2026· Proceedings of the 23rd International Conference on Security and Cryptography· pp. 375-382· 0 citations· 32 references
TL;DR
This paper proposes a lightweight, edge-deployed Wireless Intrusion Detection System (WIDS) trained on the AWID3 dataset across eight legacy and modern attack classes, which combines a three-stage feature selection pipeline with cost-sensitive learning for compact 27-feature classification at low latency, and a multi-stage validation mechanism that reduces false positives in real-time.
Abstract
: This paper addresses real-time intrusion detection in IEEE 802.11 wireless networks, where unprotected management frames and exploits such as KRACK and Kr00k pose persistent threats. Existing approaches often rely on signature-based detection, device-specific features, or synthetic oversampling, limiting their effectiveness in dynamic, resource-constrained environments. We propose a lightweight, edge-deployed Wireless Intrusion Detection System (WIDS) trained on the AWID3 dataset across eight legacy and modern attack classes. The approach combines a three-stage feature selection pipeline with cost-sensitive learning for compact 27-feature classification at low latency, and a multi-stage validation mechanism (Z-score filtering and temporal persistence) that reduces false positives in real-time. Deployed on a Raspberry Pi and evaluated with a stratified 70/30 split across five algorithms, a tuned Decision Tree achieves 99.76% accuracy and a 0.9797 macro F1-score, with 0.16s batch inference from a model serializing under 30KB, showing that lightweight models can deliver accurate, efficient real-time wireless intrusion detection.
Wireless local-area networks remain exposed at the data-link layer because legacy 802.11 management traffic can be forged, enabling impersonation and denial-of-service (DoS) conditions. Before Protected Management Frames (PMF) became widespread, deauthentication abuse was the standard technique for disrupting connectivity and for setting up later cryptographic attacks. This paper describes the design, implementation, and empirical evaluation of an anomaly-based Wireless Intrusion Detection System (WIDS) targeting such deauthentication activity. The detector, built on Python 3.11 and Scapy 2.5 operating in monitor mode, inspects management frames, evaluates reason codes, and applies threshold-based anomaly scoring to separate spoofed traffic from ordinary client roaming. A forensic logging component additionally assembles incident timelines suitable for digital-evidence collection. Whereas conventional signature-based products concentrate on known patterns, the proposed framework unites anomaly detection with automated timeline generation for post-incident review. In controlled trials the system attained a true positive rate (TPR) of 96.4%, a false positive rate (FPR) of 3.6%, and precision, recall, and F1-score values of 96.4%. The findings indicate that the detector can serve network administrators as an open-source instrument for continuous security monitoring and forensic reconstruction.
Base Jay-ar B., Palmares Serafin C., Soberano Kristine T.· World Journal of Advanced En...· 0 citations
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.
Distributed Denial-of-Service (DDoS) attacks remain one of the most disruptive threats to modern web services, overwhelming application resources and degrading service availability. This paper presents a lightweight, virtualized system architecture for real-time DDoS detection that combines kernellevel telemetry collection with machine learning (ML) based analysis. The proposed architecture enables fine-grained, lowoverhead log collection without modifying the web applications because the network and application-level events generated during normal and attack traffic are captured directly at the kernel layer by means of an extended Berkeley Packet Filter (eBPF). The collected logs are then processed within a Security Information and Event Management (SIEM) platform, where ML–based detection models analyze traffic patterns and behavioral features to identify DDoS attacks in near real-time. This architecture improves visibility into attack characteristics while maintaining minimal performance impact on the protected services. The proposed system demonstrates how eBPF-based observability, when integrated with SIEM and ML techniques, can provide an effective, scalable, and modular approach for DDoS detection in virtualized environments. The design is particularly suited for cloud and multi-VM deployments, offering enhanced security monitoring, faster attack detection, and improved operational resilience.
Zeeshan Ali, A. Marotta, W. Tiberti et al.· 2026 International Conferenc...· 0 citations
Traditional Internet of Things (IoT) security solutions often rely on heavy cloud-based or gateway-class infrastructure, which is frequently unsuitable for resource-limited hardware due to latency, power, and memory constraints. This paper proposed a resource-aware behavioral Intrusion Detection System (IDS) designed for highly constrained IoT devices. To address these challenges, the proposed system implements real-time application-layer monitoring on an ESP32 Microcontroller Unit (MCU) and utilizes an offline-trained logistic regression model for autonomous, on-device inference. The detection mechanism extracts behavioral features, such as request rates, failed authentication attempts, and invalid resource access within sliding time windows to estimate attack probabilities. Experimental evaluations under controlled scenarios involving flood, brute force, and scan attacks demonstrate that the system achieves high accuracy, precision, and recall. These findings indicate that effective cyber intrusion detection and local mitigation can be successfully executed directly on a single MCU while preserving stable runtime performance and minimal memory usage. Finally, this paper highlights the need for further optimizations to improve robustness and scalability.
Sofyan Bisher, Anas Fawaza, Tarek Mawed et al.· International Conference on...· 0 citations
The rapid growth of cyber landscapes and the development of a new cybersecurity model incorporating PET, deep learning, fuzzy systems, keystroke dynamic authentication, and encryption. It is used to prevent attacks by malware or unauthorized access to cloud systems. The proposed framework, which integrates an artificial intelligence (AI)-driven approach with identity and access management (IAM), enables the adaptive implementation of risk-based login authentication and real time anomaly detection. Unlike conventional security systems that depend on fixed rules and signatures, we provide more sophisticated solutions. A Floydel firewall is dynamically tailored through deep neural networks (DNNs) and automatically adjusts to fluctuating traffic patterns. It employs malware classification based on behavior, utilizes fuzzy logic to manage uncertainty during intrusions, and uses keystroke dynamics for user verification through typing patterns. The experiment demonstrates a 97.6% detection accuracy on benchmark data, while significantly reducing false positives and ensuring data confidentiality through encryption. The nature of cloud security can evolve based on the specific circumstances and threats we encounter. Looking ahead, we plan to delve into cryptography and distributed training to bolster decentralized infrastructures. This proposed framework aims to fortify data protection and ensure user privacy in essential areas like healthcare, financial services, and e-governance, thereby fostering increased trust.
Sai Kiranmai Dornala, S. p· International Journal of Int...· 0 citations
A two-tier hybrid IDS that uses a Random Forest model for quick initial detection and a Neural Network for deeper analysis of suspicious traffic is proposed that provides a balanced and efficient solution that overcomes key limitations of existing IDS models and offers a pathway towards a more robust real-time IoT intrusion detection.
R. Paper, Wong Zoey, Y. Watanabe et al.· International Journal of Eme...· 0 citations