A Granular Computing Approach for Multi-Labelled Sequences Classification in IEEE 802.11 Networks

Recent developments in communication networks have made new kind of services possible, which are even more connected due to smart Internet of Things devices and sensor networks. This complex integration of technologies had increased the attack surface on networks that are spread across multiple environments, with different protocols and services, usually based on the wireless medium. Network Intrusion Detection Systems aim to overcome these security issues, analyzing network traffic and applying multiple reconnaissance techniques. For this purpose, state-of-the-art research activities have been focused on Artificial Intelligence and Machine Learning-based approaches in order to scale more efficiently the capabilities of this kind of systems (in terms of both complexity, speed and training data required). Our work further analyzes these security issues, in particular, by introducing a consolidated approach based on the Granular Computing information processing paradigm applied to sequences of WiFi frames. We focused on a subset of attacks collected in the Aegean WiFi Intrusion Detection dataset, that consists in complex multi-step attacks or simpler control frames flooding attacks, not recognizable using a single-frame processing strategy. This kind of structured data heterogeneity implies a non-exclusive labelling strategy, as each frames' sequence could bring information related to different attack classes, making the whole supervised problem more challenging. We show that the proposed solution provides interesting results in terms of classification performances, limited embedding complexity and peculiar white-box trained models.