## 3 Methodology
### Preprocessing Steps  
As we mentioned before, the dataset consists of 36,913,503 instances, 30,387,099 of normal traffic, and 6,526,404 malicious ones. There are 49,990 instances for the Krack attack and 186,173 instances for the Kr00k attack. We will implement our experiment in two phases; the first phase consists of two classes (Krack, normal) and (Kr00k, normal). While the second phase consists of multi-class (Krack, Kr00k, and normal). To highlight the importance of the preprocessing of the dataset before using it in the proposed model, we have used the chosen sample without any preprocessing and feature selection techniques. The first sample consists of 106,971 kr00k traffic and 106,791 normal ones, while the second sample consists of 33,180 Krack traffic and 34,000 normal ones, with 254 features for both samples, as shown in Table 2.  
We chose the following machine learning algorithms:  
1. Decision tree: the process for building a decision tree and the most used criteria for splitting the data [42]: - Calculate an impurity measure for the entire dataset (e.g., Gini impurity or entropy). - For each feature, calculate the impurity measure of splitting the data based on the values of that feature. - Choose the feature that produces the lowest impurity measure after splitting the data. - Split the data based on the chosen feature and repeat the process for each resulting subset of data until a stopping criterion is met (e.g., a maximum depth is reached or the number of samples in a leaf node is below a certain threshold). The equations for calculating impurity measures depend on the specific criterion being used. For example, the Gini impurity measure for a set of samples \(S\) with \(C\) classes is:  
\[G(s)=1-\sum_{i=1}^{c}P_{i}^{2} \tag{6}\] \begin{table}
\begin{tabular}{l l} \hline \hline
**Krack** & **Kr00k** \\ \hline Krack is a series of attacks, exploited by attackers & Kr00k is a vulnerability in WPA2. \\ \hline The basic idea of Krack is that the attacker can use the keystream to know the plain and the cipher text. \\ The encryption employed to secure data packets transmitted over a Wi-Fi connection is impacted by Kr00k. Typically, a unique key \\ determined by the user’s Wi-Fi password is used to encrypt these packets. Researchers from ESET claim that during the \\ “disassociation” process, this key is reset for Broadcom and Cypress Wi-Fi chips to an all-zero value. \\ \hline Exploited during the 4-way handshake & Exploited after a disassociation. \\ \hline Because it exploits implementation flaws in the WPA2 protocol itself, it affects most Wi-Fi-capable devices. \\ Identified Broadcom and Cypress components used in mobile phones, tablets, laptops, and IoT devices. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparing Krack and Kr00k. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Samples** & **Attack** & **Normal** \\ \hline First Sample & 106,971 Kr00k traffic & 128,093 \\ \hline Second Sample & 33,180 Krack traffic & 34,000 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Training and testing samples in AWID3 dataset. where \(p_{i}\) is the proportion of samples in \(S\) that belong to class \(i\). The entropy impurity measure for the same set of samples \(S\) is:  
\[H(s)=-\sum_{i=1}^{c}\,p_{i}\,log_{2}\,p_{i} \tag{7}\]  
where \(p_{i}\) is the same as above. These impurity measures are used to evaluate the quality of each split and to choose the feature that produces the lowest impurity measure. * Ensemble classifiers: combine multiple individual classifiers into a single ensemble classifier to improve the overall predictive performance. There are different types of ensemble classifiers, such as bagging, boosting, and stacking, and the equations used for each type can vary. * SVM: Support Vector Machine (SVM) is a popular machine learning algorithm for classification, regression, and outlier detection. The main idea behind SVM is to find a hyperplane that separates the data into different classes with the largest margin possible.