WiFi Anomaly Behavior Analysis Based Intrusion Detection Using Online Learning

Abstract

With the rise of the Internet of Things (IoT), wireless networks like WiFi are ubiquitous in today’s world. The widespread adoption of WiFi networks leads to correspondingly widespread attacks on these networks. WiFi attacks exploit vulnerabilities in the physical layer or the datalink layer specification of the protocol, making detecting and stopping these threats a challenging task as encryption based security solutions are harder to deploy. In this paper, we measure the performance of online learning classifiers, specifically Hoeffding Tree (HT), K-nearest neighbours (KNN), Accuracy Weighted Ensemble Classifier(AWEC),and Half-Spaced Treed(HST), to detect attacks on WiFi networks. The experimental evaluation is performed on Aegean WiFi Intrusion Dataset 2 (AWID 2) and Aegean WiFi Intrusion Dataset 3 (AWID 3). Experimental evaluations show that HT has the best accuracy of 98% for both the datasets, but takes training on 300,000 packets to reach this performance. While HST and KNN converged more quickly, they were never more accurate than HT after 70,000 iterations or AWEC after 140,000 iterations. For this reason HT and AWEC are the most highly rated out of the classifiers examined.