. The following parameters used in the simulation were typical for an eleven Mbps 802.1 Ib wireless local area network (WLAN). It was assumed that no packet fragmentation occurred, and that the network terminals were located close to each other to avoid capture or hidden terminal problems. Capture happens when the transmitting power of terminal A is much higher than terminal B. In that case a collision does not occur, because only A is heard. Hidden terminal problems occur when, for example, three terminals are positioned in a line A — B — C. A is only in range of B, C is only in range of B (i.e., A and C cannot detect each other, but both can transmit to B). If A and C transmit at the same time they definitely collide at B, but they cannot detect that there was a collision because they do not know of the other. A is a "hidden terminal" to C and C is a "hidden terminal" to A. The propagation delay was set to one μs. Data packet size was fixed with a payload of 1024 bytes. The MAC and PHY headers used 272 and 192 bits respectively. The acknowledge signal (ACK) length was set to 112 bits. The receive/transmit (Rx/Tx) turnaround time was set to 20 μs, and the busy detect time was set to 29 μs. The short retry limit and long retry limit was set to 7 and 4 retransmissions respectively. Finally, the slot time was set to 20 μs, the SIFS was set to 10 μs, and the DIFS was set to 50 μs.

Further, misbehaving terminals were assumed to use the binary exponential strategy with_. CW_max =2 CJF_1nI_n, and CW_min ε { 1, 2, ..., 32}. The case of CW_min = 32 corresponded to a legitimate terminal. The case of CW_m\_n = 16 corresponded to moderate misbehavior described above. Finally, the case of CW_mj_n = 1 corresponded to a case of extreme misbehavior.

Fig. 8 is an illustrative graph of the observed difference in probability of collision by a selfish terminal using the above-described misbehavior strategies for a network with twenty terminals. Fig. 9 is an illustrative graph of the cdf for various misbehavior strategies (i.e., CW_mϊ_n = 1-30) compared to the strategy of a legitimate terminal (i.e., CW_mi_n = 32) whenp_c = 0.1. All these cases represent an overview of the different intensity of misbehaviors, and provide a benchmark for the subjective performance of the described algorithms (i.e., the delay until making a decision). Note that for CW_m\n > 25, the effect of misbehavior is minimal, so the focus is on fast detection of the strategies with CW_m\n <25.

The algorithms described above were compared to optimal detectors

(described below) for both the batch and N-truncated sequential detection algorithms. Although the misbehavior strategy

is generally not known, the misbehavior strategy f\ was arbitrarily specified for the simulations. The performance of the optimal detectors with a known misbehavior strategy/} serves as the upper bound for the performance of the above-described batch and N-truncated sequential K-S detection algorithms.

The batch K-S detection algorithm was compared with the optimal Neyman-Pearson detector using the same P_fK — «• The N-truncated sequential K-S detection algorithm was compared with the optimal Wald's sequential probability ratio test

(SPRT) using the same P^_A ^{= α anc}* detection probability P_∑>. Referring to Fig. 10, an illustrative graph of a comparison of the probability of detection with the batch K-S detection algorithm and the optimal Neyman- Pearson detector for a network of ten terminals is shown. Terminal misbehavior cases CWxain = 8, CWmva. = 16 and CPFmin = 20, with a P_FK =0.05 are included. The batch K-S detection algorithm is able to detect the misbehavior terminals quickly, thus requiring less than twice the samples needed by the optimum detector with perfect information.

Referring to Fig. 11, an illustrative graph of the number of samples needed to detect a misbehaving terminal for different CW_m\_n strategies with /V_A = 0.05 and PD = 0.95 is shown. Note that the performance of the batch K-S detection algorithm starts to degrade only for CW_m\n > 29, which is very close to the strategy of a legitimate terminal. While the number of samples required grows exponentially as the difference in collision probability is reduced. The main focus is on detection of the class of misbehavior that results in larger gains for the misbehaving terminal. Such a misbehavior would have the most devastating effects on the network because it would deny channel access to the other terminals and would lead to unfair sharing of the channel.

Under good signal-to-noise ratio (SNR) conditions (e.g., in which transmission errors not caused by collisions, such as by low signal strength, are very rare.), a typical IEEE 802.1 Ig network can deliver approximately 24Mbps to the upper layers, resulting in an approximate throughput of 2230 packets per second, assuming packets of 1400 bytes each. On such a network, and taking into account the throughput of the misbehaving terminal for ten competing terminals, the batch K-S detection algorithm is able to detect the CW_min = 29 strategy in slightly less than 2 seconds, and all the misbehavior strategies CW_mj_n < 29 in less than one second. These times are comparable to the time a terminal needs to connect (and acquire an IP address) to an IEEE 802.11 network.

The batch K-S detection algorithm can be used without modification in a situation where the number of competing terminals is dynamically changing. When the number of competing terminals changes, the observed probability of collision changes accordingly. However, the batch K-S detection algorithm estimates the probability of collision within an observation window. The approximation is valid under the assumption that the probability of collision does not change between two successive transmissions for a given terminal. As discussed above, the speed of the estimation of p_c is fast enough to make at least one estimation of p_c for each successful transmissions of the observed terminal.

Referring to Fig. 12 an illustrative graph of the performance of the batch K-S detection algorithm for an IEEE 802.11 DCF network with one misbehaving terminal using strategies CW_m\n = 8, CW_m{_n = 16 and CW_mi_n = 20 is shown. This graph includes the case when the number of competing terminals is fixed, and when all the terminals (except the one misbehaving) connect to and disconnect from the network with an exponential distribution parameter of one second. Note that under such a high rate of change of the number of competing terminals with respect to a typical IEEE 802.11 DCF network, the performance of the batch K-S detection algorithm is very close to the case of a fixed number of terminals for P_D > 0.95. Next, the N-truncated sequential K-S detection algorithm was compared to an optimal SPRT with identical P_fA and PD- While the N-truncated sequential K-S detection algorithm can only fix P _FA, as the number of samples approaches infinity, the edf approaches the population hypothetical cdf, so the power of the K-S test can be increased with the number of samples with the consequent delay cost. However, it is not possible to specify an arbitrary P^ for the test. This is a consequence of the nonparametric nature of the K-S test. Referring to Fig. 13, an illustrative graph of the significance level of the N-truncated sequential K-S detection algorithm for the misbehavior patterns CW_m\n — 8 and CW_mi_n = 16, legitimate strategy CW_m\a = 32 and legitimate strategy CW_mi_n = 40 is shown. Note that the significance level converges to 0 when F_\(χ) >Fo(χ) and converges to 1 when F\(χ) < /⁷OCt). Also, note that the threshold β of each stage is much lower than α, so it requires more samples for detection than a batch K-S detection algorithm with the same number of samples. However, the performance of the N-truncated sequential K-S detection algorithm is very close to the batch K-S detection algorithm. Referring to Fig. 14, an illustrative graph of the average stopping times of the N- truncated sequential K-S detection algorithm for different misbehavior strategies compared to the optimal SPRT at PD — 0.99 is shown. The curves in Fig. 14 stop if the corresponding N-truncated sequential K-S detection algorithm is unable to obtain P_D = 0.99. The graph in Fig. 14 shows that increasing the truncation parameter N allows the method to detect those types of misbehavior that are less severe and hence more difficult to detect, but at the cost of slightly increasing their stopping times. The penalty being so small suggests that high N are preferable. Referring to Fig. 15, an illustrative graph of the average number of samples taken by the 1000-truncated sequential K-S detection algorithm compared with the best batch K-S detection algorithm (i.e., the fixed-sample-size K-S test that achieves the same Po with the minimum number of samples) is shown. The graph in Fig. 15 shows that the N-truncated sequential K-S detection algorithm is virtually as good as the best batch K-S detection algorithm. This result shows that the N-truncated sequential K-S detection algorithm does not have a significant performance loss compared to the batch K-S detection algorithm.

Variations, modifications, and other implementations of what is described herein may occur to those of ordinary skill in the art without departing from the spirit and scope of the disclosed subject matter. Further, the various features of the embodiments described herein also can be combined, rearranged, or separated without departing from the spirit and scope of the disclosed subject matter. Accordingly, the invention is not to be defined only by the preceding illustrative description

Claims

1. A method for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, comprising: detecting a sequence of observable events related to operation of an entity in the wireless network; determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and comparing a function of the first output with a function of the second output to determine whether the particular entity is deviating from legitimate operation of the network transmission protocol.

2. The method of claim 1, wherein said observable events are successful transmissions from an entity in the wireless network.

3. The method of claim 2, wherein said second output is a probability density function of the number of idle slots between consecutive successful transmissions for legitimate operation of any entity using the network transmission protocol.

4. The method of claim 3, wherein said function of the second output is a cumulative distribution function Fo for a saturating entity.

5. The method of claim 4, wherein said function of the first output is an empirical distribution function Fi .

6. The method of claim 5, wherein said comparing is made with a Kolmogorov-Smirnov test which compares the cumulative distribution function Fo with the empirical distribution function Fi.

7. The method of claim 6, wherein said comparing determines legitimate operation of the entity when Fi < Fo.

8. The method of claim 6, wherein said comparing detects deviation from legitimate operation when Fi > Fo.

9. An apparatus for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, comprising: means for detecting a sequence of observable events related to operation of an entity in the wireless network; means for determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; means for obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and means for comparing a function of the first output with a function of the second output to determine whether the particular entity is deviating from legitimate operation of the network transmission protocol.

10. The apparatus of claim 9, wherein said observable events are successful transmissions from an entity in the wireless network.

11. The apparatus of claim 10, wherein said second output is a probability density function of the number of idle slots between consecutive successful transmissions for legitimate operation of any entity using the network transmission protocol.

12. The apparatus of claim 11, wherein said function of the second output is a cumulative distribution function Fo for a saturating entity.

13. The apparatus of claim 12, wherein said function of the first output is an empirical distribution function Fi .

14. The apparatus of claim 13, wherein said means for comparing applies a Kolmogorov-Smirnov test to compare the cumulative distribution function Fo with the empirical distribution function Fj.

15. The apparatus of claim 14, wherein said means for comparing determines legitimate operation of the entity when Fi < Fo.

16. The apparatus of claim 14, wherein said means for comparing detects deviation from legitimate operation when Fi > Fo-

17. An apparatus for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, comprising: a detector coupled to the wireless network and configured to detect a sequence of observable events related to operation of an entity in the wireless network; a first calculation module configured for determining from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; a second calculation module configured for obtaining a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and a comparator configured for comparing a function of the first output with a function of the second output to determine whether or not the particular entity is deviating from legitimate operation of the network transmission protocol.

18. The apparatus of claim 17, wherein said observable events are successful transmissions from an entity in the wireless network.

19. The apparatus of claim 18, wherein said second output is a probability density function of the number of idle slots between consecutive successful transmissions for legitimate operation of any entity using the network transmission protocol.

20. The apparatus of claim 19, wherein said function of the second output is a cumulative distribution function Fo for a saturating entity.

21. The apparatus of claim 20, wherein said function of the first output is an empirical distribution function Fj.

22. The apparatus of claim 21, wherein said comparator is configured to perform a Kolmogorov-Smirnov test which compares the cumulative distribution function Fo with the empirical distribution function.

23. The apparatus of claim 22, wherein said comparator determines legitimate operation of the entity when Fl < Fo.

24. The apparatus of claim 22, wherein said detects deviation from legitimate operation when Fi > Fo .

25. An apparatus for detecting an entity in a wireless network that deviates from legitimate operation of a network transmission protocol used on the wireless network, the apparatus comprising: a data input module configured to communicate with a router and receive data related to transmissions of terminals; and a digital data processing device configured to: receive the data from the input module; detect a sequence of observable events related to operation of an entity in the wireless network; determine from the detected sequence of observable events for a particular entity in the wireless network what number of idle slots occurred between two consecutive observable events, to provide a first output; obtain a second output corresponding to the number of idle slots between two consecutive observable events for legitimate operation of any entity in the wireless network using the network transmission protocol; and compare a function of the first output with a function of the second output to determine whether or not the particular entity is deviating from legitimate operation of the network transmission protocol.

26. The apparatus of claim 25, further comprising a data output module configured to receive data from the digital data processing device related to terminals that deviate from legitimate operation of the network transmission protocol, and transmit the data to a server.