Automated sniffer apparatus and method for monitoring computer systems for unauthorized access

Abstract

An apparatus for wireless communication including an automated intrusion detection process is provided. The apparatus has a portable housing, which may have a length no greater than 1 meter, a width no greater than 1 meter, and a height of no greater than 1 meter. A processing unit (e.g., CPU) is within the housing. One or more wireless network interface devices are within the housing and are coupled to the processing unit. The apparatus has an Ethernet (or like) network interface device within the housing and coupled to the processing unit. A network connector is coupled to the Ethernet network device. One or more memories are coupled to the processing unit. A code is directed to perform a process for detection of a wireless activity within a selected local geographic region. According to a specific embodiment, the wireless activity is derived from at least one authorized device or at least an other device. A code is directed to receiving at least identity information associated with the wireless activity from the detection process in a classification process. A code is directed to labeling the identity information into at least one of a plurality of categories in the classification process. Depending upon the embodiment, other codes may exist to carry out the functionality described herein.

What is claimed is: 
     
         1 . Apparatus for wireless communication including an automated intrusion detection process, the apparatus comprising:
 a portable housing, the housing having a length no greater than 1 meter, a width no greater than 1 meter, and a height of no greater than 1 meter;   a processing unit within the housing;   one or more wireless network interface devices within the housing and coupled to the processing unit;   at least one Ethernet network interface device within the housing and coupled to the processing unit;   at least one network connector coupled to the Ethernet network interface device; and   one or more memories within the housing and coupled to the processing unit, the one or more memories including:
 a code directed to perform a process for detection of a wireless activity within a selected local geographic region, the wireless activity being derived from at least one authorized device or at least an other device; 
 a code directed to receiving at least identity information associated with the wireless activity from the detection process in a classification process; and 
 a code directed to labeling the identity information into at least one of a plurality of categories in the classification process. 
   
     
     
         2 . The apparatus of  claim 1  further comprising at least one indicator provided on the housing, the indicator being coupled to the processing device, the indicator being able to output one or more indications based upon at least the identity information. 
     
     
         3 . The apparatus of  claim 2  further comprising a code directed to transferring an indication associated with the identify information to a prevention process, the code being in one or more of the memories. 
     
     
         4 . The apparatus of  claim 3  further comprising a code directed to performing the prevention process. 
     
     
         5 . A wireless sniffer apparatus including an automated intrusion detection process, the apparatus comprising:
 a housing, the housing having a length no greater than a first dimension, a width no greater than a second dimension, and a height of no greater than a third dimension;   a processing unit within the housing;   one or more wireless network interface devices within the housing and coupled to the processing unit;   one or more antennas coupled to the one or more wireless network interface devices, the one or more antennas being adapted to protrude outside of a portion of the housing or being adapted to be completely within the housing or a portion of they one or more antennas are within the housing and a portion of the one or more antennas are outside of the housing;   at least one Ethernet network interface device within the housing and coupled to the processing unit;   at least one network connector coupled to the Ethernet network interface device; and   one or more memories within the housing and coupled to the processing unit, the one or more memories including:
 a code directed to perform a process for detection of a wireless activity within a selected local geographic region, the wireless activity being derived from at least one authorized device or at least an other device; 
 a code directed to receiving at least identity information associated with the wireless activity from the detection process in a classification process; and 
 a code directed to labeling the identity information into at least one of a plurality of categories in the classification process; and 
 a code directed to testing connectivity of at least the other device associated with the detected wireless activity to a local area network within the selected local geographic region; 
   a first output indication coupled to the housing, the first output indication being associated with a first device type; and   a second output indication coupled to the housing, the second output indication being associated with a second device type.   
     
     
         6 . Apparatus of  claim 5  further comprising a third output indication coupled to the housing, the third output indication being associated with a third device type. 
     
     
         7 . Apparatus of  claim 5  wherein the processor having a clock speed of more than 10 MHz. 
     
     
         8 . Apparatus of  claim 5  wherein the one or more memories comprises at least a 8 Megabit Flash Memory. 
     
     
         9 . Apparatus of  claim 5  wherein the one or more memories comprises at least a 16 Megabit DRAM device. 
     
     
         10 . Apparatus of  claim 5  wherein the processing unit is operable with a Linux operating system or a real time operating system. 
     
     
         11 . Apparatus of  claim 5  wherein the first dimension is less than 40 centimeters, the second dimension is less than 25 centimeters, and the third dimension is less than 10 centimeters. 
     
     
         12 . Apparatus of  claim 5  wherein the one or more wireless interface devices comprise a first wireless interface device and a second wireless interface device, whereupon the first wireless device and the second wireless device are operable during a predetermined portion of time, each of the first wireless device and the second wireless device being under control of a software. 
     
     
         13 . Apparatus of  claim 5  wherein the housing is free from a hard disk drive unit. 
     
     
         14 . Apparatus of  claim 5  wherein the housing is free from any PC type keyboard interface device. 
     
     
         15 . Apparatus of  claim 5  wherein the sniffer is characterized as a sensor and is operable in a standalone manner. 
     
     
         16 . A method for installing one or more security devices over a selected local geographic region, the method comprising:
 providing a wireless sniffer apparatus including an automated intrusion detection process, the apparatus comprising:
 a housing, the housing having a length no greater than a first dimension of about 40 centimeters, a width no greater than a second dimension of about 25 centimeters, and a height of no greater than a third dimension of about 10 centimeters; 
 a processing unit within the housing; 
 one or more wireless network interface devices within the housing and coupled to the processing unit; 
 one or more antennas coupled the wireless network interface devices, the one or more antennas being adapted to protrude outside of a portion of the housing or being adapted to be completely within the housing or a portion of the one or more antennas are within the housing and a portion of the one or more antennas are outside of the housing; 
 at least one Ethernet network interface device within the housing and coupled to the processing unit; 
 at least one network connector coupled to the Ethernet network device; and 
 one or more memories within the housing and coupled to the processing unit, the one or more memories including:
 a code directed to perform a process for detection of a wireless activity within a selected local geographic region, the wireless activity being derived from at least one authorized device or at least an other device; 
 a code directed to receiving at least identity information associated with the wireless activity from the detection process in a classification process; 
 a code directed to labeling the identity information into at least one of a plurality of categories in the classification process; and 
 
 a code directed to testing connectivity of at least the other device associated with the detected wireless activity to a local area network within the selected location geographic region; 
 a first output indication coupled to the housing, the first output indication being associated with a first device type; and 
 a second output indication coupled to the housing, the second output indication being associated with a second device type; 
   connecting the network connector to the local area network;   executing at least a portion of the code directed to testing connectivity of at least the other device associated with the detected wireless activity to the local area network; and   outputting either the first output indication or the second output indication based upon the detected wireless activity.   
     
     
         17 . The method of  claim 16  wherein the first output indication and the second output indication comprise respectively a first visual indication and a second visual indication. 
     
     
         18 . The method of  claim 16  wherein the first output indication and the second output indication comprise respectively a first audio indication and a second audio indication. 
     
     
         19 . The method of  claim 1  wherein the first device type is associated with a no active device detected state, the second device type is associated with at least one active device detected state; and further comprising outputting a third output indication associated with a third device type, the third device type being associated with an all authorized device state and/or outputting a fourth output indication associated with a fourth device type, the fourth device type being associated with an unauthorized device state and/or outputting a fifth output device indication associated with a fifth device type, the fifth device type being associated with an unauthorized device state actively communicating. 
     
     
         20 . Apparatus for sniffing wireless communication including an automated intrusion detection process, the sniffer apparatus comprising:
 a movable housing, the housing having a length, a width, and a height;   a processing unit within the housing;   one or more wireless network interface devices within the housing and coupled to the processing unit;   at least one Ethernet network interface device within the housing and coupled to the processing unit;   at least one network connector coupled to the Ethernet network interface device; and   one or more memories within the housing and coupled to the processing unit;   wherein the processing unit adapted to direct a process for detection of a wireless activity within a selected local geographic region, the wireless activity being derived from at least one authorized device or at least an other device;   wherein the processing unit adapted to receive at least identity information associated with the wireless activity from the detection process in a classification process; and   wherein the processing unit adapted to label the identity information into at least one of a plurality of categories in the classification process.