# WPFD: Active User-Side Detection of Evil Twins
## 1 Introduction
Once a client connects to an evil twin, it is far easier for attackers to steal information using techniques such as an SSL (Secure Sockets Layer) bump. A VPN may solve this problem; however, it is too expensive to use VPNs for every network service. Moreover, according to [9], a malicious attack by an evil twin is easy to launch. Most of the solutions to evil twin problems were designed with a system administrator's permission. The main disadvantage of this approach is that the defenders may need (1) one specific network device for detection, such as one wireless sensor or router, (2) some particular data, such as legal APs/IPs or training data via machine learning, and (3) network traffic trace information. The above requirements are usually not available to general Wi-Fi users. Due to the problems mentioned above, this paper proposes an active client-side solution named Wireless Packet Forwarding Detector (WPFD) to solve the issues regarding some free public hotspots such as unencrypted WLANs. WPFD transforms the traditional detection approaches from the primary device-based detection methods to TCP/IP protocol-based monitoring methods, with packet retransmission rules and packet-forwarding conventional behavior. Thus, the only information required is the TCP/IP header of the  
Figure 1: A scenario of an evil twin setup. wireless packet. WPFD sends SYN (Synchronize sequence numbers) packets to popular websites and observes the retransmission behavior of corresponding SYN/ACK (Synchronize sequence numbers/Acknowledgment field significant) packets. Our consistent results show that WPFD has an accurate and fast detection capability for the presence of an evil twin after observing only a few packets. The features of WPFD make it an appropriate tool for Wi-Fi users. They are as follows:  
1. The WPFD does not require specific information, such as legal APs/IPs, training data via machine learning, or any other support from a network administrator. The WPFD is a user-side solution that may secure any Wi-Fi user at any location. 2. The WPFD sends SYN packets to significant websites to make its detection a more effective solution. An evil twin finds it hard to detect that it is being monitored by a WPFD, and is even less likely to adopt any anti-surveillance action in time. 3. It is based on evil twins and TCP/IP protocol. An evil twin will barely evade discovery by a WPFD. Hence, even if an evil twin can raise the packet delay time or manipulate the content of IP packets, it still needs to forward probing IP packets sent by a WPFD. A probe IP packet is just a regular SYN packet. 4. The WPFD detection accuracy is unaffected by topology, network type, traffic, or any prefetch mechanism because it does not rely on time measurement. 5. The WPFD is the first solution that combines the active probe packets and the passive monitor mode of a WNIC (Wireless Network Interface Controller) using only one WNIC and no custom server. As a result, WPFD is well suited to solving the evil twin problem in devices with only one WNIC. The related work on rogue APs and evil twins is discussed in Section 2. The principles and the algorithm of the WPFD are described in Section 3. The discussion on various experimental results, and the evaluation of the effectiveness and efficiency are given in in Section 4, along with the debate on the security issues related to WPFDs. Finally, the conclusions of our study on WPFDs are in Section 5.