Fake Wi-Fi (Evil Twin) Detection Using Machine Learning: A Review and a Random Forest-Based Detection Framework

Public Wi-Fi hotspots, although convenient, compromise the privacy and security of the users since attackers can launch Evil Twin attacks by deploying rogue access points that mimic the legitimate ones and lure devices to connect to them. Checking a single parameter such as the network name or signal strength is insufficient to detect such fake access points since attackers can spoof these values. The paper evaluates the latest machine learning algorithms for rogue access point detection, compares their approaches and shortcomings, and identifies research gaps. Based on the review, the paper proposes a client-side approach that employs the Random Forest algorithm and a set of parameters including SSID, BSSID, RSSI, channel, security, MAC address, and response mask to classify access points as legitimate or malicious and alert the user before connecting. Finally, the paper presents a proposal for evaluation using accuracy, precision, recall, F1-score, and false-positive rate, reports the results from the reviewed articles, but does not perform any experiments.