System and method for detection and location of rogue wireless access users in a computer network

A system and method to detect and geographically locate rogue wireless access users to a computer network are described. The present invention maps an area covered by the wireless network into islands with substantially similar network performances based on information collected by a network management system. This information is collected throughout the day to form a spatial performance model which comprises historical records of each island, giving a dynamic picture of the area covered. The averages of these historical values of the performance parameters at each time interval of the day form the basis of comparison with the captured current values of the rogue user. Once a potential intruder has been identified from his Media Access Control and Internet Protocol addresses, the algorithm of the present invention is used to localize the suspect into the island which has the substantially similar performance characteristics as the rogue user's computer.