Wifi Deauthentication Attack Detector Using Esp8266 — Complete Documentation & Simulation

Overview & System Context

Wifi Deauthentication Attack Detector Using Esp8266: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9514 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background A Low-Cost Wireless Intrusion Detection System for Real-Time Wi-Fi Deauthentication Detection Detecting Deauthentication Using NodeMCU ESP8266 is a low-cost, hardware-based wireless intrusion detection project designed to monitor nearby Wi-Fi traffic and identify IEEE 802.11 deauthentication frames .

The NodeMCU ESP8266 operates in promiscuous mode , allowing it to passively monitor wireless packets without connecting to a specific Wi-Fi network. Captured packets are inspected in real time, and when a deauthentication frame is detected, the system immediately activates a visual and audible alert. II This project is intended for cybersecurity education, research, defensive monitoring, and authorized testing environments.

Figure 1: Esp8266 Deauth Scanner | Esp8266 Deauther Software – BTLQB The prototype uses a NodeMCU ESP8266 connected to an external LED and buzzer on a breadboard. I 30 December 2025 I Faculty of Engineering II The Islamia University of Bahawalpur, Pakistan BS Cyber Security and Digital Forensics Department of Information and Communication Engineering The Islamia University of Bahawalpur Do not use this project to interfere with, disrupt, or access wireless networks without explicit authorization.

Figure 2: Instructions | Wi-Fi Jammer from an ESP8266 | WiFi Deauther | Hackaday.io I Building low-cost solutions for cybersecurity education and wireless security awareness. A low-cost wireless intrusion detection system using NodeMCU ESP8266 to detect Wi-Fi deauthentication frames in real time and trigger LED and buzzer alerts.

A low-cost, hardware-based wireless intrusion-detection prototype built with a NodeMCU ESP8266 . The system monitors IEEE 802.11 traffic, identifies deauthentication management frames (subtype 0x0C) , counts them over a short observation window, and activates a red LED and buzzer when the configured threshold is reached. Project scope: Deauthentication detection only. Disassociation detection was not included in the final demonstrated implementation.

Figure 3: #cybersecurity #esp8266 #iot #wifisecurity #deauthattack # ... This project was developed under the BS Cyber Security and Digital Forensics program, Department of Information and Communication Engineering, The Islamia University of Bahawalpur , and was demonstrated at CYBERGUARD 2025: CPS Security Expo on 30 December 2025.

Supervisor: Dr. Iftikhar Rasheed Team: Shan Rasool (4022), Ahmad Ghaffari (4042), Affan (4019), Faizan Manazir (4045) A deauthentication attack can disrupt Wi-Fi availability by injecting forged 802.11 management frames that cause clients to disconnect from an access point. A small, dedicated monitor can provide an immediate indication that abnormal deauthentication activity is occurring, which is useful for education, security demonstrations, and controlled wireless-security research.

The default threshold is 10 deauthentication frames within 1 second . Both values are configurable in src/deauth_detector.ino . Use a 3.3 V-compatible active buzzer/module . If the buzzer requires more current than an ESP8266 GPIO should supply, drive it through a transistor and suitable external supply. Testing was performed in a controlled Wi-Fi environment. The ESP8266 was configured for wireless packet monitoring and tested against authorized deauthentication traffic generated for the project demonstration.

The project demonstrated successful real-time detection of deauthentication activity. The exhibition implementation was evaluated qualitatively rather than through a large statistical accuracy study; therefore, no fabricated accuracy percentage is reported. The ESP8266 listens to one 2.4 GHz channel at a time. The included firmware supports channel hopping, but hopping introduces a trade-off between channel coverage and observation time. For a focused laboratory demonstration, you can disable hopping and set FIXED_CHANNEL to the channel used by the test network.

This repository is intended for education, authorized security testing, and controlled laboratory environments . Only monitor or test wireless networks when you have permission to do so. Low-cost ESP8266-based system for real-time Wi-Fi deauthentication attack detection with LED and buzzer alerts. Thank you for visiting nature.com. You are using a browser version with limited support for CSS. To obtain the best experience, we recommend you use a more up to date browser (or turn off compatibility mode in Internet Explorer). In the meantime, to ensure continued support, we are displaying the site without styles and JavaScript.

This paper presents a real-time, lightweight system for detecting Wi-Fi deauthentication (DA) attacks that uses the NodeMCU ESP8266 microcontroller for live packet sniffing and feature extraction. Tailored for low-power IoT environments, the system combines the sequential learning capabilities of Long short-term memory (LSTM), Gate recurrent unit (GRU), and Recurrent neural network (RNN) with the interpretability of logistic regression (LR). These hybrid models analyze Wi-Fi traffic in real time to detect anomalous behavior based on key metrics such as Received Signal Strength indicator (RSSI), DA, packet count, and Signal noise ratio (SNR), which are also displayed live on an OLED screen. The proposed framework uniquely integrates hybrid temporal deep learning with interpretable classification through (LR) in an ultra-low-cost embedded data acquisition setup through NodeMCU, addressing a gap in existing intrusion detection research that often focuses on either cloud-based processing or non-interpretable model. The system was trained and validated on a dataset of over 5,600 labeled samples collected under varied network conditions. Among the evaluated models, GRU_LR achieved the highest accuracy (96%) and demonstrated superior performance in identifying minority-class threats. By combining explainable AI with cost-effective embedded sensing, this work delivers a practical and transparent intrusion detection approach that can be readily adapted to diverse IoT and wireless security contexts.

A novel intrusion detection framework using hybrid deep learning to detect IIoT cloud environments attacks Wi-Fi networks are the backbone of today’s communication network and provide connectivity at homes, offices, and public establishments. With increasing dependency on wireless technology, it is also essential to make networks efficient, reliable, and secure. Despite fantastic technological developments, Wi-Fi networks remain prone to performance degradation and hostile attacks. Interference in signals, busy bands, and environmental interference are some of the challenges to network reliability. For example, the 2.4 GHz band, which is congested with consumer equipment, is plagued by poor non-overlapping channels, whereas the less congested 5 GHz band is plagued by lessened range 1 .

Signal-to-Noise Ratio (SNR) is among the most important Wi-Fi performance metrics, being the desired signal power to background interference noise power ratio. Smooth and good-quality connections are indicated by high SNR, whereas low SNR results in data loss, lowered throughput, and repeated disconnections. Physical and electronic interference due to domestic appliances, as well as proximity to access points, are contributing factors 2 .

With the progression of wireless technology, threats to it also progress. Existing lightweight IDS implementations mainly depend on shallow learning models or fixed thresholds, which limit their ability to capture complex temporal attack patterns 3 . In contrast, our work combines deep temporal sequence modeling (LSTM/GRU/RNN) with a lightweight classifier (Logistic Regression) on a resource-constrained edge platform. This hybrid design enables efficient real-time detection with reduced computational cost. Machine learning (ML) and artificial intelligence (AI) techniques offer dynamic solutions that can analyze a significant amount of network traffic to identify typical behavior and alert on atypical patterns. Regarding Wi-Fi security, ML models are most helpful in identifying behavioral outliers, such as sudden spikes in deauthentication packets, thereby reducing false positives and enhancing threat response 4 .

The most aggressive of these attacks is the deauthentication attack, which targets an 802.11 protocol vulnerability to abruptly disconnect clients from the air. It may be used for launching denial-of-service (DoS) attacks, permitting man-in-the-middle (MITM) attacks, or hijacking sensitive user credentials. Countermeasures for such vulnerabilities in real time, especially for low-energy or resource-limited applications, are critical 5 .

However, few existing solutions combine real-time anomaly detection with low-cost, edge-based deployment using interpretable models, a critical need in constrained environments such as IoT networks. To address this challenge, this work presents a robust, real-time Wi-Fi security monitoring system utilizing the NodeMCU ESP8266 microcontroller for live packet sniffing and feature extraction, while model training and inference are performed on an external computer. The system monitors key wireless parameters, including packet count, RSSI, SNR, noise level, and the rate of deauthentication packets, and displays them on an OLED screen for live inspection. A significant strength of this work lies in the creation of a real-time, application-specific dataset, collected directly from the NodeMCU during live traffic conditions. Over 5,600 labeled samples were gathered under diverse network environments capturing authentic temporal fluctuations and realistic interference patterns which ensured that the training data reflected the dynamic nature of real-world scenarios.

To analyze the collected data, we employ hybrid deep learning models that combine the temporal learning strengths of LSTM, GRU, and RNN architectures with the interpretability and efficiency of logistic regression (LR). Traditional models often struggle to capture the sequential dependencies inherent in time-series Wi-Fi traffic or fail to provide interpretable outputs particularly in constrained edge environments. The hybrid approach addresses these limitations by offering both robust temporal pattern recognition and lightweight, explainable classification, making it highly suitable for real-time, embedded security applications. While reference 23 demonstrated the effective use of deep learning models on the standardized UNSW-NB15 dataset, our work introduces several critical advancements that address gaps in real-world applicability and methodological depth. First, whereas 23 utilized a generic benchmark dataset, we have constructed and validated our models on a novel, custom-built dataset integrating specific IoT-relevant features like RSSI and DA levels, which directly enables finer-grained multi-class attack detection in real-world Wi-Fi environments. Second, beyond mere accuracy, we place a strong emphasis on deployability and resource efficiency. While 23 employed a substantial 200 epochs for training a resource-intensive process suitable for offline analysis—our hybrid architecture was meticulously optimized to achieve superior performance with significantly lower computational overhead, making it viable for real-time inference on resource-constrained hardware like the NodeMCU. Finally, our proposed hybrid ensemble methodology (LSTM/GRU/RNN integrated with LR) moves beyond the single-model paradigms to offer a unique combination of temporal feature extraction and interpretable classification, providing both high accuracy and actionable insights not delivered by the models in 23 . This focus on a specialized dataset, hardware efficiency, and an interpretable hybrid model constitutes a novel contribution aimed squarely at practical IoT security deployment.

The novelty of our work is fourfold: First, we introduce a novel hybrid ensemble architecture that cascades temporal feature extractors (LSTM, GRU, RNN) with a logistic regression classifier, uniquely balancing high accuracy with model interpretability. Second, we move beyond standardized benchmarks by constructing and utilizing a custom, multi-class dataset integrating RSSI and DA levels for fine-grained attack detection in real Wi-Fi environments. Third, we provide unprecedented resource usage benchmarks that prove the practical viability of our system for real-time deployment on constrained IoT hardware like the NodeMCU, a key advancement over pure academic approaches. Finally, we establish technical depth and statistical rigor through a comprehensive hyperparameter configuration, detailed per-class metrics (precision, recall, F1), and a rigorous comparative analysis against Random Forest baseline, conclusively demonstrating the superiority of our method.

The development of a deployable, real-time dataset, and cost-effective Wi-Fi anomaly detection system utilizing NodeMCU and OLED visualization. A hybrid artificial intelligence framework that integrates deep sequential models with logistic regression to enhance interpretability and classification performance.

Demonstrated an accuracy rate exceeding 96% in detecting multi-level deauthentication attacks across diverse network conditions. 2. System Architecture & Core Working Principles The paper maintains a coherent flow in its presentation of the system development and assessment of the proposed system.

The section " Related work " discusses related work in Wi-Fi security, anomaly detection, and hybrid deep learning approaches, noting the gaps this research aims to address. The section " Methodology " shows the methodology, including data collection using the NodeMCU, feature extraction, and the construction of hybrid models based on LSTM, GRU, RNN, and LR. The section " Results and discussion " presents experimental results, comparing the models’ performance using all evaluation metrics. The section " Conclusion " concludes the paper with a discussion of the main findings and practical issues, and future research, including hardware upgrades, larger datasets, and more sophisticated modeling techniques to enhance real-time responsiveness.

Machine learning has emerged as a promising solution for resolving security attacks in Wi-Fi networks, specifically for the detection of complex and dynamic attacks. Deep learning algorithms such as Long Short-Term Memory (LSTM) networks are widely adopted for their ability to capture nonlinear, time-varying patterns in sequential data. For instance, the work of 6 introduces a number of LSTM enhancements, including optimized cell states and convolutional variants, that facilitate improved performance on sequential and multidimensional data tasks. The applicability of LSTM goes beyond fields such as sentiment analysis, denial-of-service (DoS) attack detection, and malware classification 7 .

Simplified Gated Recurrent Unit (GRU) variants such as GRU1 and GRU2, explored in 8 , offer a lightweight alternative to LSTM while maintaining performance on tasks like digit recognition and natural language processing. In 9 , GRU is compared directly to LSTM using the Yelp review dataset, showing that GRU performs faster and maintains comparable accuracy, making it well-suited for real-time edge scenarios 10 . identifies various optimization techniques to train Recurrent Neural Networks (RNNs), e.g., pseudo-Newton methods as well as targeted initialization approaches, testing their efficacy on speech recognition and video captioning tasks.

Logistic Regression (LR) remains an underlying classification method, particularly where interpretability is crucial. The study in 11 discusses its application in imbalanced datasets and highlights improvements such as prior correction and weighting, making it well-suited for binary classification problems in network traffic analysis. In a related domain 12 , surveys ML-based Wi-Fi indoor localization systems using RSSI fingerprinting, exploring preprocessing techniques and architectures like Random Forests, CNNs, and RNNs.

Supervised classification also plays a central role in intrusion detection. A broad review in 13 compares logic-based, instance-based, Bayesian, and ensemble learning methods, stressing that no single classifier dominates across all scenarios. The value of ensemble learning and careful data preparation is emphasized. Additionally 14 , explores wireless device classification based on environmental context (indoor vs. outdoor) using RF signals. Ensemble models, particularly Random Forest, achieve high classification performance, aided by robust signal preprocessing.

Studies comparing LSTM and GRU continue to show practical trade-offs in performance and efficiency. The study in 15 investigates feedforward neural networks for RSSI modeling, identifying that training configurations like ReLU activation and Adam optimizer lead to better positioning accuracy. RNNs further benefit from architectural innovation and optimized training methods 16 .

The review in 17 underscores the importance of tuning supervised ML algorithms for effective classification and advises a hybrid strategy for tackling high-dimensional or heterogeneous datasets. Similarly 18 , examines ML-driven indoor positioning, emphasizing the limitations of GPS indoors and the promise of ML-enhanced localization techniques using RSSI, TOA, and POA.

The integration of ML into intrusion detection is further supported by 19 , where multiple classifiers including SVM and Naive Bayes are evaluated for detecting Deauthentication DoS attacks with high accuracy. In practical deployments, ensemble algorithms like Random Forest and XGBoost consistently perform well in both classification and regression tasks 20 , 21 . XGBoost, in particular, outperforms traditional Random Forest by leveraging gradient boosting and efficient parallelization 22 .

Recent deep-learning NIDS research combines a sequential DNN with Extra-Trees feature selection on UNSW-NB15, reporting ≈ 97.9% binary accuracy while noting future work on multiclass detection and leaving real-time inference characteristics largely unspecified 23 . Beyond IDS, XGBoost has been used for telecom forecasting and traffic prediction 24 and shown strong classification results for encrypted and peer-to-peer flows 25 . Indoor localization in non-line-of-sight (NLOS) conditions is tackled in 26 , which compares RF and XGBoost, finding both effective but XGBoost slightly superior. Random Forests continue to be favored for their ease of tuning, robustness to overfitting, and adaptability across domains 27 , 28 , 29 .

Adaptive Random Forest (ARF), an enhancement of the traditional RF, is introduced in 30 , where tree performance is dynamically weighted, improving classification and regression accuracy in streaming and dynamic environments. Meanwhile, Support Vector Machines are explored in 31 for face recognition, diagnosis, and network modeling due to their strong generalization capabilities rooted in statistical learning theory.

Advanced SVM use is demonstrated in 32 , where decision-making in hybrid LiFi–WiFi networks is optimized using neighboring channel conditions. SVMs also support Wi-Fi traffic prediction in 33 , where they outperform traditional forecasting models using error metrics like MSE and NMSE. Simpler yet effective approaches like kNN are reviewed in 34 , with extensions to classification and regression tasks, especially when input data is poorly structured.

KNN-based localization techniques remain highly relevant. The study in 35 refines KNN for indoor positioning using optimized fingerprinting strategies, while 36 introduces a weighted KNN variant that balances RSS similarity and spatial distance to enhance precision. Deep Neighborhood Learning (DNL) in 37 builds on this by modeling RSS fingerprints as graphs, using graph neural networks to capture contextual relationships between access points and signal patterns.

Traditional classifiers still hold ground in anomaly detection and throughput modeling. In 38 , various ML methods are applied to wireless data for classification and optimization. These include decision trees, kNN, and boosting methods for robust and fast detection of anomalies. Foundational techniques like linear regression and Random Forest are compared in 39 for their ability to model relationships between signal metrics and throughput.

The study in 41 explores kNN-based classification in noisy environments, identifying variants that improve robustness and generalization. Similarly 42 , applies ML techniques to uncover relationships in Wi-Fi datasets. Random Forest outperforms linear regression in predicting round-trip time (RTT), revealing it as a key predictor of Wi-Fi throughput. Complementing these findings, a lightweight IDS that uses simple statistics-based feature selection with classical ML (e.g., LR, SVM, RF) achieves competitive accuracy on IoTID20 and ≈ 99%+ on NSL-KDD while reducing computation time, highlighting the suitability of compact models for edge devices 43 .

While the literature presents a broad range of machine learning models and techniques for Wi-Fi security, most existing approaches either emphasize high-performance, cloud-based solutions or overlook the importance of deployment in real-time, low-cost edge environments. Few works address the trade-off between accuracy and interpretability, which is critical in embedded systems and IoT applications. The present study addresses this gap by introducing a lightweight, deployable Wi-Fi monitoring framework that integrates deep temporal learning with explainable models. Leveraging NodeMCU-based packet sniffing, OLED-based real-time visualization, and hybrid architectures combining LSTM, GRU, and RNN with Logistic Regression, this work offers a scalable and interpretable solution tailored for edge-level Wi-Fi anomaly detection.

Table 1 summarizes our proposed work and other works, including methodologies, objectives, dataset, and results of various machine learning models. It shows LSTM and GRU’s ability in handling sequential data, where GRU is faster and LSTM is superior in accuracy. GRU variants are shown to reduce complexity while maintaining comparable results. The table also reviews other algorithms, such as SVM, Random Forest, and XGBoost, noting their strengths in classification tasks and applications ranging from speech recognition to Wi-Fi traffic prediction. The proposed work builds on these studies by using AI to assess Wi-Fi performance and identify network threats in real time.

This section shows the comprehensive process involved in the development of a real-time Wi-Fi anomaly detection system utilizing the NodeMCU ESP8266 microcontroller. As depicted in Fig. 1 , the process encompasses hardware configuration, software integration, real-time monitoring, hybrid model classification, and performance assessment. The process commences with the installation of the NodeMCU in conjunction with the Arduino IDE and requisite libraries, such as ESP8266WiFi and Adafruit SSD1306. The NodeMCU has been successfully interfaced via Micro-USB, and custom firmware has been programmed to enable Wi-Fi packet sniffing and the generation of deauthentication packets, in conjunction with the Adafruit GFX library. When turned on, the microcontroller performs sweeps of nearby networks and records data such as SSID, channel, RSSI, SNR, noise, and the count of deauthentication packets. All data that is gathered is displayed in real-time through an OLED display with an I2C interface.

Key functional modules include monitoring packet data transmission, assessing signal quality and noise, channel probing, and displaying suspicious traffic. The minimalist setup facilitates real-time monitoring in resource-constrained environments without necessitating extensive infrastructure. For anomaly detection purposes, the collected data is transmitted to a set of hybrid machine learning models: LSTM_LR, GRU_LR, and RNN_LR. These models blend the temporal learning capability of deep neural networks (LSTM, GRU, RNN) with the efficiency and interpretability of Logistic Regression (LR). Specifically, LSTM is employed to capture long-term dependencies, GRU provides a lighter variant with comparable accuracy, and RNN serves as the temporal baseline. Logistic Regression is the decision layer for efficiency and interpretability improvements.

This hybrid architecture augments anomaly detection by combining temporal observations with explicit classification rules, rendering it well-suited for detecting attack patterns such as bursts of de-authentication packets or declines in signal quality. To mitigate the inherent challenge of class imbalance within the dataset, a two-pronged strategy was employed. First, class weighting was implemented for all traditional machine learning models; specifically, the class_weight=’balanced’ parameter was used to adjust the influence of each sample during training inversely proportional to its class frequency. Second, stratified sampling was applied throughout the experimental pipeline to approve that the original class distribution was preserved in all training and testing subsets.

The overall workflow of the proposed Wi-Fi monitoring framework is illustrated in Fig. 2 . The procedure has six successive steps that all contribute to the conversion of raw network traffic to actionable intelligence using hybrid machine learning models: Packet Sniffing: The process starts by installing the NodeMCU (ESP8266) microcontroller, flashing it with Wi-Fi packet sniffing-supported firmware. The device is connected to a laptop to begin capturing live traffic from nearby wireless networks.

Data Monitoring: Received Packets are graphed live on an OLED screen via I2C. Key signals such as RSSI, SNR, Wi-Fi channel, and deauthentication packet count are plotted, allowing out-of-pattern activity or interference to be identified simultaneously. Data Saving: To support long-term analysis, the data recorded is stored in structured formats such as Excel or CSV.

CoolTerm-like applications are used to interact with the NodeMCU and download the traffic logs for offline analysis and model training. Data Filtering and Analysis: In this stage, the key features are selected from the dataset to evaluate network performance and detect security threats. Performance metrics like deauthentication packet frequency and SNR trends are used to identify potential intrusions. In this study, a total of 5,653 samples from the dataset were prepared for model evaluation.

Data Cleaning: Data cleaning is performed before training to remove inconsistencies, outliers, and unwanted noise from the data. This improves model accuracy and provides good feature representation for machine learning analysis. Applying Hybrid AI Models: Finally, hybrid models combining deep learning and traditional classification are applied to the cleaned dataset. Especially, three architectures LSTM_LR, GRU_LR, and RNN_LR are used. The deep learning modules (LSTM, GRU, RNN) can easily capture time-dependent patterns in sequential network data, and Logistic Regression is used as a light decision layer to enhance interpretability and classification accuracy. These models collectively enable accurate anomaly detection and behavioral classification in real-time Wi-Fi environments.

Packet sniffing is accomplished with the NodeMCU (ESP8266) microcontroller used in promiscuous mode that enables the device to capture all Wi-Fi packets that are broadcast on a selected channel irrespective of the source or destination. This gives the NodeMCU the capability to operate as a passive listener in the 2.4 GHz frequency range that supports up to 13 channels depending on where it is located.

The process begins with selecting a target channel via sequential scanning or plugging the device into a specific one for targeted monitoring. When activated, the NodeMCU takes snapshots of a number of 802.11 frame types such as management frames (e.g., beacon, probe), control frames (e.g., ACK, RTS/CTS), and data frames carrying payload traffic. This raw traffic data contains useful information about the topology and activity of nearby networks and is the basis for subsequent feature extraction and anomaly detection.

In addition to enabling real-time network awareness, the NodeMCU platform features an OLED screen that displays a set of parameters indicative of performance and security status. Parameters that include real-time bar graph depiction of network traffic, the current operating channel of Wi-Fi, the number of packets sent, and the DA packet detection rate are all included. It also provides important wireless parameters such as the Service Set Identifier (SSID), Received Signal Strength Indicator (RSSI), noise level in the environment, and Signal-to-Noise Ratio (SNR). All these parameters together allow users to monitor link quality continuously, detect abnormal fluctuations, and detect likely security attacks with low latency.

Figure 3 shows the practical setup used during the data collection phase of the proposed work. ESP8266 NodeMCU serial output is displayed in real time by using the Arduino IDE Serial Monitor. For offline analysis and persisting data, the CoolTerm terminal software was used to capture the serial output and save it in a CSV file. This method enabled the seamless logging of key network metrics, ensuring consistency across the more than 5,600 collected samples. The image also showcases both the coding environment used for firmware development and the OLED display output, effectively illustrating the integration between software implementation and hardware-level data visualization. Data Specifications.

Figures 4 and 5 show real-time visualizations of network activity via an OLED display mounted on the NodeMCU. The interface features a dynamic bar graph that plots packet density over time, providing key statistics such as the Wi-Fi channel, number of packets sensed, Received Signal Strength Indicator (RSSI), noise reading, and Deauthentication (DA) packet count.

Received Signal Strength Indication, or RSSI, is the power received in decibels relative to a milliwatt (dBm) and needs to be employed to estimate proximity of the device and signal quality. Signal-to-Noise Ratio (SNR) can be computed as: An increased SNR means stronger and more stable communication, which has a direct relation to data throughput and connection stability.

3. Software Implementation, Frameworks & Protocols It also monitors the Wi-Fi channel (1–13 within the 2.4 GHz band) and aggregate packet traffic, providing a general idea of the activity underway. Of special concern is the count of deauthentication packets (DA), which are early warning indicators of potential denial-of-service (DoS) attacks. For instance, Fig. 5 shows DA = 205, indicating a potential high-level threat.

To contextualize these values, Table 2 outlines a classification scheme for DA activity, mapping the rate of deauthentication packets to corresponding security threat levels. This classification aids both in feature labeling for supervised learning and in the real-time identification of network anomalies. In addition to DA thresholds, RSSI ranges were also integrated to provide a more robust classification of threat levels. The classification thresholds for deauthentication (DA) packet rates and RSSI values in Table 2 were determined through a combination of empirical analysis and established wireless security principles. A dataset of over 5600 network parameter entries was collected from controlled experiments simulating both normal Wi-Fi operation and varying intensities of deauthentication attacks. Statistical analysis of DA packet rate distributions under benign and attack conditions revealed distinct separation ranges. For example, normal network activity rarely exceeded 40 packets/sec, low-intensity attacks typically ranged from 40 to 80 packets/sec, and sustained high-volume attacks produced rates well above 150 packets/sec. In addition to DA frequency, we also considered the duration of device disconnection as a key factor in classification: normal scenarios were associated with 0–1 s of disconnection, low-volume attacks typically resulted in 1–20 s, moderate attacks in 20–60 s, and high-volume attacks in disconnections exceeding 60 s. This dual-criterion approach (packets/sec and disconnection time) ensured that thresholds aligned not only with packet-level anomalies but also with the real impact on connectivity. This procedure is compatible with prior work demonstrating that DA frequency is an effective indicator for classifying attack severity and that thresholds should be empirically tuned to the deployment environment 44 . Similarly, RSSI thresholds were informed by widely accepted Wi-Fi performance categorizations, where RSSI ≥ − 50 dBm indicates strong connectivity, RSSI < − 60 dBm represents moderate to weak connectivity, and RSSI < − 70 dBm is associated with poor or unstable links 45 . The final ranges presented in Table 2 reflect both the observed behavior in our dataset and the recommendations from relevant literature. A custom code function was developed to dynamically link RSSI values to their corresponding DA packet rates, allowing for real-time multi-parameter threat classification. This dual-condition scheme enhances the system’s ability to detect and respond to network anomalies in dynamic wireless environments while remaining lightweight and interpretable for embedded deployment.

Hybrid machine learning models combine deep learning with traditional classifiers to provide more precise, efficient, and interpretable predictions. Three hybrids were used in the study: LSTM_LR, GRU_LR, and RNN_LR. Deep learning components (LSTM, GRU, and RNN) can learn efficient temporal patterns in Wi-Fi traffic, while Logistic Regression (LR) simplifies the last-stage classification and enables model interpretability.

This design leverages the benefits of sequential data modeling and lightweight decision-making, making it appropriately suited for real-time anomaly detection on resource-constrained devices. After the dataset was extracted via NodeMCU and cool term, the cleaning, preprocessing and the running of the ML models were all done on a Dell Precision system equipped with an Intel Core i7 processor (2.9 GHz), 16 GB of RAM, and an NVIDIA Quadro M1200 graphics unit with 4 GB of dedicated memory. The following subsection explains every model.

The LSTM_LR model combines Long Short-Term Memory (LSTM) networks and Logistic Regression (LR) to leverage the temporal learning capabilities of deep models with the interpretability of linear classifiers 40 . LSTM is particularly well-suited to learn sequences, and thus would be employed to capture time-based Wi-Fi traffic patterns. Instead of a dense neural output layer, the final state of the LSTM is passed directly to a logistic regression component. This design improves computational efficiency and readability, enabling real-time deployment on low-resource devices.

As shown in Fig. 6 , the design consists of LR classifiers and stacked LSTM layers. The model produces standard evaluation metrics like F1-score, precision, and recall. Training is performed using a binary cross-entropy loss function. \(\:{h}_{T}^{\left(i\right)}\) : Final hidden state from the LSTM for the \(\:{i}^{th}\) input. The GRU_LR hybrid model combines Gated Recurrent Units (GRUs) with Logistic Regression (LR) to strike a balance between temporal pattern recognition and interpretability. GRUs, which are recurrent neural networks, are best suited for pulling sequential patterns from time-series data and offering a computationally less expensive alternative to LSTMs. The final hidden state output of the GRU is passed to a logistic regression layer after training for classification 46 .

This approach enhances performance in tasks such as anomaly detection and time-based classification while keeping the decision process explainable and straightforward. The model is optimized using a binary cross-entropy loss function: By combining the GRU’s sequential modeling strengths with LR’s simplicity, this hybrid architecture delivers a strong, interpretable solution suitable for real-time network threat detection.

RNN_LR hybrid model integrates Recurrent Neural Networks (RNNs) and Logistic Regression (LR) to leverage the strengths of sequential learning and explainable classification. RNNs are particularly well-suited for capturing temporal relationships in sequential data, such as network traffic over a specific period. The final hidden state of the RNN, used as input to a logistic regression layer, is employed to produce a classification choice based on learned patterns.

This type of architecture proves helpful when both model explainability and temporal context are crucial, such as in network intrusion detection, where understandable alarms are needed. \(\:{\widehat{y}}_{i}\) : Predicted probability for the \(\:{i}^{th}\) sample output from the logistic regression layer. By pairing RNN with LR, this hybrid model offers a lightweight and interpretable structure while still effectively capturing sequential trends for accurate classification.

To assess the performance of each hybrid model, we utilized standard evaluation metrics, as detailed below. Accuracy in machine learning measures the proportion of correctly classified instances among the total instances. It is a key performance metric, especially for balanced datasets, but may be misleading in imbalanced scenarios, where precision, recall, and F1-score provide a more comprehensive evaluation of performance.

The key evaluation metric for classification models is recall, especially when false negatives are more critical than false positives. It is defined as the proportion of actual positive cases that the model correctly identifies. Precision in machine learning quantifies the proportion of true positive predictions among all positive predictions made by the model. It is crucial in scenarios where false positives carry significant consequences, ensuring that positive classifications are reliable and minimizing incorrect identifications.

The F1 score is defined as the harmonic means of precision and recall providing a single number that balances both. F1 Score is more useful in the case of imbalanced datasets than AUC-ROC, where one class is heavily dominant than the other. It is useful when both false positives (FP) and false negative (FN) are important as it gives equal weight to precision and recall.

The Receiver Operating Characteristic (ROC) curve is a way to visualize the accuracy of a binary classifier. It is a plot of the True Positive Rate (TPR) against the False Positive Rate (FPR) at different thresholds. Table 3 provides a systematic breakdown of all configurable parameters found in the provided hybrid machine learning models for a classification task.

This sub-section illustrates the performance evaluation of the suggested hybrid models by key metrics: accuracy, precision, recall, and F1-score. The metrics reveal each model’s ability to generalize from unseen data, handle class imbalances, and minimize false predictions. The results also reflect the impact of model selection, hyperparameter tuning, and preprocessing. Detailed numerical results and comparative remarks are presented in the following subsections to compare the advantages and disadvantages of each approach and determine the top-performing model for real-time Wi-Fi attack detection.

Figure 7 shows the confusion matrices of the LSTM_LR, GRU_LR, and RNN_LR models on the four-class classification problem. All three models show great performance on identifying the most dominant class (Class 3), with LSTM_LR correctly classifying 3,850 instances, GRU_LR with 3,853, and RNN_LR being slightly lower at 3,824. The LSTM_LR also performs better on Class 1 (609) and Class 2 (363) owing to its ability to identify long-term dependencies through memory gating mechanisms.

GRU_LR, as lighter in architecture, matches or beats LSTM_LR in Class 1 (613) and Class 2 (368), making it a great option in low complexity and efficiency environments. RNN_LR, despite having promising results in Class 1 (620), lags behind somewhat with Class 0 (506) and Class 2 (348), likely due to the fact that it contains no gating units, which limits its ability to effectively model long-range patterns.

Overall, LSTM_LR and GRU_LR are better than RNN_LR in precision and stability, with stronger classification ability between imbalanced or confusing classes. Figure 8 shows Receiver Operating Characteristic (ROC) curves for LSTM_LR, GRU_LR, and RNN_LR models for a four-class problem. All three models are well discriminative with 1.00 Area Under the Curve (AUC) for classes 0 and 1, and 0.99 for classes 2 and 3.This near-ideal performance indicates high sensitivity and specificity with minimal trade-off among true positive and false positive rates.

The LSTM_LR and GRU_LR models have very similar ROC curves, confirming their effectiveness in learning temporal patterns for multi-class classification. The RNN_LR model, while less sharp in curve gradient, still achieves comparable AUC values, proving its dependability even without gated memory units. These consistently high AUC values from all models confirm the performance of the hybrid deep-learning classifiers and prove them suitable for real-time, multi-class Wi-Fi threat detection.

Figure 9 shows the precision, recall, and F1-scores for each class in the three hybrid models: LSTM_LR, GRU_LR, and RNN_LR. The performance of all the models is good, but there are minor variations in class-wise performance. LSTM_LR performs best in classes 0 and 3, but with slightly reduced recall in class 2. GRU_LR performs most consistently across all classes and measures, with class 0 having almost perfect precision. This implies its parsimony combined with generalization ability. Conversely, RNN_LR, although slightly behind class 2 recall, maintains consistent scores for all classes, reflecting a steady, if less specialized, classification ability. Overall, LSTM_LR and GRU_LR perform more strongly, with GRU_LR offering a good accuracy vs. efficiency balance.

Figure 10 illustrates the F1-score performance of classes 0 to 3 for the three hybrid models, LSTM_LR, GRU_LR, and RNN_LR. All three models exhibit excellent performance, with all F1-scores above 0.85 for all classes. The highest scores are achieved by classes 0 and 3, where LSTM_LR and GRU_LR marginally outperform RNN_LR, indicating better classification performance for these classes. Whereas Class 2 sees a modest decline in performance for all models, GRU_LR performs the worst in terms of F1-score for the class. LSTM_LR and GRU_LR are both highly comparable trends by class, demonstrating the reliability and strength of the two. Both LSTM_LR and GRU_LR are generally more precise and consistent, and it is important to explain why they work as the model for the multiclass classification task versus the basic RNN_LR model.

Figure 11 is a heatmap representing the error correlation between hybrid models LSTM_LR, GRU_LR, and RNN_LR. It is expected that each model will have a perfect self-correlation along the diagonal (value = 1). Among the model pairs, LSTM_LR and GRU_LR have the most significant error correlation (0.67), indicating that they learn very similar temporal behaviors. RNN_LR has lower correlation with LSTM_LR (0.60) and GRU_LR (0.61), indicating more distinct error distributions. They indicate possible complementarity between models, a consideration that is pertinent to ensemble learning or more sophisticated hybrid methods for improved robustness and generalization.

Table 4 summarizes a comparison of precision, recall, F1-score, and overall accuracy for the hybrid models LSTM_LR, GRU_LR, and RNN_LR on a four-class classification task. Both LSTM_LR and GRU_LR achieved the highest accuracy (96%) with stable and uniform performance for all but one class. LSTM_LR maintained a balanced precision and recall, with its peak achieved for Class 3 (F1-score: 0.97). GRU_LR was also, albeit slightly more accurate for Class 0 (0.99), and similarly resilient overall, as LSTM_LR. RNN_LR, while equally effective at 95% accuracy, was slightly less accurate for Class 2 and Class 1. The results highlight the improved generalizability and reliability of LSTM_LR and GRU_LR, particularly for more complex or ambiguous class boundaries. We also ran an additional analysis of the RF model using AUC scores, which ranged between 0.84 and 0.95. These values show that the model can rank instances reasonably well, but it struggles to turn that ranking into accurate final predictions. This weakness is clear in its low precision, recall, and F1-scores as shown in Table 4 . In contrast, our hybrid model not only separates classes effectively but also delivers consistent and reliable classification results.

This work explored a real-time Wi-Fi intrusion detection system using hybrid deep learning models deployed on low-cost edge devices. By combining sequential models, such as LSTM, GRU, and RNN, with logistic regression, we aimed to create a lightweight, interpretable, and accurate classification pipeline that utilizes live network features, including RSSI, SNR, packet counts, and deauthentication activity. Across all experiments, the GRU_LR model emerged as the top performer, achieving 96% accuracy and excelling particularly in harder-to-classify categories, such as Class 2. LSTM_LR followed closely with strong long-term pattern recognition, while RNN_LR performed adequately but lagged slightly in recall for minority classes.

Confusion matrices, ROC curves, and F1-score charts all indicated that the hybrid GRU and LSTM models were top performers. The system also included real-time OLED visualization for live traffic feedback and worked entirely on the NodeMCU platform, proving both affordable and effective in edge settings. That said, the system does have its limitations. For one, it relies heavily on RSSI and SNR for interpreting network behavior, both of which are sensitive to walls, interference, and physical movement. These factors could throw off detection accuracy in busier or less controlled environments. Plus, the models were trained in a fixed context, and while they performed well there, they may require retraining to remain effective in larger, more complex networks. While our system demonstrates reliable performance in controlled single-floor scenarios, its effectiveness in multi-floor, high-density access point (AP) environments would be considerably reduced. This limitation is primarily because of the restricted coverage and sensitivity of the onboard microstrip antenna of the NodeMCU. In such situation, signal attenuation through floors and the interference generated by overlapping APs would significantly hinder the ability of a single device to capture and classify deauthentication packets accurately. To address this, a distributed deployment strategy would be required, involving multiple NodeMCU units strategically positioned across floors to ensure adequate spatial coverage and reliable detection.

While the system does not capture packet contents, it still monitors device behavior, which raises ethical considerations. It is meant as a security tool for authorized admins, not a surveillance mechanism. Any use in the real world must be declared openly, with permission having been granted, as is obvious. Users must be informed, and measures are taken to limit misuse. In the future, improving its privacy features would help to make it beneficial without violating any ethical limits.

In summary, the integration of deep temporal modeling and lightweight classification within a compact embedded platform highlights the feasibility of deploying advanced security frameworks for wireless networks. Compared with state-of-the-art lightweight IDS systems for embedded platforms, which typically report detection accuracy in the 85–92% range, our system achieves improved performance (96%) while maintaining real-time inference and low-resource utilization. These results underline the novelty of combining temporal sequence modeling with logistic regression on an edge device and demonstrate that hybrid model architectures can provide both efficiency and enhanced detection accuracy for real-world IoT environments.

With this promising result, subsequent research can overcome much of the most significant limitations found in development and deployment. One of the problems was the OLED display’s low memory, which caused bugs in attempting to include additional features. This restricted real-time visualization of key network metrics and excluded more complex indicators from integration. Moreover, NodeMCU’s lower RAM was a major constraint, as it was not possible to offload even a single parameter to third-party cloud services such as Firebase. This restricted the ability of the system to log data remotely or to perform off-device computations, which are critical for large-scale deployment and continuous monitoring. The other problem that was noticed was the weak reception of the signal, which impacted trilateration and RSSI-based attack detection adversely; it suggests the incorporation of signal amplification techniques or using external antennae.

4. Practical Deployment, Analysis & Case Studies Future work can expand on this work by integrating (RSSI) into trilateration-based localization frameworks. While RSSI in this paper was applied chiefly to signal quality evaluation and anomaly detection, its potential for precise spatial localization remains widely untapped. Trilateration, which computes a device’s position from distances to several access points, stands to drastically improve wireless localization precision when combined with RSSI fingerprinting. Since precise trilateration would necessitate several access points deployed across the environment, a single source would be insufficient. Combined in our system, trilateration could render the system far more powerful by enabling precise threat localization, increasing the granularity of anomaly detection, and improving overall system robustness to real-world deployments. Problems inherent to multipath fading, interference, and limited hardware capabilities of low-power devices, however, remain considerable obstacles. Incorporating trilateration in future research phases will not only provide more accurate positioning but also facilitate innovative real-time security monitoring and context-aware IoT services.

To further these horizons and allow the system to operate even more efficiently, the inclusion of state-of-the-art next-generation transformer-based models such as DeBERTa or ELECTRA would be an option. These would allow for greater contextual understanding and classification precision, especially with difficult or dynamic traffic conditions. Even more powerful edge-computing platforms such as the Raspberry Pi 4 Power Edition, coupled with state-of-the-art network analyzers, would also make better real-time signal processing and harvesting possible and further increase the accuracy of localization and detection.

It will also be necessary to scale up the diversity and size of the dataset to capture the strength and extensibility of the hybrid models across varying network settings and attack patterns. Probing model compression techniques (knowledge distillation, parameter sharing, and neural architecture search) will also facilitate efficient deployment on resource-limited devices without impairment. Use of ensemble methods’ predictions, which aggregate predictions from numerous transformer-based models, can support more robust classification certainty, especially for minority class labels. Finally, with domain-adaptive fine-tuning along with continuous learning paradigms, the detection system would be able to maintain high accuracy even in dynamic systems with changing network patterns over time.

The datasets analyzed during the current study are available from the corresponding author on reasonable request. Rappaport, T. S. Wireless Communications: Principles and Practice (Prentice Hall PTR, 2002). Kantharaju, V. et al. Machine learning based intrusion detection framework for detecting security attacks in internet of things. Sci. Rep. 14 , 30275. https://doi.org/10.1038/s41598-024-81535-3 (2024).

Chen, & Chang,. Machine Learning for Cyber Security 1st edn. (Springer International Publishing, 2019). https://doi.org/10.1007/978-3-030-30619-9 . Wright, J. & Cache, J. Hacking Exposed Wireless: Wireless Security Secrets & Solutions 3rd edn (McGraw-Hill Education Group, 2015).

Lindemann, B., Müller, T., Vietz, H., Jazdi, N. & Weyrich, M. A survey on long short-term memory networks for time series Van Houdt, G., Mosquera, C. & Nápoles, G. A review on the long short-term memory model. Artif. Intell. Rev. 53 , 5929–5955. https://doi.org/10.1007/s10462-020-09838-1 (2020). Dey, R. & Salem, F. M. Gate-variants of Gated Recurrent Unit (GRU) neural networks, IEEE 60th International Midwest Symposium on Circuits and Systems , 1597–1600 (MWSCAS, Boston, MA, USA, 2017).

https://doi.org/10.1109/MWSCAS.2017.8053243 Yang, S., Yu, X., & Zhou, Y. LSTM and GRU Neural Network Performance Comparison Study: Taking Yelp Review Dataset as an Example," 2020 International Workshop on Electronic Communication and Artificial Intelligence (IWECAI) , Shanghai, China, 98–101. https://doi.org/10.1109/IWECAI50956.2020.00027 (2020).

Salehinejad, H. et al. Recent advances in recurrent neural networks. https://doi.org/10.48550/arXiv.1801.01078 (2017). Maalouf, M. Logistic regression in data analysis: an overview. Int. J. Data Anal. Techniques Strategies . 3 , 281–299. https://doi.org/10.1504/IJDATS.2011.041335 (2011). Singh, N., Choe, S. & Punmiya, R. Machine learning based indoor localization using Wi-Fi RSSI fingerprints: An overview.

IEEE Access 9 , 127150–127174. https://doi.org/10.1109/ACCESS.2021.3111083 (2021). Kotsiantis, S. B., Zaharakis, I. D. & Pintelas, P. E. Machine learning: a review of classification and combining techniques. Artif. Intell. Rev. 26 , 159–190. https://doi.org/10.1007/s10462-007-9052-3 (2006). Ramamurthy, A., Sathya, V., Rochman, M. I. & Ghosh, M. ML-Based Classification of Device Environment Using Wi-Fi and Cellular Signal Measurements. IEEE Access 10 , 29461–29472. https://doi.org/10.1109/ACCESS.2022.3158056 (2022).

Bogdandy, B. & Toth, Z. Analysis of Training Parameters of Feed Forward Neural Networks for WiFi RSSI Modeling. In: 2019 IEEE 15th International Scientific Conference on Informatics, Poprad, Slovakia , 000273–000278.

https://doi.org/10.1109/Informatics47936.2019.9119313 (2019). Chaudhry, A. U. & Roshdy Hafez, H. M. On Finding Hidden Relationship among Variables in WiFi using Machine Learning. In: 2020 International Conference on Computing, Networking and Communications (ICNC), Big Island, HI, USA , 157–161. https://doi.org/10.1109/ICNC47757.2020.9049741 (2020).

Akinsola, J. E. T. Supervised machine learning algorithms: classification and comparison. Int. J. Comput. Trends Technol. (IJCTT) 48 , 128–138. https://doi.org/10.14445/22312803/IJCTT-V48P126 (2017). Rathnayake, R. M. M. R., Maduranga, M. W. P., Tilwari, V. & Dissanayake, M. B. RSSI and machine Learning-Based indoor localization systems for smart cities. Eng 4 , 1468–1494. https://doi.org/10.3390/eng4020085 (2023).

Agarwal, M., Biswas, S., Nandi, S. & Kong, H. Detection of De-Authentication DoS Attacks in Wi-Fi Networks: A Machine Learning Approach. In: 2015 IEEE International Conference on Systems, Man, and Cybernetics, China , 246–251. https://doi.org/10.1109/SMC.2015.55 (2015). Fatima, S., Hussain, A., Amir, S., Ahmed, S. H., Aslam, S. & & & & XGBoost and random forest algorithms: an In-Depth analysis. Pak. J. Sci. Res. 3 , 26–31. https://doi.org/10.57041/pjosr.v3i1.946 (2023).

Chen, T. XGBoost: A Scalable Tree Boosting System. https://doi.org/10.48550/arXiv.1603.02754 (2016). Bentéjac, C., CsörgI, A.

& Martínez-Muñoz, G. A comparative analysis of XGBoost.

https://doi.org/10.48550/arXiv.1911.01914 (2019). Farhan, M. et al. Network-based intrusion detection using deep learning technique. Sci. Rep. 15 , 25550. https://doi.org/10.1038/s41598-025-08770-0 (2025). Jain, G. & Prasad, R. R. Machine learning, Prophet and XGBoost algorithm: Analysis of Traffic Forecasting in Telecom Networks with time series data. In: 2020 8th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO), Noida, India , 893–897. https://doi.org/10.1109/ICRITO48877.2020.9197864 (2020).

Cherif, I. L. & Kortebi, A. On using eXtreme Gradient Boosting (XGBoost) Machine Learning algorithm for Home Network Traffic Classification, 2019 Wireless Days (WD), Manchester, UK, 1–6. https://doi.org/10.1109/WD.2019.8734193 (2019) Niang, M. et al. Comparison of Random Forest and Extreme Gradient Boosting Fingerprints to Enhance an indoor Wifi Localization System.

In 2021 International Mobile, Intelligent, and (MIUCC) , Cairo, Egypt, 143–148.

https://doi.org/10.1109/MIUCC52538.2021.9447676 (2021). Cutler, A., Cutler, D. & Stevens, J. Random Forests. https://doi.org/10.1007/978-1-4419-9326-7_5 (2011). Biau, G. Analysis of a Random Forests Model. J. Mach. Learn. Res. https://doi.org/10.48550/arXiv.1005.0208 (2012). He, L. et al. Random Forest as a Predictive Analytics Alternative to Regression in Institutional Research. Practical Assessment, Research & Evaluation, A peer-reviewed electronic journal (2018).

Mohapatra, N., Shreya, K. & Chinmay, A. Optimization of the random forest algorithm. In Advances in Data Science and Evgeniou, T. & Pontil, M.

Support Vector Machines: Theory and Applications, 2049.

249–257. https://doi.org/10.1007/3-540-44673-7_12 (2001). Ji, K., Mao, T., Chen, J., Dong, Y. & Wang, Z. SVM-Based Network Access Type Decision in Hybrid LiFi and WiFi Networks. In 2019 IEEE 90th Vehicular Technology Conference (VTC2019-Fall) , Honolulu, HI, USA, 1–5.

https://doi.org/10.1109/VTCFall.2019.8891341 (2019). Feng, H., Shu, Y., Wang, S. & Ma, M. SVM-Based Models for Predicting WLAN Traffic. In 2006 IEEE International Conference on Communications, Istanbul, Turkey, 597–602. https://doi.org/10.1109/ICC.2006.254860 (2006). 5. Performance Evaluation & Extended Technical Observations Taunk, K., De, S., Verma, S. & Swetapadma, A. A brief review of nearest neighbor algorithm for learning and classification, 1255–1260. https://doi.org/10.1109/ICCS45141.2019.9065747 (2019).

Ge, X., Qu, Z. & Science, S. 7th IEEE International Conference on Software Engineering and Optimization WIFI indoor positioning KNN algorithm location-based fingerprint, (ICSESS) , Beijing, China, 2016, 135–137.

https://doi.org/10.1109/ICSESS.2016.7883033 (2016). Wang, B. et al. A novel weighted KNN algorithm based on RSS similarity and position distance for Wi-Fi fingerprint positioning. IEEE Access 8 , 30591–30602. https://doi.org/10.1109/ACCESS.2020.2973212 (2020). Dong, Y., Zampella, F., Alsehly, F. & Beyond, K. N. N. Deep Neighborhood Learning for WiFi-based Indoor Positioning Systems. In 2023 IEEE Wireless Communications and Networking Conference (WCNC), Glasgow, United Kingdom, 1–6.

https://doi.org/10.1109/WCNC55385.2023.10118752 (2023). Moharam, M. H. et al. Anomaly detection using machine learning and adopted digital twin concepts in radio environments. Sci. Rep. 15 , 18352. https://doi.org/10.1038/s41598-025-02759-5 (2025). Hussien, M. Enhancing network security with a deep Learning-Based intrusion detection system for 5G networks. RS Open. J.

Innovative Commun. Technol. 4 (9). https://doi.org/10.46470/03d8ffbd.bddb240c (2023). Mohamed, H. M. & Wafik, A. W. Deep learning integration in PAPR reduction in 5G filter bank multicarrier systems. Iran. J. Electr. Electron. Eng. https://doi.org/10.22068/IJEEE.20.4.3459 (2024). Salem, D., Ahmed, M. H., Esraa Mamdouh, H. & Moharam & Development of machine learning regression models for predicting the performance of nanofibrous scaffolds for skin tissue engineering. J. Bio-X Res. 7 , 0008.

https://doi.org/10.34133/jbioxresearch.0008 (2024). Saaid, M. E. et al. Advanced wireless earthquake alarm system. In 2024 International Telecommunications Conference (ITC-Egypt) , 128–133. https://doi.org/10.1109/ITC-Egypt61547.2024.10620472 Kaushik, S. et al. Robust machine learning based intrusion detection system using simple statistical techniques in feature selection. Sci. Rep. 15 , 3970. https://doi.org/10.1038/s41598-025-88286-9 (2025).

Milliken, J., Selis, V., Yap, K. M. & Marshall, A. Impact of metric selection on wireless deauthentication DoS attack performance. IEEE Wirel. Commun. Lett. 2 (5), 571–574. https://doi.org/10.1109/WCL.2013.072513.130428 (2013). Ferro, D. & Bill Rink. and. Understanding technology options for deploying Wi-Fi. Tech. Pap Prep Soc. Cable Telecommun Eng. (2014).

Moharam, M. H. Comparative analysis of the performance of regression machine learning models for indoor visible light positioning systems. Discov Appl. Sci. 7 , 933. https://doi.org/10.1007/s42452-025-06519-y (2025). Open access funding provided by The Science, Technology & Innovation Funding Authority (STDF) in cooperation with The Egyptian Knowledge Bank (EKB).

Department of Electronics and Communications Engineering, Misr University for Science and Technology, P.O. Box 23546, Sixth of October, Giza, Egypt Mohamed Hussien Moharam, Kareem Ashraf, Hussien Alaa, Mostafa Ahmed & Hesham A. El-Hakim Conceptualization: Mohamed Hussien Moharam.Data curation: Kareem Ashraf, Hussien Alaa. Formal analysis: Hussien Alaa, Kareem Ashraf.Investigation: Mohamed Hussien Moharam, Hesham A. El HakimMethodology: Mohamed Hussien Moharam, Kareem Ashraf.Project administration: Mohamed Hussien Moharam. Hesham A. El HakimSoftware: Mohamed Hussien Moharam, Hussien Alaa, Mostafa Ahmed.Supervision: Mohamed Hussien Moharam.Validation: Mostafa Ahmed, Kareem Ashraf.Visualization: Mohamed Hussien Moharam.Writing– original draft: Kareem Ashraf, Mohamed Hussien Moharam.Writing– review & editing: Mohamed Hussien Moharam, Hesham A. El Hakim.

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/ .

Moharam, M.H., Ashraf, K., Alaa, H. et al. Real-time detection of Wi-Fi attacks using hybrid deep learning models on NodeMCU. Sci Rep 15 , 32544 (2025). https://doi.org/10.1038/s41598-025-18947-2 Sign up for the Nature Briefing: AI and Robotics newsletter — what matters in AI and robotics research, free to your inbox weekly.

Download Full-Text PDF Cite this Publication Lakshmi Saranya, Reddyvari Venkateswara Reddy, A Basanth Reddy, Bolloju Sai Dinesh, Mohammad Muneeruddin, 2024, Detect wi-fi De-Authentication Attacks Using Esp8266, INTERNATIONAL JOURNAL OF ENGINEERING RESEARCH & TECHNOLOGY (IJERT) Volume 13, Issue 03 (March 2024), Lakshmi Saranya, Reddyvari Venkateswara Reddy, A Basanth Reddy, Bolloju Sai Dinesh, Mohammad Muneeruddin Associate Professor, Department of CSE (Cybersecurity), CMR College of Engineering & Technology, Hyderabad, Telangana, India.

Associate Professor, Department of CSE (Cybersecurity), CMR College of Engineering & Technology, Hyderabad, Telangana, India. Students, Department of CSE (Cybersecurity), CMR College of Engineering & Technology, Hyderabad, Telangana, India. AbstractIn network security, the utilization of an ESP8266 microcontroller unit (MCU) from Espressif Systems emerges as a vigilant guardian against potential threats, specifically de-authentication attacks. These malicious endeavors involve the forceful expulsion of devices from a Wi-Fi network, leading to significant disruptions. The ESP8266, a compact yet powerful Wi-Fi module, can be programmed to diligently monitor the wireless environment for signs of such malevolent activities. The primary function of this MCU node involves continuous scanning of Wi-Fi networks to identify and analyze de-authentication packets. These packets serve as key indicators of attempts to disconnect devices forcefully from the network. The ESP8266 acts as a sentinel, ever-vigilant in its observation of the network's integrity. Upon detecting an abnormal surge in the number of de- authentication packets, it promptly raises a metaphorical "blue flag," signaling the potential presence of a de-authentication attack. In essence, the ESP8266 operates as a proactive defender, scrutinizing the wireless landscape for any anomalous patterns indicative of someone attempting to disrupt the network by forcibly disconnecting connected devices.

This abstracts the complexity of network monitoring into a succinct and effective solution for detecting and mitigating de-authentication attacks. Keywords ESP8266, de-authentication attacks, Wi- Fi networks, Microcontroller unit (MCU),Espressif Systems, Wireless environment, Abnormal patterns, De-authentication packets, Threat detection.

Detecting de-authentication attacks using ESP8266 involves monitoring and analyzing wireless communication disruptions within a network. The ESP8266, a versatile Wi-Fi module, can be employed to identify anomalies associated with de- authentication attacks. These attacks involve maliciously disconnecting devices from a Wi-Fi network, causing disruptions and potential security threats.

By leveraging the ESP8266's capabilities, one can implement a monitoring system that constantly analyzes network traffic patterns. De-authentication attacks often manifest as a sudden spike in disconnection events. The ESP8266 can be programmed to detect such anomalies by monitoring the frequency and timing of de-authentication frames. Furthermore, by looking at signal strength and MAC addresses, we can spot unusual patterns that might indicate an ongoing attack.

The literature review provides an overview of existing research in three main areas: Wireless Intrusion Detection Systems (IDS), ESP8266-based Security Solutions, and De-authentication Attack Mitigation Techniques. Wireless Intrusion Detection Systems (IDS): This section highlights the importance of IDS in wireless networks due to their unique characteristics such as open air transmission, dynamic nature, and multiple protocols. It emphasizes the need for specialized security systems like WIDS to To effectively oversee and assess.wireless network traffic for malicious activity, thus enhancing network visibility, security, and compliance.

ESP8266-based Security Solutions: Previous studies have explored the application of ESP8266 MCU in enhancing networks. These works underscore the versatility of ESP8266 in implementing intrusion Identifying and stopping undesired occurrences, making it an attractive option for addressing security concerns in various applications. De-authentication Attack Mitigation Techniques: This section discusses de-authentication attacks, their simplicity of execution, and potential disruptions, especially in public Wi-Fi environments. It suggests mitigation techniques such as using strong encryption (WPA2/WPA3) and implementing network segmentation to limit attacks.

This study is to develop a robust Intrusion Detection System (IDS) utilizing the ESP8266 microcontroller unit (MCU) to detect and mitigate de-authentication attacks in Wi-Fi networks. These attacks, characterized by the transmission of fake de- authentication packets, pose a significant security threat by disrupting legitimate users' connections. Harvested Online Documentation & Reference Sources • https://github.com/shan-rasool/WiFi-Deauth-Detection-ESP8266 • https://github.com/faizan0049/ESP8266-Deauthentication-Attack-Detector • https://www.nature.com/articles/s41598-025-18947-2 • https://www.ijert.org/detect-wi-fi-de-authentication-attacks-using-esp8266