# Threat Detection Model for WLAN of Simulated Data Using Deep Convolutional Neural Network
## 2 Materials and Methods
### The Developed Neural Network Architecture  
IQ imbalance has been considered in this work due to that the quadrature mixers are usually degraded by the mismatch in phase and gain between the parallel RF chain branches handling the Q and I signal tracks. Phase imbalance comes from the quadrature signal's phase divergence from 90 degrees, whereas amplitude imbalance is caused by the mismatch in their gains. Due to frequency-dependent low-pass filters, IQ imbalance only fluctuates with frequency, and as a result, it bears a particular transmitter signature for that frequency. This work develops a deep learning convolutional neural network (CNN) that contains three fully connected and two convolutional layers. The training options have been configured to use a mini-batch size of 512 with the ADAM optimizer, which is the extended version of stochastic gradient descent and can be implemented in natural language and computer vision processing. The perception behind this model is to learn features independently by the first layer in Q and I. The filter size is 1 \(\times\) 7, while the size is 2 \(\times\) 7 at the next layer for extracting features that combine both Q and I. Lastly; the extracted features in the previous layers are classified by a final three fully connected layers [37]. To make sure that the applied CNN model generalizes successfully, the selection of network hyperparameters, such as the number of filters and their sizes in the convolution layers, and CNN depth, is crucial. These are carefully selected via cross-validation. We fixed the dropout rate for the dense layers to 50% in order to avoid overfitting. Additionally, we choose a regularization factor of = 0.0001. Adam optimizer is used to train the network's weights, and its learning rate is set to lr = 0.0001. Back-propagation is used to minimize error prediction, with categorical cross-entropy computed on the classifier output serving as the loss function. The developed architecture is detailed in Table 2.  
Figure 9: Creating Input Matrices with Real-Values. After setting the training options, network training is performed. Then, we loaded the trained network, testing dataset, and the user-generated MAC Addresses. The accuracy of the network architecture is computed, and the classification for the testing frames is performed to detect router imitators. For each unknown MAC address and all the known MAC addresses in iteration, a generation of beacon frames is performed. Then, generating a new pack of multipath channels and RF impairments is performed. The RF profile for these frames should be categorized as \"Unknown\" because all of the impairments are unexplored. Beacon frames of defined MAC addresses represent router imitators whereas those of undefined MAC addresses are unknown devices. The impersonator detection algorithm can be represented by Algorithm 2. ``` Frames_Per_Router = 4; Known_MAC_Addresses = generated_MAC_Addresses (1: No_Known_Routers); % each simulated radio is assigned as random impairments within the earlier defined ranges For router_Idx = 1: No_Total_Routers  radio_Impairments (router_Idx).Phase_Noise = rand*( phase_Noise_Range (2)-phase_Noise_Range (1) ) + phase_Noise_Range (1);  radio_Impairments (router_Idx).DC_Offset = rand*( DC_Offset_Range (2)-DC_Offset_Range (1) ) + DC_Offset_Range (1);  radio_Impairments (router_Idx).Frequency_Offset = fc/1e6*(rand*( freq_Offset_Range(2)-freq_Offset_Range(1)) ) + freq_Offset_Range(1)); end % To generate a new static channel, Reset multipath_Channel object Reset (multipath_Channel) % Do for one unknown routers and all known For mac_Index = 1:(No_Known_Routers + 1) beacon_Frame_Config.Address2 = generated_MAC_Addresses(macIndex); % produce Beacon frame bits beacon = wlan_MAC_Frame(beacon_Frame_Config, 'Output_Format', 'bits'); tx_Waveform = wlan_Waveform_Generator(beacon, nonHT_Config); tx_Waveform = helper_Normalize_Frame_Power (tx_Waveform); % To account, add zeros for channel delays