An Edge-Based Framework for Wireless Intrusion Detection and Real-Time Unauthorized Device Identification Using ESP32

Technical Summary: An Edge-Based Framework for Wireless Intrusion Detection and Real-Time Unauthorized Device Identification Using ESP32

Problem Statement
The proliferation of wireless communications in homes, educational institutions, and small businesses has introduced significant security vulnerabilities. While wireless networks facilitate IoT applications, their inherent openness makes them susceptible to unauthorized access, bandwidth theft, and malicious attacks. Traditional Intrusion Detection Systems (IDS), such as Snort and Suricata, rely on packet inspection and signature matching but are often impractical for small-scale deployments due to their high computational requirements, expensive hardware dependencies, and reliance on cloud infrastructure. Furthermore, existing low-cost monitoring solutions often lack real-time alerting capabilities, focusing instead on data logging. There is a distinct need for a cost-effective, low-power, and standalone solution that can detect unauthorized devices without compromising data privacy through cloud dependency.

Methodology and System Architecture
The proposed solution is a low-cost WiFi intrusion alert system built on edge computing principles, utilizing the ESP32 microcontroller as the central processing unit. The system operates independently of cloud services, ensuring data privacy and reducing latency. The architecture is structured into four distinct layers:

1. Network Monitoring Layer: The ESP32 connects to the target wireless network and continuously scans for active devices, capturing identification information (specifically MAC addresses).
2. Device Verification Layer: Detected device identifiers are cross-referenced against a pre-defined whitelist of authorized MAC addresses. Any device not matching the whitelist is flagged as suspicious.
3. Intrusion Analysis Layer: This localized decision-making block evaluates the legitimacy of devices. If an unauthorized device is confirmed, the system triggers an intrusion event. This layer operates entirely on the ESP32, minimizing response time.
4. Alert Generation Layer: Upon detecting an intrusion, the system immediately activates dual alert mechanisms: a visual indicator (Red LED) and an audio alert generated via a DFPlayer Mini module and speaker. A Green LED indicates normal status.

The workflow involves the ESP32 associating with the network, continuously monitoring data packets, and comparing detected devices against the whitelist. If an unauthorized device is identified, the system triggers alerts and continues monitoring until the threat is removed, at which point it automatically resets. The detection logic is mathematically defined where a value of '1' indicates an intrusion requiring alert activation.

Key Contributions
The paper outlines five primary contributions to the field of embedded security:

1. The design of a low-cost framework for WiFi intrusion detection.
2. The implementation of real-time identification of unauthorized devices.
3. The integration of both visual and audio alert mechanisms for immediate user notification.
4. The establishment of an edge-based processing model that eliminates dependency on cloud services.
5. A scalable deployment strategy suitable for resource-constrained environments like homes and educational laboratories.

Experimental Results
The system was validated through controlled experiments involving authorized devices, unauthorized devices, and mixed scenarios.

• Authorized Access: When only whitelisted devices were connected, the system correctly identified them as authorized and generated no false alerts.
• Unauthorized Access: When an unauthorized device connected to the network, the ESP32 successfully identified it, classified it as suspicious, and triggered both visual and audible alerts.
• Threat Removal: Upon disconnecting the unauthorized device, the system automatically cleared the warning and resumed monitoring without manual intervention.
• Performance: The system demonstrated a low processing and power consumption profile. Detection occurred within a few seconds, determined primarily by the network scan interval. The framework operated within the ESP32's memory limits without impacting service quality.

Comparative analysis indicates that while enterprise IDS and cloud security services offer high capabilities, they come with high costs and cloud dependencies. The proposed ESP32 system offers a low-cost alternative with real-time alerting, making it uniquely suitable for residential and educational settings where budgets are limited.

Significance and Claims
The authors claim that this work provides a viable, low-cost alternative to expensive commercial intrusion detection systems. By leveraging the ESP32's integrated WiFi and low-power capabilities, the system offers a "standalone" security solution that enhances data privacy by avoiding external server dependencies. The paper emphasizes that the system is particularly effective for small-scale networks where advanced cybersecurity options are financially unfeasible.

The authors maintain a modest scope regarding the system's current capabilities, acknowledging that it relies on MAC address verification, which is vulnerable to spoofing, and does not perform Deep Packet Inspection (DPI) to analyze payload contents. However, they posit that the framework successfully demonstrates the feasibility of using embedded computing platforms for wireless intrusion detection, providing a foundation for future, more intelligent security systems.