A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks

Abstract

One of the advanced Man-in-the-Middle (MitM) attacks is the Multi-Channel MitM (MC-MitM) attack, which is capable of manipulating encrypted wireless frames between clients and the Access Point (AP) in a Wireless LAN (WLAN). MC-MitM attacks are possible on any client no matter how the client authenticates with the AP. Key reinstallation attacks (KRACK) in 2017-18, and the latest FragAttacks in 2021 are frontline MC-MitM attacks that widely impacted millions of Wi-Fi systems, especially those with Internet of Things (IoT) devices. Although there are security patches against some attacks, they are not applicable to every Wi-Fi or IoT device. In addition, existing defense mechanisms to combat MC-MitM attacks are not feasible for two reasons: they either require severe firmware modifications on all the devices in a system, or they require the use of several advanced hardware and software for deployment. On top of that, high technical overhead is imposed on users in terms of network setup and maintenance. This paper presents the first plug-and-play system to detect MC-MitM attacks. Our solution is a lightweight, signaturebased, and centralized online passive intrusion detection system that can be easily integrated into Wi-Fi-based IoT environments without modifying any network settings or existing devices. The evaluation results show that our proposed framework can detect MC-MitM attacks with a maximum detection time of 60 seconds and a minimum TPR (true positive rate) of 90% by short-distance detectors and 85% by long-distance detectors in real Wi-Fi or IoT environments.

Unveiling the core of IoT: comprehensive review on data security challenges and mitigation strategies

“…The study of IoT Security Attack Types, Application Areas, Challenges, and Mitigation Strategies as discussed in Table 13 is a vital exploration that encompasses the multifaceted landscape of IoT security. By analyzing different attack types such as botnet attacks that are used to compromise numerous connected systems, spoofing (Reddy et al, 2024;Xu et al, 2024) which is an act of deceiving, and man-in-the-middle attacks (Bin Muzammil et al, 2024;Thankappan et al, 2024) that alters the communication between two parties, researchers gain insights into the vulnerabilities and risks faced by IoT systems. Understanding the application areas impacted by these attacks, including smart homes, industrial automation, and healthcare, highlights the potential consequences and the need for robust security measures.…”