DENIAL OF SERVICE ATTACK DETECTION AND MITIGATION

Wireless communications systems may detect network attacks based on analysis of medium access control (MAC) addresses and origination locations associated with incoming authentication requests. For example, a DoS attack may be detected by determining (e.g., via a database) whether a particular MAC address is associated with multiple authentication request messages without proceeding to an authentication step. According to the described techniques, a system (e.g., an AP, controller/cloud, etc.) may maintain a database of authentication requests and associated MAC addresses, timestamps, and location information. As such, upon reception of an authentication request corresponding to a MAC address, the MAC address may be compared to the database. If the delta (e.g., timestamp difference) between authentication requests from a same MAC address is less than a threshold, the system may detect a potential DoS attack by a client associated with the MAC address and the MAC address may be removed from the AP.