[Paper Review] RIDS : Real-time Intrusion Detection System for WPA3 enabled Enterprise Networks

Rahul Saini, Debajyoti Halder+1 more|arXiv (Cornell University)|Jul 6, 2022

IPv6, Mobility, Handover, Networks, Security4 citations

TL;DR

This paper proposes RIDS, a two-stage real-time intrusion detection system for WPA3-enabled enterprise networks that uses a lightweight flood detection algorithm at access points (APs) to trigger ML-based classification at the controller. The system achieves over 99% accuracy in attack detection using a Decision Tree classifier on a newly created WPA3 attack dataset, with a low false positive rate of 0.054%.

ABSTRACT

With the advent of new IEEE 802.11ax (WiFi 6) devices, enabling security is a priority. Since previous versions were found to have security vulnerabilities, to fix the most common security flaws, the WiFi Protected Access 3 (WPA3) got introduced. Although WPA3 is an improvement over its predecessor in terms of security, recently it was found that WPA3 has a few security vulnerabilities as well. In this paper, we have mentioned the previously known vulnerabilities in WPA3 and WPA2. In addition to that, we have created our own dataset based on WPA3 attacks (Section III). We have proposed a two-stage solution for the detection of an intrusion in the network. The two-stage approach will help ease computational processing burden of an AP and WLAN Controller. First, AP will perform a lightweight simple operation for some duration (say 500ms) at certain time interval. Upon discovering any abnormality in the flow of traffic an ML-based solution at the controller will detect the type of attack. Our approach is to utilize resources on AP as well as the back-end controller with certain level of optimization. We have achieved over 99% accuracy in attack detection using an ML-based solution. We have also publicly provided our code and dataset for the open-source research community, so that it can contribute for future research work.

Motivation & Objective

• Address the lack of publicly available datasets for WPA3-specific network attacks, which hinders research in intrusion detection for the latest WiFi security standard.
• Develop a real-time, scalable intrusion detection system suitable for enterprise WLANs that reduces computational load on central controllers.
• Overcome limitations of traditional signature-based IDS and existing ML-based approaches by combining lightweight on-AP anomaly detection with high-accuracy ML classification at the controller.
• Provide a cost-efficient, distributed architecture that enables early alerting and precise attack classification without overwhelming network resources.

Proposed method

• Deploy a two-stage architecture: (1) a lightweight Flood Detection System (FDS) at each AP to monitor incoming packet rates every second and detect traffic spikes.
• Use FDS to trigger packet capture for 500ms when anomalies are detected—specifically, a 10x increase in mean packets per user or a 15x increase in total packets.
• Forward captured packets to the central WLAN controller for analysis using a machine learning classifier.
• Train and evaluate multiple classifiers (Logistic Regression, Decision Tree, Random Forest) on a newly collected WPA3 attack dataset to identify the most accurate and efficient model.
• Select the Decision Tree classifier based on its superior balance of high accuracy (99.98%) and low false positive rate (0.054%).
• Implement a distributed detection pipeline where APs perform initial filtering, reducing the load on the central controller and enabling real-time response.

Experimental results

Research questions

• RQ1 How can real-time intrusion detection be efficiently implemented in WPA3-enabled enterprise networks with minimal computational overhead on access points and controllers?
• RQ2 What are the most effective lightweight detection mechanisms that can trigger accurate ML-based attack classification without overwhelming network resources?
• RQ3 Can a newly created, publicly available dataset of WPA3-specific attacks improve the performance and generalizability of ML-based intrusion detection systems?
• RQ4 Which machine learning classifier offers the best trade-off between accuracy, false positive rate, and inference speed for real-time network intrusion detection in WPA3 environments?

Key findings

• The proposed RIDS system achieves 99.98% accuracy in classifying WPA3 network attacks using a Decision Tree classifier on the newly created dataset.
• The Decision Tree classifier exhibits the lowest false positive rate (0.054%) among tested models, making it ideal for minimizing false alarms in production environments.
• The FDS algorithm successfully detects traffic anomalies in real time by monitoring packet rate changes per user and total traffic, triggering alerts only when thresholds are exceeded.
• The two-stage architecture effectively reduces the load on the central controller by offloading initial detection to APs, enabling scalable deployment in large enterprise networks.
• The system captures and classifies 500ms of network traffic in real time, allowing for rapid response to ongoing attacks without significant latency.
• The authors have publicly released both the dataset and code, enabling reproducibility and fostering further research in WPA3 security and intrusion detection.