Roman Banakh

The basis for this work is the growing prevalence of the Evil Twin attack on IEEE 802.11 networks, as it is the initial link in downgrade attacks that force the security protocol from WPA3 to WPA2 in transition mode, enabling handshake interception and an offline dictionary attack on the network password. For the study, a Wi-Fi access point and a device simulating the Evil Twin attack were deployed, and a multi-sensor Internet of Things (IoT) infrastructure was developed to record the received signal strength indicator (RSSI) from the access point. The resulting RSSI dataset was used to train machine learning models addressing three subtasks: attack detection, attacker localization, and antenna-type identification. Ten classification algorithms were compared using group-based nested cross-validation, keeping entire attack sessions together. Attack detection reached an accuracy of 98.8% with KNN, while the accuracy of localizing the attacking device among eight positions and identifying the antenna type was 74.3% (89.6% per attack session) and 36.3%, respectively, with KNN and XGBoost. The results demonstrate the feasibility of the proposed method as a first step towards reducing incident response time and narrowing the search area for the source of an Evil Twin attack on a Wi-Fi network.

The paper addresses the problem of detecting Evil Twin attacks on IEEE 802.11 wireless networks in dense urban environments with monolithic reinforced concrete construction, which significantly attenuates radio signals in the 2.4 and 5 GHz bands. In a full access point cloning scenario, the attacker copies both the network identifier and the hardware address of the legitimate device, making classical detection methods based on the analysis of management frame identifiers inapplicable. A detection method is proposed that uses a network of four indoor Wi-Fi sensors to continuously measure the received signal strength indicator of the legitimate access point and analyzes the geometric relationships between sensors. The method combines two independent detectors – a pair-wise residual detector S(t) based on a statistical model of signal power differences across all sensor pairs, sensitive to sustained violations of the spatial signal attenuation pattern, and an impulse detector based on the z-score of each sensor relative to its calibration baseline, which reacts to short, locally strong deviations lasting 2–5 minutes. Subsequent classification of impulse intervals by peak z-score magnitude allows separation of strong external attacks from regular human activity inside the room. Experimental validation was performed on a labeled set of 40 attacks using four types of antennas placed outside the concrete building. The method achieved 60% recall and 85.7% precision at the individual attack level, and 100% recall at the attack session level (groups of ten consecutive attacks per antenna). The developed approach does not require specialized hardware, operates on standard Wi-Fi chipsets, and can be deployed within existing infrastructure to protect critical infrastructure facilities.

The tracking of assets or cargo is one of the main objectives of global logistics and transportation systems, ensuring operational efficiency, security, and timeliness. Currently, battery-operated GPS (Global Positioning System)-based tracking devices are used for this purpose. The main shortcoming of these devices is the lifetime of the batteries because they cannot be replaced or recharged, or because this is simply not economically feasible. Therefore, efficient methods are needed to prolong battery life as much as possible. Various existing energy-saving techniques can be applied to solve this problem. However, none of these consider situations in which multiple tracking devices are transported together and can cooperate to further increase their energy efficiency. In this study, we propose and evaluate the novel lightweight peer-to-peer energy-saving method for nearby wireless battery-powered trackers based on their cooperation. The proposed method is based on the short-range BLE (Bluetooth Low Energy) device discovery mechanism and the dynamic election of the leader tracker (with the highest battery capacity) to report the location of its own and other neighboring trackers to the central server. The experimental evaluation of the proposed method shows that, compared to the traditional approach, where each tracker sends its location individually, the proposed method allows a reduction in the average battery charge required for one position report from 19% to 240% per each cooperating tracker. The average energy consumption for one location report per node decreased from 4.68 mWh using the traditional approach to 3.93 mWh for 2 cooperating devices and 1.92 mWh for 15 cooperating devices.

This article provides a comprehensive overview of the capabilities and architecture of Scout Suite, one of the leading open-source tools for cloud infrastructure security auditing. Scout Suite is designed for automated analysis of cloud account configurations to identify potential vulnerabilities, misconfigured access controls, missing encryption, weak IAM policies, and more. One of the tool’s main advantages is its multi-cloud support, including Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), as well as Alibaba Cloud and Oracle Cloud Infrastructure in alpha versions. The study examines the tool’s architecture, which follows a modular design and consists of a core engine, CLI request handlers, output interfaces, and dedicated components for each cloud provider. Through the use of the facade pattern, Scout Suite enables flexible support for new services while maintaining a unified logic for accessing resources. The tool generates interactive HTML reports that can be viewed offline and supports both rule customization and integration into CI/CD pipelines, such as via Jenkins. Particular attention is paid to the tool’s use in securing DevSecOps processes and achieving compliance with security standards. Scout Suite allows users to gain a full overview of their cloud infrastructure’s security posture, automate the detection of critical issues, and significantly reduce the time required for manual review. The article also outlines future research directions, including integration with SIEM systems, the application of machine learning for automated analysis of audit results, expansion to support additional cloud platforms, and the creation of specific verification profiles aligned with security standards. Scout Suite is considered a vital tool in the modern cybersecurity arsenal for organizations that actively rely on cloud services.

This article presents a research-driven approach to enhancing the efficiency of incident response within Security Operations Centers by implementing an automated event analysis system that integrates the n8n platform and large language models. This approach addresses modern cybersecurity challenges, including the continuous increase in the number of security alerts, the growing complexity of IT infrastructures, limited human resources, and the declining effectiveness of manual analysis. The developed architecture incorporates the Elastic Security SIEM system as the primary event source, n8n as the orchestration platform for workflow management, LLM-based agents for natural-language interpretation of incidents, and external enrichment services such as AbuseIPDB and VirusTotal. The core system functions include automated collection, normalization, and enrichment of security events, risk scoring, incident type classification, generation of concise analytical summaries in the 5W format (Who, What, When, Where, Why), and automatic creation of relevant response actions. To validate the effectiveness of the proposed approach, a comprehensive experimental study was conducted, encompassing several stages: simulation of real SOC scenarios, generation of representative security incidents, execution of the automated analysis workflow, and comparison of results with the performance of Tier-1 SOC analysts. Particular attention was paid to assessing the stability of the LLM agent under varying event formats, different log sources, and inconsistent data quality. Furthermore, the system’s behavior was examined in scenarios involving ambiguous or partially missing incident attributes, as well as its resilience to noisy or incomplete data. The analysis demonstrated that the integrated approach not only automates routine tasks but also ensures high consistency of decisions, minimizes subjective variability inherent to manual analysis, and supports the production of unified and repeatable incident verdicts. Additional evaluation focused on the quality of the generated analytical summaries, the accuracy of contextual interpretation, the model’s ability to identify key entities and causal factors, and the relevance of recommended response actions. The study also verified the system’s compatibility with existing SOC infrastructure and its ability to scale under increased alert volumes without significant performance degradation. The obtained results confirm that the proposed system not only enhances the speed and quality of incident response but also lays the foundation for transitioning from a reactive to a proactive SOC model, where automated tools take over a substantial portion of the cognitive workload. Due to the modularity of n8n and the flexibility of LLM agents, the system can adapt to new threat types, expand functionality without significant cost, and integrate with various corporate services. Thus, it provides the technological basis for further adoption of intelligent automation in cybersecurity practice and supports the development of next-generation SOC environments.

Recent cyber security solutions for wireless networks during internet open access have become critically important for personal data security. The newest WPA3 network security protocol has been used to maximize this protection; however, attackers can use an Evil Twin attack to replace a legitimate access point. The article is devoted to solving the problem of intrusion detection at the OSI model’s physical layers. To solve this, a hardware–software complex has been developed to collect information about the signal strength from Wi-Fi access points using wireless sensor networks. The collected data were supplemented with a generative algorithm considering all possible combinations of signal strength. The k-nearest neighbor model was trained on the obtained data to distinguish the signal strength of legitimate from illegitimate access points. To verify the authenticity of the data, an Evil Twin attack was physically simulated, and a machine learning model analyzed the data from the sensors. As a result, the Evil Twin attack was successfully identified based on the signal strength in the radio spectrum. The proposed model can be used in open access points as well as in large corporate and home Wi-Fi networks to detect intrusions aimed at substituting devices in the radio spectrum where IEEE 802.11 networking equipment operates.

The object of research is IEEE 802.11 (Wi-Fi) networks, which are often the targets of a group of attacks called "evil twin". Research into this area is extremely important because Wi-Fi technology is a very common method of connecting to a network and is usually the first target of cybercriminals when they attack businesses. With the help of a systematic analysis of the literature focused on countering attacks of the "evil twin" type, this work identifies the main advantages of using artificial intelligence systems in the analysis of network data and identification of intrusions in Wi-Fi networks. To evaluate the effectiveness of intrusion detection and cybercrime analysis, a number of experiments as close as possible to real attacks on Wi-Fi networks were conducted. As part of the research reported in this paper, a method is proposed for detecting cybercrimes in IEEE 802.11 (Wi-Fi) wireless networks using artificial intelligence, namely a model built on the basis of the k-nearest neighbors method. This method is based on the classification of previously collected data, namely the signal strength from the access point, and then continuous comparison of the newly collected data with the trained model. A compact and energy-efficient prototype of a hardware and software system has been designed for the implementation of monitoring, analysis of ethernet network packets and data storage based on time series. In order to reduce the load on the computer network and taking into account the limited computing power of the system, a method of data aggregation was proposed, which ensures fast transfer of information. The results, namely 100 % of test cases (more than 7 thousand), were classified correctly, which indicates that the chosen method of data analysis will significantly increase the security of information and communication systems at the state and private levels