Bachelor and Master Theses

Background

Wireless communication technologies such as Wi-Fi, Bluetooth Low Energy (BLE), Zigbee, and other Internet of Things (IoT) protocols are increasingly deployed in industrial automation, smart buildings, healthcare, and critical infrastructure.

As these technologies become more widespread, ensuring their security and reliability becomes increasingly important.

Traditional Wireless Intrusion Detection Systems (WIDSs) primarily analyze network packets and protocol-specific information to identify suspicious activities. Such approaches are effective against many known attacks but may provide limited visibility into threats occurring at the physical layer.

For example, radio-frequency (RF) interference, intentional jamming, abnormal signal transmissions, and certain forms of wireless spoofing may be difficult to detect using packet-level information alone.

Recent advances in Software-Defined Radio (SDR), signal processing, and machine learning create opportunities for developing security monitoring systems that analyze the characteristics of wireless signals directly.

Commercial solutions, such as those developed by Bastille Networks and Nozomi Networks, demonstrate the growing importance of RF-aware wireless security monitoring. However, their proprietary implementations make independent evaluation and experimentation challenging.

This thesis investigates whether physical-layer signal characteristics can improve wireless intrusion detection and how such capabilities can be implemented using affordable SDR hardware and open-source software.

Problem Description

Conventional WIDS solutions often rely on information extracted from successfully decoded wireless frames, including MAC addresses, frame types, traffic statistics, and protocol behavior.

However, this approach presents several limitations:

1. Certain wireless threats may disrupt communication without generating recognizable or decodable packets.

2. Malicious RF activity may resemble legitimate wireless interference.

3. Attackers may manipulate protocol identifiers, such as MAC addresses, to evade packet-based detection mechanisms.

4. Different wireless technologies may require separate protocol-specific detection solutions.

5. Physical-layer characteristics are often underutilized in conventional wireless security monitoring.

RF-based analysis provides additional information about wireless activity, including signal power, spectral characteristics, temporal behavior, and channel occupancy.

Nevertheless, important challenges remain in determining which physical-layer features are useful for security monitoring and whether they can reliably distinguish malicious activity from normal wireless behavior.

Another challenge is evaluating the extent to which a detection mechanism developed for one wireless technology can be adapted to others.

Aim

The aim of this thesis is to design, implement, and experimentally evaluate an intelligent RF-based wireless intrusion detection system using Software-Defined Radio and machine learning.

The proposed system will investigate how physical-layer features can identify suspicious wireless activities and whether combining RF-based and conventional packet-based information improves intrusion detection performance.

The thesis will initially focus on Wi-Fi, with the possibility of extending the investigation to another IoT communication technology.

Research Questions

1. Which physical-layer signal characteristics are most useful for identifying wireless attacks and abnormal RF activity?

2. How effectively can machine learning techniques distinguish malicious wireless transmissions from legitimate communication and environmental interference?

3. Can RF-based monitoring detect attacks that are difficult to identify using conventional packet-based WIDS approaches?

4. Does combining physical-layer and MAC-layer features improve wireless intrusion detection performance compared with using either source of information independently?

5. To what extent can the developed detection framework be adapted to different wireless communication technologies?

Methodology

The student will:

1. Conduct a literature review of RF-based intrusion detection, SDR-based wireless monitoring, physical-layer security, and machine learning techniques.

2. Establish an isolated wireless experimental testbed using SDR hardware, Linux computers, and commodity Wi-Fi equipment.

3. Collect RF measurements under different legitimate wireless traffic and interference conditions.

4. Generate representative wireless security scenarios in a controlled laboratory, including abnormal channel occupancy, interference, and selected denial-of-service activities.

5. Extract relevant RF features, such as received signal power, spectral energy distribution, channel occupancy, and temporal signal characteristics.

6. Develop and evaluate statistical or machine learning-based algorithms for identifying abnormal wireless activity.

7. Implement a conventional packet-based detection baseline using Wireshark, Kismet, or equivalent open-source tools.

8. Investigate a hybrid detection mechanism combining physical-layer measurements with MAC-layer traffic information.

9. Compare RF-based, packet-based, and hybrid detection approaches under identical experimental conditions.

10. Evaluate the computational requirements and feasibility of deploying the developed system on resource-constrained edge platforms.

If time and equipment permit, the student may extend the framework to a second wireless technology, such as BLE or Zigbee.

Evaluation Metrics

Detection Metrics

• Precision

• Recall

• F1-score

• False Positive Rate

• Detection Latency

• Area Under the ROC Curve (AUC)

Physical-Layer Metrics

• Received Signal Strength

• Signal-to-Noise Ratio (SNR)

• Channel Occupancy

• Spectral Power Distribution

• Interference Detection Rate

Network Performance Metrics

• Throughput

• Packet Loss

• Communication Latency

• Network Availability

Implementation Metrics

• CPU Utilization

• Memory Consumption

• Processing Latency

• SDR Sampling and Processing Requirements

Generalization Metrics

• Performance under different wireless traffic conditions

• Robustness to environmental interference

• Performance across different signal strengths and distances

• Adaptability to different wireless technologies

Expected Outcomes

The thesis is expected to:

• Develop an experimental framework for RF-based wireless intrusion detection using open-source tools and SDR hardware.

• Identify physical-layer features suitable for detecting suspicious wireless activity.

• Design and implement an intelligent RF-based intrusion detection algorithm.

• Compare the effectiveness of RF-based and conventional packet-based detection methods.

• Investigate whether combining physical-layer and MAC-layer information improves detection accuracy and robustness.

• Produce a reproducible dataset of legitimate and abnormal RF activity.

• Evaluate the feasibility of deploying the proposed detection system on edge devices.

• Provide recommendations for developing practical RF-aware security monitoring solutions for wireless IoT environments.

Knowledge of Linux, computer networking, cybersecurity, and Python programming is beneficial.

Familiarity with wireless communication systems, signal processing, machine learning, or Software-Defined Radio is an advantage.

The project is experimental and involves wireless communication equipment, SDR hardware, and open-source software.

The initial experimental scope will focus on Wi-Fi to ensure feasibility within a master's thesis. Extension to additional wireless protocols is optional.

Active RF experiments will be performed in an authorized, isolated laboratory environment.

Access to commercial wireless intrusion detection platforms is not required.