The AWID2 Dataset
Data Gathering
For purposes of data gathering we created a physical lab which realistically emulates a typical SOHO infrastructure. A number of mobile and stationary STAs were used as the valid clients of the network, while a single mobile attacker was unleashing various attacks. More specifically, the valid network consisted of 1 desktop machine, 2 laptops, 2 smartphones, 1 tablet and 1 smartTV. The position of the desktop machine and smart TV remained static throughout the course of all the experiments. The smartphone devices displayed high mobility, i.e., they changed position inside the facilities of the lab and joined/left the network numerous times throughout the course of the experiments. Finally, the laptop machines were semi-static, i.e., they rarely changed their position. The services running on the clients which were responsible for producing traffic were web browsing, VoIP, and file downloading. The network was covered by a single AP, which was a Netgear N150 WNR1000 v3 device (Firmware Version V1.0.2.5460.0.82), protected by the unreliable WEP encryption, supporting up to 54Mbps transfer rates.
Equipment
The network was covered by a single AP, which was a Netgear N150 WNR1000 v3 device (Firmware Version V1.0.2.5460.0.82), protected by the unreliable WEP encryption, supporting up to 54Mbps transfer rates. All attacks were unleashed by a single attacking node using an Acer Aspire 5750G laptop running Kali Linux 1.0.6 64bit. The attacker was equipped with a D-Link DWA-125 card in promiscuous mode for injecting packets. The assailant frequently changed her MAC address among the various attacks. To implement the attacks various tools were used including the Aircrack-ng suite, the MDK3 tool, the Metasploit framework as well as custom made ones implemented in C language using the Lorcon2 library. The intruder was mobile and was acting outside the perimeter of the facilities of the lab. For capturing the wireless traffic a separate device was introduced as a monitor node.
Scenarios
We analyze the 15 attacks included in the training version of the reduced AWID dataset (AWID-ATK-R-Trn) detailed in section VI. This undertake aims in highlighting possible attack patterns from a theoretical as well as practical perspective. To the best of our knowledge this is the first documented attempt to fingerprint 802.11 attacks. We expect that this will lead to the better understanding of the structure and the characteristics of such anomalies when they occur in wireless networks.
File Characteristics
The AWID dataset is comprised from a large set of packets (F) and a smaller one (R). These two versions are not related i.e., the smaller one has not been produced from the larger. Actually, they have been captured at different times, with different equipment and in different environments. Each version has a training set (denoted as Trn) and a test set (denoted as Tst). The test version has not been produced from the corresponding training set. Finally, a version where labels that correspond to different attacks (ATK), as well as a version where the attack labels are organized into 3 major classes (CLS) are provided. In that case the datasets only differ in the label.
Attributes
Each record includes 155 attributes, including the class attribute which denotes whether the record is normal or transmitted during an attack. Out of these attributes some are useful for detecting attacks, some are just noise while some may prove misleading. If an attribute does not apply to a specific record then value "?" is used. For a full reference of the attributes please visit: Wireshark frame reference.
Machine Learning Classification
We evaluated the AWID dataset against several soft computing algorithms in an attempt to give pointers towards the algorithms that behave best with the AWID dataset. Our experiments were conducted with the Weka framework on an 8-core, Ubuntu 12.04 server, virtual machine with 56GB RAM, located on the Azure cloud service. The chosen datasets were AWID-CLS-R-Trn and AWID-CLS-R-Tst for training and testing purposes respectively.
