EVIL TWIN ATTACK DETECTION IN IEEE 802.11 WIRELESS NETWORKS IN DENSE URBAN ENVIRONMENTS

Abstract

The paper addresses the problem of detecting Evil Twin attacks on IEEE 802.11 wireless networks in dense urban environments with monolithic reinforced concrete construction, which significantly attenuates radio signals in the 2.4 and 5 GHz bands. In a full access point cloning scenario, the attacker copies both the network identifier and the hardware address of the legitimate device, making classical detection methods based on the analysis of management frame identifiers inapplicable. A detection method is proposed that uses a network of four indoor Wi-Fi sensors to continuously measure the received signal strength indicator of the legitimate access point and analyzes the geometric relationships between sensors. The method combines two independent detectors – a pair-wise residual detector S(t) based on a statistical model of signal power differences across all sensor pairs, sensitive to sustained violations of the spatial signal attenuation pattern, and an impulse detector based on the z-score of each sensor relative to its calibration baseline, which reacts to short, locally strong deviations lasting 2–5 minutes. Subsequent classification of impulse intervals by peak z-score magnitude allows separation of strong external attacks from regular human activity inside the room. Experimental validation was performed on a labeled set of 40 attacks using four types of antennas placed outside the concrete building. The method achieved 60% recall and 85.7% precision at the individual attack level, and 100% recall at the attack session level (groups of ten consecutive attacks per antenna). The developed approach does not require specialized hardware, operates on standard Wi-Fi chipsets, and can be deployed within existing infrastructure to protect critical infrastructure facilities.