AWID3

Feb 15, 2021

The AWID3 Dataset

It markedly supplements and extends the well-known AWID2 corpus by capturing and studying traces of a wide variety of attacks hurled in the IEEE 802.1X Extensible Authentication Protocol (EAP) environment. Also, given that all the 802.11-oriented attacks have been carried out when the defenses introduced by Protected Management Frames (PMF) were operative, it offers the first to our knowledge full-fledged empirical study regarding the robustness of the IEEE 802.11w amendment, which is mandatory for WPA3 certified devices. Under both the aforementioned settings, AWID3 is anticipated to be of significant aid towards designing and evaluating intrusion detection systems. To deliver a well-rounded dataset of greater lifespan, and under the prism of an attacker escalating their assault from the wireless MAC layer to higher ones, we have additionally included several assaults that are common to IEEE 802.3 networks. Since the corpus is publicly offered in the form of raw cleartext pcap files, future research can straightforwardly exploit any subset of features, depending on the particular application scenario. To further assist researchers working on the WiFi IDS topic, we empirically extracted manually 254 features, i.e., 253 generic ones, plus one more for labeling purposes, in CSV format. This "AWID3-CSV" dataset complements the original one given in pcap format. The extracted features spread across both the MAC and app layers of the recorded pcap files, and are separated based on the corresponding layer.

Testbed

As depicted in the figure below, AWID3 exploits a physical lab which realistically emulates a typical enterprise infrastructure. In total, we utilized 16 different physical devices and VMs. From them, 10 were used as client STAs, while one more laptop STA was operated by the mobile attacker. Two of the client STAs were running Ubuntu 20.04 desktop, 5 more had MS Windows 10 Pro or Enterprise, and the rest 3 were Samsung S20 FE on Android v10, Samsung Note 4 on Android 6.0.1, and iPhone 6s on iOS v14.2. Another 3 devices were acting as an MS Windows Server 2019, a Fedora 33 Server, and a Ubuntu 20.04 Server. The rest of the 3 devices were the AP, the monitor node, and a dockerized version of the Damn Vulnerable Web Application (DVWA) residing in MS Azure.

Attacks

Multi-stage Attacks

Signature of a multi-stage assault combining 3 pcap files, namely "Deauth", "Evil_Twin", and "Website_spoofing".

PMF (802.11w) issues

Especially for the 802.11-oriented attacks, and by considering diverse setups, we meticulously study their effect on devices with a particular focus on PMF and elaborate on probable causes. Among other interesting results, our study reveals that even with the protection of PMF, legacy DoS attacks exploiting 802.11 management frames are still quite feasible on legacy devices by using off-the-shelf equipment.

Beacon DoS Attack: PoC Video

This is the video describing the Beacon DoS attack given in p.7 of the paper. This kind of attack affects WPA3 networks too.

Proposed Wireshark filter per attack

To quickly discern among normal and attack traffic you can use the following Wireshark filters. Note that these filters will return the great mass (>95%) of attack frames per attack, and for some of the attacks almost all such frames.