Abstract
In 802.11 Wireless Networks, detecting faulty equipment, poor radio conditions, and changes in user behavior through anomaly detection techniques is of great importance in network management. The traffic load and user movement on different access points (APs) in a wireless covered area vary with time, making these network management tasks harder. We intend to inspect the evolving structure of wireless networks and their inherent dynamics in order to provide models for anomaly detection. For this purpose we explore the temporal usage behavior of the network by applying various types of Hidden Markov Models. We observe the usage pattern of up to 100 APs in one week period in 2011 at the Faculty of Engineering of the University of Porto. The first step of this study consists of constructing various Hidden Markov Models from 802.11 AP usage data. We then apply statistical techniques for outlier detection and justify the presented outliers by inspecting the models' parameters and a set of HMM indicators. We finally introduce examples of wireless networks anomalous patterns based on the transitions between HMM states and provide an analysis of the entire set of APs under study.

Abstract
IEEE 802.11 Wireless Networks are getting more and more popular at university campuses, enterprises, shopping centers, airports and in so many other public places, providing Internet access to a large crowd openly and quickly. The wireless users are also getting more dependent on WiFi technology and therefore demanding more reliability and higher performance for this vital technology. However, due to unstable radio conditions, faulty equipment, and dynamic user behavior among other reasons, there are always unpredictable performance problems in a wireless covered area. Detection and prediction of such problems is of great significance to network managers if they are to alleviate the connectivity issues of the mobile users and provide a higher quality wireless service. This paper aims to improve the management of the 802.11 wireless networks by characterizing and modeling wireless usage patterns in a set of anomalous scenarios that can occur in such networks. We apply time-invariant (Gaussian Mixture Models) and time-variant (Hidden Markov Models) modeling approaches to a dataset generated from a large production network and describe how we use these models for anomaly detection. We then generate several common anomalies on a Testbed network and evaluate the proposed anomaly detection methodologies in a controlled environment. The experimental results of the Testbed show that HMM outperforms GMM and yields a higher anomaly detection ratio and a lower false alarm rate.

Abstract
Despite the growing popularity of 802.11 wireless networks, users often suffer from connectivity problems and performance issues due to unstable radio conditions and dynamic user behavior, among other reasons. Anomaly detection and distinction are in the thick of major challenges that network managers encounter. The difficulty of monitoring broad and complex Wireless Local Area Networks, that often requires heavy instrumentation of the user devices, makes anomaly detection analysis even harder. In this paper we exploit 802.11 access point usage data and propose an anomaly detection technique based on Hidden Markov Model (HMM) and Universal Background Model (UBM) on data that is inexpensive to obtain. We then generate a number of network anomalous scenarios in OMNeT++/INET network simulator and compare the detection outcomes with those in baseline approaches-RawData and Principal Component Analysis. The experimental results show the superiority of HMM and HMM-UBM models in detection precision and sensitivity.

Abstract
The present work introduces a hybrid integration of the self-organizing map and the hidden Markov model (HMM) for anomaly detection in 802.11 wireless networks. The self-organizing hidden Markov model map (SOHMMM) deals with the spatial connections of HMMs, along with the inherent temporal dependencies of data sequences. In essence, an HMM is associated with each neuron of the SOHMMM lattice. In this paper, the SOHMMM algorithm is employed for anomaly detection in 802.11 wireless access point usage data. Furthermore, we extend the SOHMMM online gradient descent unsupervised learning algorithm for multivariate Gaussian emissions. The experimental analysis uses two types of data: synthetic data to investigate the accuracy and convergence of the SOHMMM algorithm and wireless simulation data to verify the significance and efficiency of the algorithm in anomaly detection. The sensitivity and specificity of the SOHMMM algorithm in anomaly detection are compared to two other approaches, namely HMM initialized with universal background model (HMM-UBM) and SOHMMM with zero neighborhood (Z-SOHMMM). The results from the wireless simulation experiments show that SOHMMM outperformed the aforementioned approaches in all the presented anomalous scenarios.

Abstract