Best of Both Worlds: Detecting Application Layer Attacks through 802.11 and Non-802.11 Features

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Intrusion detection in Wi-Fi networks is critical.
• Existing research lacks comprehensive assessment of application layer attack detection using diverse network features.
• Wi-Fi networks are frequently exploited for various application layer attacks.

Purpose of the Study:

• To evaluate the effectiveness of 802.11 and non-802.11 network features in detecting application layer attacks.
• To identify the most informative network protocol features for machine learning-based intrusion detection.
• To assess the performance of shallow and deep learning techniques in this context.

Main Methods:

• Utilized the AWID3 benchmark dataset.
• Employed shallow and deep learning machine learning techniques.
• Analyzed both 802.11-specific and non-802.11 network protocol features, individually and combined.

Main Results:

• Achieved a detection performance of up to 96.7% Area under the ROC Curve (AUC).
• Demonstrated the efficacy of engineered features in enhancing detection rates.
• Identified specific network features that are highly informative for machine learning models.

Conclusions:

• Network features, particularly when combined, are highly competent in detecting application layer attacks in Wi-Fi networks.
• Machine learning models can effectively identify sophisticated threats like website spoofing.
• The study provides valuable insights into feature selection for robust Wi-Fi intrusion detection systems.