# Threat Detection Model for WLAN of Simulated Data Using Deep Convolutional Neural Network
## 2 Materials and Methods
### The Developed Neural Network Architecture
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Name/Size** & **Description** & **Layer Label** & **No** \\ \hline
160 \(\times\) 2 \(\times\) 1 images & Image Input & ‘Input Layer’ & 1 \\ Stride padding [1 1 0 0] and [1 1] with 50 7 \(\times\) 1 convolutions & 2-D Convolution & ‘CNN1’ & 2 \\ Batch normalization & Batch Normalization & ‘BN1’ & 3 \\ Leaky ReLU with a scale of 0.01 & Leaky ReLU & ‘LeakyReLu1’ & 4 \\
2 \(\times\) 1 max pooling with stride [2 1] and padding [0 0 0 0] & 2-D Max Pooling & ‘MaxPool1’ & 5 \\
50 7 \(\times\) 2 convolutions with stride [1 1] and padding [1 1 0 0] & 2-D Convolution & ‘CNN2’ & 6 \\ Batch normalization & Batch Normalization & ‘BN2’ & 7 \\ Leaky ReLU with a scale of 0.01 & Leaky ReLU & ‘LeakyReLu2’ & 8 \\
2 \(\times\) 1 max pooling with stride [2 1] and padding [0 0 0 0] & 2-D Max Pooling & ‘MaxPool2’ & 9 \\
256 fully connected layer & Fully Connected & ‘FC1’ & 10 \\ Leaky ReLU with a scale of 0.01 & Leaky ReLU & ‘LeakyReLu3’ & 11 \\
50\% dropout & Dropout & ‘DropOut1’ & 12 \\
80 fully connected layer & Fully Connected & ‘FC2’ & 13 \\ Leaky ReLU with a scale of 0.01 & Leaky ReLU & ‘LeakyReLu4’ & 14 \\
50\% dropout & Dropout & ‘DropOut2’ & 15 \\
5 fully connected layer & Fully Connected & ‘FC3’ & 16 \\ Softmax & Softmax & ‘SoftMax’ & 17 \\ Crosentropyex & Classification Output & ‘Output’ & 18 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The layers of the developed architecture. tx_Waveform = [tx_Waveform; zeros (160,1) ]; % generate unseen RF fingerprint or an undetected multipath channel. Reset (multipath_Channel)  Frame_Count= 0;  while frame_Count < frames_Per_Router  rxMultipath = multipath_Channel(tx_Waveform);  rxImpairment = helperRFImpairments(rxMultipath, radio_Impairments(router_Idx), fs);  rxBig = awgn(rxImpairment,SNR,0);  % Detect the WLAN packet and return the received L-LTF signal using rf_Fingerprinting_NonHT_Front_End object [payload_Full, cfgNonHT, rx_NonHT_Data, chanEst, noiseVar, LLTF] = rx_Front_End (rxSig);  If payload_Full  frame_Count = frameCount+1;  rec_Bits = wlan_NonHT_Data_Recover (rx_NonHT_Data, chanEst, noise_Var, cfg_NonHT, 'Equalization_Method', 'ZF');  % Evaluate and decode recovered bits  mpduCfg = wlan_MPDU_Decode (recBits, cfgNonHT);  % Reshape and Separate Q and I of neural network  LLTF= [ real (LLTF), image (LLTF) ];  LLTF = permute (reshape (LLTF, frame_Length, [], 2, 1), [1 3 4 2]); ypred = classify(sim_Net, LLTF);  if sum (contains (known_MAC_Addresses, mpduCfg.Address2 )) -= 0  if categorical (convert_Chars_To_Strings (mpduCfg.Address2))-=ypred  disp (strcat ( \" MAC Address \", mpduCfg.Address2,\" is known, fingerprint mismatch, ROUTER IMPERSONATOR  DETECTED\"))  else  disp(strcat(\"MAC Address \", mpduCfg.Address2,\" is known, fingerprint match\"))  end  else  disp(strcat(\"MAC_Address \", mpduCfg.Address2,\" is not recognized, unknown device\"))  end  end  % To generate a new static channel, reset multipath_Channel object  Reset (multipath_Channel)  end  end

## 3 Results

### Scenario 1, Generating AA...A MAC Address for the Unknown Devices

The operation of MAC address generation after applying channel impairments results in data frames for the router of the WLAN, a photo of the generated data is shown in Figure 10.

There are four normally generated MAC addresses of the known routers, while A...A MAC address for the remaining 10 unknown routers. The training options have been

Figure 10: Generating the data frames for routers. ### Scenario 2, Generating Random MAC Address for the Unknown Devices and 7 Known Routers

The operation of MAC address generation after applying channel impairments results in data frames for the router of the WLAN, a photo of the generated data is shown in Figure 13.

There are also four normally generated MAC addresses for the known routers and 10 different other MAC addresses for the unknown routers. The training options have been configured under the same conditions as scenario 1.