# Graph-Based Multi-Label Classification for WiFi Network Traffic Analysis
## 3 Dataset Description  
The present work is the result of a set of research efforts that began in [1], aiming to improve automatic network traffic recognition in different situations. Specifically, in this case, we aim to recognize attacks on the network infrastructure by defining a supervised problem in a non-metric space. The elements of the input space are graphs representing how information flows through the network in a specific time frame.  
Simulations have been performed on the Aegean WiFi Intrusion Detection Dataset ([[http://icsdweb.aegean.gr/awid/](http://icsdweb.aegean.gr/awid/)]([http://icsdweb.aegean.gr/awid/](http://icsdweb.aegean.gr/awid/)) accessed on 20 August 2022) [10] that is a rigorous attempt to capture the inner workings of a WiFi Small Office Home Office (SOHO) network environment. Basically, it includes heterogeneous legit devices (such as smartphones, workstations and other smart devices), along with the attacker WiFi station and monitoring device to capture frames exchanged by other stations.  
The WiFi network setup used in the collection of AWID data employs the WEP security protocol to secure information traffic. This choice arises from the need to be able to deeply study multiple kinds of attacks while keeping frame capture and labeling procedures as simple as possible. This dataset gives valuable insights into the anomaly and attack detection problem in WiFi networks thanks to the large number of details included for each captured MAC frame (i.e., more than one hundred features). Moreover, fourteen different types of attacks have been implemented as well as realistic production of legitimate traffic flows. The extensiveness of considered scenarios and the abundant data made available with the AWID dataset make it a useful tool to assess algorithms validation both in terms of classes recognition capabilities and in terms of management of a huge amount of data.  
Frames are divided into fifteen classes, hierarchically organized in the following four macro-classes:  
* **Flooding**: Attacks of this kind exploit unauthenticated management and control mechanisms [18] by forging vast amounts of frames in order to disrupt communications by flooding the available medium. These kinds of attacks can be used to build more sophisticated strategies, such as in WiFi _Impersonation_ attack scenarios.
* **Frame Injection**: This macro-class includes attacks that exploit vulnerabilities in the WEP security cryptographic protocols. More in depth, the attacker uses the Access Point (AP) as an oracle to check cryptographic correctness of frames. Repeating this process multiple times, the attacker can retrieve cryptographic key material information.  
* **Impersonation**: This set of attacks is a key component to prepare more complex adversary scenarios, where the attacker tries to impersonate the access point by exploiting similar vulnerabilities as described before.
* **Normal**: Lastly, this macro-class collects network traffic of legitimate users connected through multiple smart devices.  
[PERSON] et al. [10] forged and captured the aforementioned attacks using the well-known penetration testing toolchain provided by the Kali Linux project (e.g., _interack-ng_ suite ([[https://www.aircrack-ng.org](https://www.aircrack-ng.org)]([https://www.aircrack-ng.org](https://www.aircrack-ng.org)) accessed on 20 August 2022) and MDK3 ([[https://tools.kali.org/wireless-attacks/mdk3](https://tools.kali.org/wireless-attacks/mdk3)]([https://tools.kali.org/wireless-attacks/mdk3](https://tools.kali.org/wireless-attacks/mdk3)) accessed on 20 August 2022)).  
The present work has been developed by employing a subset of the AWID dataset, containing patterns of 15 classes (which distribution has been detailed in Table 1).