Bachelor and Master Theses

Background

Wi-Fi networks are widely used in industrial environments, smart buildings, Internet of Things (IoT) applications, and critical communication infrastructures. Ensuring their availability is essential for maintaining reliable communication and uninterrupted network services.

Despite significant improvements in Wi-Fi security, certain vulnerabilities remain at the Medium Access Control (MAC) layer. One example involves the Clear-to-Send (CTS) control frame, which is used to coordinate wireless medium access through the Network Allocation Vector (NAV) mechanism.

Attackers can exploit this mechanism by transmitting malicious CTS frames that cause legitimate devices to defer their transmissions. Such attacks include CTS flooding and forged CTS-to-self attacks, potentially resulting in significant network performance degradation or denial of service (DoS).

Existing wireless intrusion detection and prevention systems provide mechanisms for identifying certain wireless attacks. However, the availability, effectiveness, and adaptability of CTS-specific detection mechanisms remain important questions.

Open-source platforms such as Kismet provide opportunities to develop, integrate, and experimentally evaluate new wireless intrusion detection capabilities.

This thesis investigates intelligent and practical approaches for detecting CTS-based attacks and integrating the resulting mechanisms into an open-source wireless intrusion detection system.

Problem Description

CTS-based attacks exploit the fact that Wi-Fi control frames are not cryptographically authenticated in conventional deployments. Consequently, wireless devices may process forged CTS frames and modify their medium access behavior.

Detecting these attacks is challenging for several reasons:

1. Legitimate and malicious CTS frames may have similar characteristics.

2. Attackers may vary their transmission patterns to avoid simple detection thresholds.

3. Legitimate network conditions can cause changes in CTS traffic.

4. Detection mechanisms must operate with limited computational overhead.

5. Open-source wireless intrusion detection systems may lack dedicated CTS attack detection capabilities.

Simple threshold-based solutions may detect high-rate flooding attacks but struggle with more subtle or adaptive attack patterns.

There is therefore a need for detection mechanisms that can distinguish malicious CTS behavior from legitimate wireless activity while maintaining high detection accuracy and low false-positive rates.

Aim

The aim of this thesis is to design, implement, and experimentally evaluate an intelligent CTS attack detection mechanism for Wi-Fi networks.

The developed solution should be suitable for integration into an open-source wireless intrusion detection platform, such as Kismet, and should detect different CTS-based attack patterns under realistic network conditions.

Research Questions

1. How do CTS flooding and forged CTS-to-self attacks affect the performance of Wi-Fi networks?

2. Which characteristics of CTS traffic can be used to distinguish legitimate behavior from malicious activity?

3. How effectively can statistical, rule-based, or machine learning-based techniques detect different CTS attack patterns?

4. How does the proposed detection mechanism compare with existing reproducible detection approaches in terms of accuracy, detection latency, and computational overhead?

5. Can the proposed mechanism be integrated into Kismet to provide practical CTS attack detection and alerting capabilities?

Methodology

The student will:

1. Conduct a literature review of CTS-based attacks, NAV manipulation, and existing detection techniques.

2. Establish an isolated Wi-Fi experimental testbed using commodity access points, Linux systems, and compatible wireless network adapters.

3. Collect and analyze wireless traffic under normal operation and controlled CTS-based attack scenarios.

4. Identify relevant detection features, such as CTS transmission frequency, NAV duration, temporal traffic patterns, and subsequent channel activity.

5. Design and implement a detection algorithm using appropriate statistical, rule-based, or machine learning techniques.

6. Implement the proposed mechanism as a Kismet extension, plugin, or compatible external detection component.

7. Compare the proposed approach against reproducible baseline detection algorithms.

8. Evaluate detection performance under different traffic loads, network configurations, and attack patterns.

All active attack experiments will be performed in an authorized, isolated laboratory environment.

Evaluation Metrics

Detection Metrics

• Precision

• Recall

• F1-score

• False Positive Rate

• Detection Rate

• Detection Latency

Network Performance Metrics

• Throughput

• Packet Loss

• Communication Latency

• Channel Utilization

Implementation Metrics

• CPU Utilization

• Memory Consumption

• Processing Overhead

• Detection Scalability

Robustness Metrics

• Performance under different traffic loads

• Detection of low-rate and bursty attacks

• Sensitivity to different CTS duration values

• Generalization across network configurations

Expected Outcomes

The thesis is expected to:

• Provide an experimental analysis of CTS-based denial-of-service attacks.

• Identify useful features for distinguishing legitimate and malicious CTS traffic.

• Develop and evaluate a practical CTS attack detection algorithm.

• Compare the proposed solution with reproducible baseline methods.

• Implement a functional CTS detection component compatible with Kismet.

• Produce an experimental dataset and reproducible evaluation framework.

• Explore the possibility of contributing the developed functionality to the open-source Kismet project.

Knowledge of Linux, computer networking, cybersecurity, and Python programming is beneficial.

Familiarity with Wi-Fi protocols, network traffic analysis, and basic machine learning concepts is an advantage.

The project involves practical experiments with Wi-Fi equipment and open-source security tools. Access to commercial wireless intrusion prevention systems is not required.

The thesis may be coordinated with a related project investigating reinforcement learning-based adaptive CTS attacks.