Intrusion detection system for detecting wireless attacks in IEEE 802.11 networks

Abstract

Sophisticated wireless attacks such as Wifiphishing, Evil twin and so on are a serious threat to Wi-Fi networks. These attacks are tricky enough to spoof users by launching a fake access point (AP) pretending to be a legitimate one. The existing intrusion detection schemes are prone to a high rate of false positives as they depend on restricted features. Hence, an efficient intrusion detection system, which considers many more features is needed. Kernel density estimation (KDE) statistically models the distribution of data and detects the attacks in active mode. However, in passive mode (without any connectivity to the AP), detecting the attack is complicated and it requires prior knowledge of attack signatures. The other intrusion detection model which is used in passive mode, namely hidden Markov model (HMM), does not need knowledge of initial probabilities. In this study, a novel wireless intrusion detection system is proposed, by combining KDE and HMM through a tandem queue with feedback. The proposed KDE-HMM technique/method combines the advantages of both statistical and probabilistic properties to yield better results. The performance of the proposed KDE-HMM technique has been experimentally validated and it is found that the proposed KDE-HMM detects the aforementioned attacks with 98% accuracy.