ABSTRACT
Open Wi-Fi networks are commonly deployed in colleges, libraries, transportation hubs, and public areas because they provide convenient and unrestricted internet access. However, this openness comes at the cost of security. One of the most common and disruptive threats in such environments is the deauthentication attack, which exploits the unprotected management frames of the IEEE 802.11 protocol. By sending forged deauthentication frames, an attacker can forcibly disconnect legitimate users, disrupt services, and even prepare the ground for more dangerous attacks such as evil twin access points for credential theft.This paper presents the design, development, and evaluation of a low-cost ESP32-based security monitoring system that detects deauthentication attacks in real time. The system operates in promiscuous mode to capture wireless frames across multiple Wi-Fi channels and applies a hybrid detection mechanism combining count-based thresholds, rate-based analysis, and RSSI filtering to reduce false positives. Additionally, a router MAC address database is maintained to identify spoofing attempts. Upon detection, the system provides real-time alerts through an OLED display, buzzer notification, and email reporting containing detailed attack information. The system was tested in a college campus network environment consisting of 10 access points and approximately 500 concurrent users. Experimental results showed 96% detection accuracy with zero false positives during a four-hour evaluation period. The proposed solution demonstrates that an affordable embedded platform can effectively provide practical wireless intrusion detection in open network environments..
Keywords: Deauthentication attack, ESP32, Wi-Fi security, intrusion detection, spoof detection, embedded monitoring system.