# WPFD: Active User-Side Detection of Evil Twins
## 3 Design Principle and Detection Algorithm
### The Principle and Wireless Packet Forwarding Detector (WPFD) Algorithm  
The WPFD can be installed on any host without any special requirements. WPFD detects evil twins based on the general rule that a good twin will not forward wireless packets. The packet transmission process for a three-way handshake to establish a TCP connection through the evil twin is shown in Figure 3. In the fifth step, if User 1 does not send the ACK packet, the server would retransmit the SYN/ACK packet when the RTO (Retransmission Timeout) is reached. Henceforth, we refer to this retransmission of an SYN/ACK packet associated with a WPFD TCP/IP detection connection as a probe hit. Every time a packet is retransmitted, the RTO for this packet doubles. Operating systems often resend an IP packet at least five times [32], and most web servers define the initial RTO from 2 to 3 s.  
Figure 2: The perception of an Evil Twin by a WNIC (Wireless Network Interface Controller).  
As described in the previous section, this paper utilizes the retransmission mechanism and the three-way handshake mechanism of the TCP/IP protocol to detect packet forwarding behavior in Wi-Fi networks. We propose the following algorithm, called Wireless Packet Forwarding Detector (WPFD) algorithm, to detect evil twins.  
Step 1: Choose a remote host \(IP_{server}\) with an IP address from a list of websites. The top 10,000 websites on Alexa are used to create the list.  
Step 2: WPFD checks the environment to see if any APs with the same SSID are present. If not, there are no evil twins. Hence the detecting process is over. If they are present, WPFD will choose all APs with the same SSID, sometimes referred to as suspicious APs. WPFD discovers the Wi-Fi channel that each suspicious AP is using. Channel groups are used to classify suspect APs that are connected to the same Wi-Fi channel. WPFD gathers each channel group before moving on to step 3.  
Step 3: Let \(S\) stand for a collection of the channel groups that WPFD gathered in step 2. To determine if a suspicious AP in \(S\) is an evil twin, WPFD employs Algorithm 1. The suspect AP, \(AP_{input}\) is chosen as Algorithm 1's input. Algorithm 1's current inputs are \(IP_{server}\), \(AP_{input}\), and \(S_{input}\). The return result indicates whether or not \(AP_{input}\) has an evil twin.  
Every channel group employs a channel, and its _Repeats_ will be assessed. If \(AP_{input}\) has an evil twin, it will connect to the Internet using a legitimate AP. Let \(ProbeHi_{i}\) indicate the number of times \(IP_{server}\) retransmitted when algorithm 1 is applied to channel group \(G_{i}\) using channel \(CH_{i}\). \(Total_{i}\) is a counter used to determine the number of examinations performed when \(G_{i}\) is utilized in algorithm 1, and channel \(CH_{i}\) will be used by suspect APs. The greater \(ProbeHi_{i}\) is, the more retransmissions occur in channel \(CH_{i}\) which suspect APs in \(G_{i}\) use. The ratio of \(robeHi_{i}\) to \(Total_{i}\) might be used to determine if \(AP_{input}\) forwards \(SYN\) packets sent by WPFD, since SYN/ACK packet retransmissions from a certain \(IP_{server}\) do not occur often. _Repeats_ and _Threshold_ should be set to 5 and 0.1, respectively. Section 4 explains the rationale.  
Figure 3: The packet sequence for the three-way handshake of User 1 was used to establish one TCP (Transmission Control Protocol) connection through an evil twin.