Improved Preprocessing for Machine Learning Intrusion Detection in IEEE 802.11

Abstract

WiFi networks have become the most used technology when connecting various personal devices to the Internet at home, in the office, or even in public places. Such popularity and widespread use make WiFi networks an attractive target for attackers. Despite the encryption of network frames and other security features implemented as part of the IEEE 802.11 family of standards, different kinds of intrusion activities that disrupt regular WiFi communication are still on the rise. Detection of such sophisticated attacks is the first step in protecting WiFi networks. Therefore, Intrusion Detection Systems (IDS) are of paramount importance. This paper evaluates different machine learning algorithms applicable for implementing an IDS. We train and evaluate attack detection models with respect to the well-known and publicly available Aegean WiFi Intrusion Dataset (AWID), using the version having 4 labels and a reduced number of items (AWID-CLS-R). Our focus is especially on the preprocessing phase, where we apply specific feature selection procedures. Based on the dataset features, we also infer new feature variables that add information about relations between individual dataset items (frames). Compared to other similar works, our evaluation results show that feature reduction combined with specific machine learning algorithms can improve attack detection rate in terms of accuracy, precision, and recall.