Insider attack attribution using signal strength-based hyperbolic location estimation

A rogue insider, in a wireless network, is an authenticated member that exploits possession of a valid identity in order to launch an attack. A typical example is the transmission of a verifiable message containing false or incomplete information. An important step, in enabling the network authorities to attribute an attack message to its originator, involves locating the physical source of the transmission. We propose a probabilistic scheme to determine the location of a transmitting rogue, with a degree of confidence, using the relative signal strength received by neighboring devices, even if the effective isotropic radiated power (EIRP) employed by the rogue is unknown. The relative received signal strength (RSS) between pairs of trusted receivers are combined with a range of possible EIRP values to construct an area in Euclidian space bounded by minimum and maximum distance hyperbolas. The area contained within the intersection of multiple hyperbola pairs pinpoints the location of the rogue transmitter with a specific level of confidence. Copyright (c) 2008 John Wiley & Sons, Ltd.