Lightweight Real-Time Wireless Intrusion Detection for IEEE 802.11 Networks on Edge Devices
TL;DR
This paper proposes a lightweight, edge-deployed Wireless Intrusion Detection System (WIDS) trained on the AWID3 dataset across eight legacy and modern attack classes, which combines a three-stage feature selection pipeline with cost-sensitive learning for compact 27-feature classification at low latency, and a multi-stage validation mechanism that reduces false positives in real-time.
Abstract
: This paper addresses real-time intrusion detection in IEEE 802.11 wireless networks, where unprotected management frames and exploits such as KRACK and Kr00k pose persistent threats. Existing approaches often rely on signature-based detection, device-specific features, or synthetic oversampling, limiting their effectiveness in dynamic, resource-constrained environments. We propose a lightweight, edge-deployed Wireless Intrusion Detection System (WIDS) trained on the AWID3 dataset across eight legacy and modern attack classes. The approach combines a three-stage feature selection pipeline with cost-sensitive learning for compact 27-feature classification at low latency, and a multi-stage validation mechanism (Z-score filtering and temporal persistence) that reduces false positives in real-time. Deployed on a Raspberry Pi and evaluated with a stratified 70/30 split across five algorithms, a tuned Decision Tree achieves 99.76% accuracy and a 0.9797 macro F1-score, with 0.16s batch inference from a model serializing under 30KB, showing that lightweight models can deliver accurate, efficient real-time wireless intrusion detection.