# WPFD: Active User-Side Detection of Evil Twins
## 2 Related Work
As a result, APSB (AP Service Blocking)attacks are made feasible by interfering with the client's EAPOL (Extensible authentication protocol over LAN) 4-way handshake and the WPA2-protected LAP, taking advantage of the evil twin's ability to operate on the same Wi-Fi channel as the LAP. EvilScout is installed on top of the SDN controller and takes advantage of OpenFlow features like PacketIn and writes FlowMod messages. The SDN Wi-Fi architecture enables developers to include new capabilities but also creates unknown security risks. For instance, because the controller is the brains of SDN Wi-Fi, there should be no design or implementation errors, and Duplicate Association is used to spot nefarious twin assaults. Since EvilScout only needs to verify one packet from every victim client, it has little controller overhead and is capable of quick detection. The research offers a thorough knowledge of APSB assaults and potential defense mechanisms. The most novel and standard part of the application of Wi-Fi communication in recent years is the IoT, and the typical example of an IoT will be the smart home. For example, we can use Wi-Fi to build a smart home. Then we can use wireless communication to establish simple household operations of kitchen items such as refrigerators or electrical appliances (the most common ones are televisions, speakers, etc.). In this case, if the Wi-Fi is considered only for self-use at home without unique encryption settings, under this application, such an innovative home environment may also be exposed to the risk of malicious evil twins. That is to say, in a public domain where free Wi-Fi is provided and in the private area of the home with poor security policies, the evil twin will also obtain personal information in practice if an attacker deliberately locks someone. Also, the risk is even greater if IoT devices are surveillance systems and cameras closely related to privacy. [PERSON] et al., who studied Wi-Fi-enabled home security surveillance systems using Raspberry Pi and IoT module, mention the connected novel system. However, such a system is also threatened by the evil twin. Even the smart meter, as in [PERSON] et al. [23], will be exposed to this threat. The attacker can get their information about the power wastage and cost of consumption of the house. In fact, for this kind of research on Rouge AP to IoT, [PERSON] et al. [24] presented a real-time and lightweight algorithm based on an information-theoretic approach for detecting rogue APs in embedded IoT devices. The most directly related to our work was the solution proposed by [PERSON] and [PERSON] [25], called Wi-Fihop, which detects evil twins based on their forward behavior. Wi-Fihop sends active probe packets and switches the WNIC to the monitor mode. It analyzes the response packets to determine if there is an evil twin. This approach is similar to our solution, and Wi-Fihop also needs one WNIC on the client side. However, unlike our solution, which is a purely client-side tool, Wi-Fihop requires a customized server to respond to specific probe packets. Furthermore, the particular probe packets are easily detected by an experienced attacker who can ignore the probe packets to bypass the detection of Wi-Fi. The WPFD does not have this problem  
On the other hand, in the previous research on general rogue APs there is a summary or a discussion like [PERSON] et al. [26], and for a round-trip time measurement with a machine learning algorithm, in [PERSON] et al. [27]. Furthermore, as mentioned above, there are also algorithms like [PERSON] et al., which is a standard algorithm of the LAN network environment [28], and [PERSON] et al. [29], which is a hash algorithm focused on WLAN security. Finally, for the Wireless LAN network, there is a detection solution designed by [PERSON] et al. [30] with a sensor node and a heartbeat method to prevent Rogue APs. Table 1 compares the accuracy performance of several evil twin attack detection systems.