# Threat Detection Model for WLAN of Simulated Data Using Deep Convolutional Neural Network
## 2 Materials and Methods
### RF Signature-Based Router Impersonation Detection  
In order to mislead network users into connecting to it, a malicious agent will try to impersonate a genuine router in a technique known as router impersonation. Simple digital identifiers used in security identification systems, including MAC addresses, IP addresses, and SSIDs, are ineffective at identifying such attacks. These detectors can be easily tricked. Consequently, additional secured solutions use further communication data, like the radio RF link fingerprinting combined with these straightforward digital detectors. A receiver-to-transmitter wireless pair produces a single RF signature from the receiver for combining the RF impairments and channel. The process of identifying transmitted RF signals in a shared spectrum throughout these signatures is called Fingerprinting RF. The study [37] presented a design of a deep learning architecture to consume raw baseband in quadrature/phase (IQ) to identify and sample the signal-transmitting radios. The architecture can recognize an RF transmitting radio if the channel profiles stay steady through the processing time or the radio impairments are dominant. The majority of WLAN architectures have permanent routers for creating a stationary channel signature if the receiver position is also constant. For this scenario, the deep neural networks are able to define router impersonators by evaluating the data pair of the MAC address and the received signal's RF fingerprint to that of the identified routers. These works create several fixed routers for the WLAN system with a permanent observer utilizing the WLAN Toolbox and perform neural network training on the computer-generated data by Deep Neural Learning. This approach assumes the following environment:  
1. The network includes several trusted known routers (of identified MAC addresses) operating in an indoor area. 2. Some unidentified routers may include router intrusions within the inspection network coverage. 3. The \"Unknown\" category stands for each transmitting apparatus that is not included within the known group of routers. Figure 1 demonstrates the three known router scenarios. The observer node gathers lighthouse signals of the routers with non-HT (non-high throughput) and identifies the RF fingerprint using the long (legacy) training field (L-LTF). To avoid any data dependency, L-LTF Transmitted signals are configured as the same for every router to allow algorithm application. Since the observer and the routers are constant, the RF signatures (combination of RF impairments and multi-path channel pattern) RF3,  
Figure 1: The diagram of the first scenario of three known routers. RF2, and RF1 perform without variation with time. Unidentified router information is a set of random RF signatures that are unlike the identified routers. In another scenario in which a user is linked to a mobile hot spot and a router, the observer decodes the MAC address and collects beacon frames after training. Then, the observer takes out the L-LTF signals and employs these signals to categorize the RF signature for the beacon frame source. The observer assigns that the source is a \"known router\" if the RF fingerprint and the MAC address match, as shown for Router 3, Router 2, and Router 1. In the same context, the observer defines the source as an \"unknown router\" if the RF signature does not agree with every one of the identified routers and the beacon MAC address is not included in the database, as is demonstrated for a mobile hot spot in Figure 2.  
The third scenario demonstrates the effect of a router intrusion; where an impersonator router (evil twin) tries to transmit beacon frames by replicating the MAC address of an identified router, see Figure 3. The original router can be jammed by the hacker, forcing users to connect to its evil duplicate. The observer decodes the MAC address when receiving the beacon frames from the evil duplicate. The MAC address of an identified router matches the decoded MAC address but the RF signature does not counterpart.