Uncovering Threats Before Connection: A Physical-Layer Approach for Intrusion Detection Using Wi-Fi CSI - Almeida, Felipe Silveira de; Pereira Júnior, Lourenço Alves (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg_estendido.2026.31708, 2026)
This paper presents a proactive intrusion detection approach that uses Wi-Fi Channel State Information (CSI) to detect suspicious behavior at the physical and data link layers before access point association. The proposal was validated through two experimental studies using low-cost ESP32 devices: the first analyzed 70,513 instances in two environments and achieved 94.24% accuracy with Random Forest; the second, named Spider-Sense, analyzed approximately 800,000 instances in three environments and reached 99.95% accuracy and an F1-score of 1.000 with Decision Tree. The main contribution is a passive, affordable, and application-agnostic early-warning layer that complements traditional NIDS before network-layer traffic is available.