Wi-Fi Frame Classification and Feature Selection Analysis in Detecting Evil Twin Attack

Abstract

Wi-Fi are mostly used components for connecting to the internet today. Nowadays Wi-Fi can be found in work, home or even in bus and train. While using internet with these access points, the connection between user and server is barely secure. Attackers can harvest data, as well as modify or drop data by impersonating himself as a legitimate access point. Also attacker can acquire the credentials of a legitimate access point from the users by impersonating himself as the legitimate access point and forcing the legitimate access point to be stopped for time being. This attack is known as Evil Twin attack. In this paper the traffics of both legitimate access point and rogue access point are analyzed. The detection is concluded with 91.2367% accuracy. Wi-fi frames of both APs are captured and features are extracted. Best 10 features are selected to increase the accuracy using chi-square test, information gain, gain ratio and tree based random forest. Several algorithms are used to classify the frames; among those J48 decision tree algorithm gives the highest accuracy.