Lightweight CNN-Based Wi-Fi Intrusion Detection Using 2D Traffic Representations

TL;DR

This work tackles real-time intrusion detection in Wi-Fi networks by transforming a compact set of AWID3 features into 2D images and applying lightweight CNNs for binary and multi-class classification. It introduces five 2D transformation techniques, including Cyclic, Circulant, Grayscale Circulant, Correlation, and Gramian Angular Field (GAF), to produce $16\times16$ inputs, and evaluates four small CNN architectures ($2D-2L$, $2D-1L$, $1D-2L$, $1D-1L$). The results show that the GAF-based $2D-2L$ model achieves $99.93\%$ binary accuracy and $99.62\%$ multi-class accuracy with inference times around $48\mu$s and $40\mu$s per record, respectively, using only about $11\text{k}$ to $34\text{k}$ parameters. The work provides open-source code and demonstrates practical viability for real-time deployment on resource-constrained devices, with future plans for on-device deployment on platforms such as OpenWrt.

Abstract

Wi-Fi networks are ubiquitous in both home and enterprise environments, serving as a primary medium for Internet access and forming the backbone of modern IoT ecosystems. However, their inherent vulnerabilities, combined with widespread adoption, create opportunities for malicious actors to gain unauthorized access or compromise sensitive data stored on connected devices. To address these challenges, we propose a deep learning based network intrusion detection system (NIDS) for Wi-Fi environments. Building on our previous work, we convert network traffic into two-dimensional data representations and use them to train DL models based on convolutional neural network (CNN) architectures. We implement five distinct techniques for generating the two-dimensional representations, and to ensure low detection latency, we adopt lightweight CNN architectures in our NIDS. The models are trained using the AWID3 dataset, a publicly available benchmark for Wi-Fi NIDS research, and are evaluated for both binary and multi-class classification tasks. Experimental results demonstrate that the proposed approach achieves competitive detection performance with low inference time, making it suitable for real-world Wi-Fi deployment scenarios.

Figures (3)

• Figure 1: A few samples of GAF images for each type of attack data and normal data rayed
• Figure 2: Architectures of 2D-CNN and 1D-CNN used in our work
• Figure 3: Confusion matrices for binary and multi-class classifications for best performing transformation techniques and CNN models