Privacy-Preserving Detection of Wi-Fi Deauthentication Attacks on Robotic Systems Using Temporal Traffic Features

Abstract

The increasing integration of robots into everyday environments has led to the emergence of cybersecurity threats against robotic systems, which has consequently rendered this area a significant research challenge. This study proposes an advanced behavioral analysis framework, grounded in temporal characteristics, for the identification of various WiFi attack types targeting WiFi-enabled robotic systems. In order to ensure the confidentiality of data, the proposed Intrusion Detection System (IDS) functions independently of packet payloads and identifiers, relying exclusively on features derived from Inter-Arrival Time (IAT) metrics. The total number of temporal features that were engineered amounted to 26, including IAT entropy, coefficient of variation, burst detection indicators, and multi-window statistical measures. In order to address the issue of class imbalance, the Synthetic Minority Over-Sampling Technique (SMOTE) was implemented, and a window-size sensitivity analysis was conducted to provide an objective justification for the selected feature configuration. A comprehensive comparative evaluation was performed using Random Forest (RF), Support Vector Machine (SVM), Multilayer Perceptron (MLP), Gradient Boosting Machine (GBM), and Long Short-Term Memory (LSTM) models on a WiFi traffic dataset comprising 36,098 samples across five classes (Normal, Deauthentication, Fake Authentication, ARP Replay, and Interactive Replay), collected from a real-world robotic platform scenario. Two classification settings were considered: binary classification and multi-class classification. In the binary classification scenario, the MLP model demonstrated the optimal performance, attaining an F1-score of 0.906 and an accuracy of 0.833. In the multi-class scenario, the LSTM model demonstrated superior performance, attaining an accuracy of 0.782 and an F1-score of 0.792. The findings indicate that the utilization of time-based behavioral features exclusively facilitates effective attack detection while preserving privacy and minimizing the risk of data leakage. Furthermore, a clear hierarchy in attack distinguishability is identified: high-rate, connectivity-disrupting attacks, such as deauthentication, are detected with near-perfect accuracy (F1=0.99 ), whereas lower-rate attacks that do not disrupt connectivity pose greater detection challenges. These findings offer significant insights into the design of privacy-preserving IDS solutions in robotic environments.