 |
In this slide, I present the overall system architecture of our proposed methodology for detecting CTS flooding attacks in Wi-Fi networks.
The process begins with data preprocessing, where control frames are extracted from the network traffic. These frames are then analyzed using sketch-based traffic profiling, along with NAV pattern hashing and PHY fingerprint updates, to efficiently summarize traffic behavior while keeping memory overhead low.
Next, the system performs a traffic update phase, where multiple traffic metrics are continuously monitored. An anomaly scoring mechanism evaluates deviations from normal behavior, and a verification trigger module confirms whether the observed pattern corresponds to a CTS flooding attack.
Once an anomaly is detected, the system evaluates the traffic intensity. If the traffic is normal, the process exits without intervention. However, if high-intensity anomalous traffic is confirmed, the system activates the countermeasure module.
The countermeasures include soft blocking strategies, NAV adjustment, and controlled escalation, ensuring that malicious nodes are mitigated while minimizing disruption to legitimate network traffic.
This adaptive architecture allows our system to detect CTS flooding attacks accurately and respond efficiently in real time. |
IEEE/ICACT20260287 Slide.06
[Big Slide]
[YouTube]