Machine Learning-Based Evil Twin Attack Detection and Attacker Position Classification Using an IoT Sensor Network in Non-Urban Terrain

Author:
Open Access
Publisher website
Google Scholar
Abstract
The basis for this work is the growing prevalence of the Evil Twin attack on IEEE 802.11 networks, as it is the initial link in downgrade attacks that force the security protocol from WPA3 to WPA2 in transition mode, enabling handshake interception and an offline dictionary attack on the network password. For the study, a Wi-Fi access point and a device simulating the Evil Twin attack were deployed, and a multi-sensor Internet of Things (IoT) infrastructure was developed to record the received signal strength indicator (RSSI) from the access point. The resulting RSSI dataset was used to train machine learning models addressing three subtasks: attack detection, attacker localization, and antenna-type identification. Ten classification algorithms were compared using group-based nested cross-validation, keeping entire attack sessions together. Attack detection reached an accuracy of 98.8% with KNN, while the accuracy of localizing the attacking device among eight positions and identifying the antenna type was 74.3% (89.6% per attack session) and 36.3%, respectively, with KNN and XGBoost. The results demonstrate the feasibility of the proposed method as a first step towards reducing incident response time and narrowing the search area for the source of an Evil Twin attack on a Wi-Fi network.
Funding Information
  • National Research Foundation of Ukraine (2025.05/0046)

This publication has 38 references indexed in Scilit: