Enhancing WPA3 Wireless Network Security Through Lightweight BSSID and RSSI-Based Evil Twin Attack Detection

Wi-Fi networks technology bringing revolution in the IT industry in 1999 when apple firstly inbuilt Wi-Fi in their iBook laptops. It’s in trending among people around the world when Wi-Fi technology connects devices without any wire. The major responsibility of Wi-Fi is supporting everything from personal devices to enterprise-level systems. But modern digital era passing out very tough time of cybercrime that demand secure Wi-Fi. So with the time wireless security has evolved from WEP, WPA, WPA2 protocol to modern WPA3 standard. But in some cases wireless networks remain vulnerable to practical attacks particularly those involving rogue access points. The main reason behind threat is the Evil Twin attack, in which an attacker sets up a fake access point (adversary) that looks like a real network. This scenario invite to intercept user connections and carry out man-in-the-middle attacks. So to resolve the problem this paper presents a controlled experimental assessment of Evil Twin attack effectiveness against WPA3-Personal (SAE) networks across three device platforms that is Android 12, Windows 10, and Ubuntu 22.0. The Main focus basically two attack scenario which is passive rogue AP deployment (S1) and active de-authentication-assisted Evil Twin (S2). Additionally this paper introduce RogueAPscan.py, a novel lightweight Python-based BSSID and RSSI monitoring tool providing real-time rogue AP detection with three confidence levels (HIGH, SUSPICIOUS, LOW). It is based on OUI-prefix analysis and signal anomaly detection. The Experiments were conducted across 90 controlled trials. Findings under S1, passive attack success rates were 30%, 50%, and 40% for Android, Windows, and Linux respectively. Active de-authentication (S2) elevated these to 70%, 90%, and 60%. Result indicate that WPA3 PMF protections are bypassed in transition-mode deployments. RogueAPscan.py achieved detection rates of 83.3% (BSSID-only), 75.0% (RSSI-only), and 91.7% (combined), with a 3.3% false positive rate under combined detection. For more, results indicate that robust wireless security requires combining WPA3 authentication with active BSSID/RSSI monitoring.

WPA3 Security, Evil Twin Attack, BSSID Monitoring, Simultaneous Authentication of Equals (SAE)

1. Wi-Fi Alliance, "Wi-Fi CERTIFIED WPA3 Security Considerations Overview," 2018. [Online]. Available: https://www.wi-fi.org [Google Scholar] [Crossref]

2. Halbouni, L.-Y. Ong and M.-C. Leow, "Wireless Security Protocols WPA3: A Systematic Literature Review," IEEE Access, vol. 11, pp. 112438–112450, Oct. 2023. [Google Scholar] [Crossref]

3. M. Conti, N. Dragoni and V. Lesyk, "A Survey on Man-in-the-Middle Attacks," IEEE Commun. Surveys Tuts., vol. 18, no. 3, pp. 2027–2051, 2016. [Google Scholar] [Crossref]

4. Tleuberdin et al., "Vulnerabilities Assessment of WPA3-Enterprise in Evil Twin Attacks," in Proc. IEEE Conf., 2025. [Google Scholar] [Crossref]

5. M. Vanhoef and F. Piessens, "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2," in Proc. ACM CCS, 2017, pp. 1313–1328. [Google Scholar] [Crossref]

6. M. Vanhoef and E. Ronen, "Dragonblood: Analyzing the Dragonfly Handshake of WPA3-SAE," in Proc. IEEE S&P, 2019, pp. 517–533. [Google Scholar] [Crossref]

7. N. Asokan, V. Niemi and K. Nyberg, "Man-in-the-Middle in Tunnelled Authentication Protocols," in Security Protocols Workshop, LNCS vol. 3364, 2005, pp. 28–41. [Google Scholar] [Crossref]

8. Bartoli, E. Medvet, A. De Lorenzo and F. Tarlao, "(In) Secure Configuration Practices of WPA2 Enterprise Supplicants," in Proc. ARES, 2018, pp. 1–6. [Google Scholar] [Crossref]

9. G. A. Alghisi and F. Gringoli, "An Experimental Analysis of the WPA3 Protocol in IoT Devices," in Proc. MedComNet, 2024, pp. 1–4. [Google Scholar] [Crossref]

10. M. Asaduzzaman, M. S. Majib and M. M. Rahman, "Wi-Fi Frame Classification and Feature Selection Analysis in Detecting Evil Twin Attack," in Proc. IEEE TENSYMP, 2020, pp. 1704–1707. [Google Scholar] [Crossref]

11. Kamble and D. Kshirsagar, "Feature Selection in Wireless Intrusion Detection System for Evil Twin Attack Detection," in Proc. CISCT, 2023, pp. 1–5. [Google Scholar] [Crossref]

12. Hussain, K., Rahmatyar, A. R., Riskhan, B., Sheikh, M. A. & Sindiramutty, S. R. (2024). Threats and Vulnerabilities of Wireless Networks in the Internet of Things (IoT). 2024 IEEE 1st Karachi Section Humanitarian Technology Conference (KHI-HTC). [Google Scholar] [Crossref]

13. Shafique, K., Khawaja, B. A., Sabir, F., Qazi, S. & Mustaqim, M. (2020). Internet of Things (IoT) for Next-Generation Smart Systems: A Review of Current Challenges, Future Trends and Prospects for Emerging 5G-IoT Scenarios. IEEE Access, 8. [Google Scholar] [Crossref]

14. Islam, M. and Jin, S. (2019). An Overview Research on Wireless Communication Network. Advances in Wireless Communications and Networks. [Google Scholar] [Crossref]

15. Burg, A., Chattopadhyay, A. & Lam, K. (2018). Wireless Communication and Security Issues for Cyber–Physical Systems and the Internet-of-Things. Proceedings of the IEEE, 106. [Google Scholar] [Crossref]

16. Hussain, K., Rahmatyar, A. R., Riskhan, B., Sheikh, M. A. & Sindiramutty, S. R. (2024). Threats and Vulnerabilities of Wireless Networks in the Internet of Things (IoT). 2024 IEEE 1st Karachi Section Humanitarian Technology Conference (KHI-HTC). [Google Scholar] [Crossref]

17. Gupta, S., Chouhan, S. A., & Sounkhla, I. (2025, December). Hybrid ResNet-Transformer Architecture for Accurate LULC Classification on EuroSAT Data. In 2025 IEEE India Geoscience and Remote Sensing Symposium (InGARSS) (pp. 556-559). IEEE. [Google Scholar] [Crossref]

18. Gupta, S., Chouhan, S. A., & Sharma, A. (2025, October). Predictive Analysis and Monitoring of Crop Health using Satellite Imagery and Deep Learning. In 2025 1st IEEE Uttar Pradesh Section Women in Engineering International Conference on Electrical Electronics and Computer Engineering (UPWIECON) (pp. 111-117). IEEE. [Google Scholar] [Crossref]

19. Sounkhla, I., Dhir, R., Gupta, S., & Chouhan, S. A. (2026). ResNet-Transformer Hybrid Model for Classifying Apple Leaf Diseases. Procedia Computer Science, 283, 5329-5335. [Google Scholar] [Crossref]

• Human Factors Shaping Cybersecurity Behavior in Work from Home Environment in Ugandan Universities
• Comparative Analysis of Lightweight Cryptography and Blockchain-Based Security Protocols for Mitigating Threats and Vulnerabilities in the Internet of things