Uncovering Threats Before Connection: A Physical-Layer Approach for Intrusion Detection Using Wi-Fi CSI

• Felipe Silveira de Almeida ITA
• Lourenço Alves Pereira Júnior ITA

DOI: https://doi.org/10.5753/sbseg_estendido.2026.31708

Resumo

This paper presents a proactive intrusion detection approach that uses Wi-Fi Channel State Information (CSI) to detect suspicious behavior at the physical and data link layers before access point association. The proposal was validated through two experimental studies using low-cost ESP32 devices: the first analyzed 70,513 instances in two environments and achieved 94.24% accuracy with Random Forest; the second, named Spider-Sense, analyzed approximately 800,000 instances in three environments and reached 99.95% accuracy and an F1-score of 1.000 with Decision Tree. The main contribution is a passive, affordable, and application-agnostic early-warning layer that complements traditional NIDS before network-layer traffic is available.

Referências

Aleesa, A. M., Zaidan, B. B., Zaidan, A. A., and Sahar, N. M. (2020). Review of intrusion detection systems based on deep learning techniques: coherent taxonomy, challenges, motivations, recommendations, substantial analysis and future directions. Neural Computing and Applications, 32(14):9827–9858.

Cominelli, M., Gringoli, F., and Restuccia, F. (2023). Exposing the csi: A systematic investigation of csi-based wi-fi sensing capabilities and limitations. In 2023 IEEE International Conference on Pervasive Computing and Communications (PerCom), pages 81–90.

De Carvalho Bertoli, G., Pereira Júnior, L. A., Saotome, O., Dos Santos, A. L., Verri, F. A. N., Marcondes, C. A. C., Barbieri, S., Rodrigues, M. S., and Parente De Oliveira, J. M. (2021). An end-to-end framework for machine learning-based network intrusion detection system. IEEE Access, 9:106790–106805.

Espressif Systems (2018). Csi documentation – esp-idf programming guide. [link]. Accessed: 2024-01-20.

Gringoli, F., Schulz, M., Link, J., and Hollick, M. (2019). Free your csi: A channel state information extraction platform for modern wi-fi chipsets. In Proceedings of the 13th International Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization, WiNTECH ’19, pages 21–28, New York, NY, USA. Association for Computing Machinery.

Halperin, D., Hu, W., Sheth, A., and Wetherall, D. (2011). Tool release: gathering 802.11n traces with channel state information. SIGCOMM Comput. Commun. Rev., 41(1):53.

IEEE (2021). Ieee standard for information technology–telecommunications and information exchange between systems - local and metropolitan area networks–specific requirements - part 11: Wireless lan medium access control (mac) and physical layer (phy) specifications. IEEE Std 802.11-2020 (Revision of IEEE Std 802.11-2016), pages 1–4379.

Liu, J., Liu, H., Chen, Y., Wang, Y., and Wang, C. (2020). Wireless sensing for human activity: A survey. IEEE Communications Surveys & Tutorials, 22(3):1629–1645.

Ma, Y., Zhou, G., and Wang, S. (2019). Wifi sensing with channel state information: A survey. ACM Comput. Surv., 52(3):46.

Meng, Y., Li, J., Zhu, H., Liang, X., Liu, Y., and Ruan, N. (2020). Revealing your mobile password via wifi signals: Attacks and countermeasures. IEEE Transactions on Mobile Computing, 19(2):432–449.

Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018). Kitsune: An ensemble of autoencoders for online network intrusion detection. Network and Distributed System Security Symposium (NDSS).

Tan, S., Ren, Y., Yang, J., and Chen, Y. (2022). Commodity wifi sensing in ten years: Status, challenges, and opportunities. IEEE Internet of Things Journal, 9(18):17832–17843.

Wang, Z., Dou, W., Ma, M., Feng, X., Huang, Z., Zhang, C., Guo, Y., and Chen, D. (2021). A survey of user authentication based on channel state information. Wireless Communications and Mobile Computing, 2021(1):6636665.

Yang, Z., Zhou, Z., and Liu, Y. (2013). From rssi to csi: Indoor localization via channel response. ACM Comput. Surv., 46(2).