Now 5071 visitors
Today:0 Yesterday:0
Total: 147068 212S 50P 4R
2026-10-20, Week 43
Member Login
TACT Journal Homepage
Call for Paper
Committee
Find My Paper
Author Homepage
Statistics & History
Welcome Message
Paper Procedure
FAQ
Paper Archives
Outstanding Papers
Program & Proceedings
Presentation Platform
Hotel & Travel Info
Photo Gallery
Scheduler Login
Seminar
Archives Login
Sponsors


















Presentation Assistant Go to [Q&A Session]
Paper Number
Paper Title
Keyword
ICACT20260287 Slide.01        [Big Slide]      [YouTube] Chrome Click!!
Good day everyone. I am Asif Hossain Joy, and today I am pleased to present our research paper entitled “Adaptive Anomaly Detection of CTS Flooding in Wi-Fi Networks Using Sketch-Based Profiling.” This research is a collaborative work between Zinadin Zidan and myself, and was conducted under the guidance of our respected faculty member, Dr. Nahar Sultana. In this presentation, I will introduce the problem of CTS flooding attacks in Wi-Fi networks, highlight the limitations of existing detection techniques, and present our proposed adaptive sketch-based profiling approach for efficient anomaly detection.
ICACT20260287 Slide.02        [Big Slide]      [YouTube] Chrome Click!!
Wireless networks are widely used in IoT, enterprises, and public spaces. Most security systems focus on data and management frames, but control frames like CTS are usually get ignored. Attackers exploit this weakness by sending fake CTS frames. Our goal is to design a lightweight, real-time detection and mitigation system without heavy computation.
ICACT20260287 Slide.03        [Big Slide]      [YouTube] Chrome Click!!
This slide states what happens in a CTS attack and its impact. In a CTS flooding attack, an attacker sends fake CTS frames with large duration values. This forces nearby devices to set their NAV timers, believing the channel is busy. As a result, legitimate communication is blocked even though the network appears active. The main impact is severe throughput delay and high latency. This creates a condition called virtual jamming, where devices stay silent which means the network looks busy, but no useful data is transferred.
ICACT20260287 Slide.04        [Big Slide]      [YouTube] Chrome Click!!
This slide represent the limitations of existing solutions against the problem. Traditional intrusion detection systems mostly ignore control frames. Rule-based systems rely on static thresholds, which attackers can easily bypass. Machine-learning-based solutions are comparatively heavy and slow, making them unsuitable for real-time protection at the control layer.
ICACT20260287 Slide.05        [Big Slide]      [YouTube] Chrome Click!!
Here is our proposed solution, We propose a multi-stage, cross-layer detection framework for real-time anomaly detection. We use sketch-based profiling, specifically Count-Min Sketch and Bloom Filters. We used this to track of CTS behavior efficiently. In our approach, we do not rely only on MAC-layer information. Instead, we combine MAC-layer logic with PHY-layer fingerprints, such as signal strength and transmission characteristics. If a device claims to be a legitimate user at the MAC layer, but its physical signal properties do not match the expected pattern, the system identifies this as spoofing behavior. This cross-layer validation makes the detection more robust and helps identify attackers even when they successfully fake their MAC addresses. Soft mitigation is used instead of immediate blocking to reduce false positives because instant blacklisting can disrupt legitimate users in noisy wireless environments. The system applies token-bucket rate limiting to restrict high CTS transmissions and uses NAV rewriting to correct malicious duration values, allowing normal communication to continue. If the abnormal behavior remains same, the response is gradually increased, and the attacker is blocked only when necessary.
ICACT20260287 Slide.06        [Big Slide]      [YouTube] Chrome Click!!
In this slide, I present the overall system architecture of our proposed methodology for detecting CTS flooding attacks in Wi-Fi networks. The process begins with data preprocessing, where control frames are extracted from the network traffic. These frames are then analyzed using sketch-based traffic profiling, along with NAV pattern hashing and PHY fingerprint updates, to efficiently summarize traffic behavior while keeping memory overhead low. Next, the system performs a traffic update phase, where multiple traffic metrics are continuously monitored. An anomaly scoring mechanism evaluates deviations from normal behavior, and a verification trigger module confirms whether the observed pattern corresponds to a CTS flooding attack. Once an anomaly is detected, the system evaluates the traffic intensity. If the traffic is normal, the process exits without intervention. However, if high-intensity anomalous traffic is confirmed, the system activates the countermeasure module. The countermeasures include soft blocking strategies, NAV adjustment, and controlled escalation, ensuring that malicious nodes are mitigated while minimizing disruption to legitimate network traffic. This adaptive architecture allows our system to detect CTS flooding attacks accurately and respond efficiently in real time.
ICACT20260287 Slide.07        [Big Slide]      [YouTube] Chrome Click!!
This slide explains how our system performs profiling and detection in a lightweight and reliable way. First, we use a Count-Min Sketch to efficiently track how frequently each device sends CTS frames, without storing every packet. Next, a Bloom Filter is used to detect repeated NAV duration values, which is a common pattern in CTS flooding attacks. To prevent identity spoofing, we apply PHY-layer fingerprinting, where the signal characteristics are compared with the claimed MAC address and if any mismatch occurred it is flagged as suspicious. Finally, before acting, the system uses a challenge–response mechanism to verify the device, since a spoofed attacker cannot respond correctly.
ICACT20260287 Slide.08        [Big Slide]      [YouTube] Chrome Click!!
This slide presents our mitigation strategy. First, we use token-bucket rate limiting, which works like giving each device a small allowance for sending CTS frames. If a device starts sending too many CTS packets, it quickly uses up that allowance, and its transmissions are slowed down instead of being stopped immediately. This helps reduce the attack without harming normal users. Then, with NAV rewriting, the access point fixes the fake “busy” times sent by the attacker, so other devices don’t stay silent, and the network can keep working normally. Finally, if the device keeps misbehaving even after these steps, the system slowly increases the response and blocks the attacker only when there is no other option.
ICACT20260287 Slide.09        [Big Slide]      [YouTube] Chrome Click!!
Though we didn’t implement this on physical devices this experiments were conducted in a controlled simulation environment using Google Colab. During normal operation, CTS rates remain stable. When the attack starts, CTS transmission increases sharply. The anomaly score quickly crosses the threshold, and the detection flag activates in real time.
ICACT20260287 Slide.10        [Big Slide]      [YouTube] Chrome Click!!
Before mitigation, the CTS rate remains continuously high due to flooding. After mitigation, the CTS rate drops immediately. This happens because token-bucket rate limiting restricts how aggressively the attacker can send CTS frames, without instantly disconnecting the device. At the same time, NAV rewriting corrects the fake duration values, so legitimate devices are no longer forced to stay silent. Overall, these results show that our system can quickly reduce the impact of the attack while still allowing normal network communication for legitimate users.
ICACT20260287 Slide.11        [Big Slide]      [YouTube] Chrome Click!!
Here is a short comparison with the existing works as Traditional rule-based methods rely on static checks and blacklisting, which can cause network instability. Heavy machine learning approaches require large datasets and high computation. Our approach is lightweight, real-time, and spoof-resistant due to sketch-based profiling and cross-layer verification.
ICACT20260287 Slide.12        [Big Slide]      [YouTube] Chrome Click!!
To sum up We proposed a novel and lightweight CTS flooding detection framework. Our Simulation results confirm the fast detection and effective mitigation of our work. And Soft mitigation successfully protects the network without disconnecting legitimate users. In the future, we will plan for real-world deployment, realistic attack generation, and threshold optimization for this work.
ICACT20260287 Slide.13        [Big Slide]      [YouTube] Chrome Click!!
Thank you.