# WPFD: Active User-Side Detection of Evil Twins
## 4 Evaluation
### Discussion  
We compare WPFD with previous studies on detecting evil twins [19; 20] and a traditional time-metric-based solution [34]. [PERSON] et al. [19] is our prototype using the evil twin redirection methodology. However, if the adversary modifies the sequence numbers and ACKs, it will be bypassed. Instead, WPFD only sends SYN packets. These probe SYN packets sent by WPFD behave the same way as standard TCP three-way handshake packets. Therefore, attackers have little chance of finding the probe packets, bypassing the WPFD's detection. [PERSON] et al. [34] showed that time-based methods might be affected by various environmental factors. Another difference is that a WPFD only needs one device because it uses the same WNIC to send probe packets and switch to monitor mode. When we studied LAF [20], it had some of the advantages of the WPFD. Still, the WPFD has evolved into an active detection mechanism after changing the algorithm from the passive detection mechanism of LAF. The novel dynamic mechanism is more capable of detecting  
Figure 5: Accuracy of WPFD under various volumes of network traffic.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Time** & **Probe Hits of the Good Twin** & **Probe Hits of the Evil Twin** \\ \hline
3 min & 0 & 3 \\ \hline
5 min & 0 & 4 \\ \hline
7 min & 0 & 6 \\ \hline
10 min & 1 & 9 \\ \hline
15 min & 1 & 14 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Time efficiency experimental results under different test durations.  
the evil twin at any time, which has excellent usability. Table 4 shows these advantages and differences.  
If an attacker could detect the probe packets sent by a WPFD, the attacker could block such packets or send RST packets to stop the retransmission of SYN/ACK packets from servers. However, a WPFD only sends SYN packets. It is not reasonable for an attacker to block every SYN packet. Moreover, a WPFD can change the source IP addresses or MAC addresses of probe SYN packets. It can also send different probe SYN packets to other servers. In this case, an attacker is brutally distinguishing the probe SYN packets sent by WPFD from the standard SYN packets sent by a regular user. Thus, the attacker cannot bypass the detection of a WPFD. Retransmission of IP packets may frequently occur in a Wi-Fi network. Therefore, users connected to an evil twin experience disconnection if the evil twin blocks retransmitted packets. In the end, users will not use the evil twin and choose a good twin to connect to the Internet.  
Second, a WPFD functions well even if multiple APs have identical SSID but use different channels. However, the more channels are involved, the more detection time is needed. There could exist three or more other channels used by suspect APs in a Wi-Fi network. Thus, the detection time would increase. To address this problem, a WPFD could speed up the detection time by sending multiple probe SYN packets to numerous servers simultaneously and checking their responses. In this situation, adjusting the 5 Repeats times in the algorithm might still restrict the detection time of a WPFD to a few minutes.