Frame-by-frame Wi-Fi attack detection algorithm with scalable and modular machine-learning design

The popularity of Wi-Fi networks coupled with the intrinsic vulnerability of wireless interfaces has promoted the investigation and proposal of traffic analysis and anomaly detection algorithms targeted to that application. We propose a scalable and modular algorithm architecture to set up a lightweight classifier, able to detect malicious frames with high reliability, allowing a simple implementation and suitable for real-time operations. We compare two design alternatives, based on either an optimized neuro-fuzzy classifier or a k-Nearest Neighbor classifier wrapped into a genetic optimization procedure. Both designs exploit a dissimilarity measure able to handle both numerical and non-numerical features. Scalability and modularity are obtained by considering an array of binary classifiers tuned to identify one specific attack against any other type of traffic. We exploit the Aegean Wi-Fi Intrusion Detection (AWID) dataset to assess the accuracy of the proposed algorithm, finding up to twelve out of the fourteen attack classes of the dataset can be identified with high reliability based just on the inspection of a single frame, provided the right features are observed.