IEEE 802.11 Beacon Frame Dataset for Rogue Access Point Detection in Urban Environments
Description
The core hypothesis is that IEEE 802.11 beacon frames carry sufficient metadata to passively distinguish rogue access points from legitimate ones without requiring active probe injection, network association, or elevated privileges. Specifically, rogue APs (particularly evil twin attacks, where an adversary mimics a legitimate AP to intercept traffic) leave detectable fingerprints in frame-level fields such as BSSID locally administered bits, anomalously low TSF/sequence numbers, encryption mismatches, and unusual channel assignments. The goal is to validate these heuristics on real-world urban data and enable reproducible ML model training. The dataset consists of approximately 29,990 raw beacon frame records captured across four field sessions in Chennai, Tamil Nadu, India (approx. 13.0827° N, 80.2707° E). Data was collected by mounting a custom ESP32-based scanner on a bicycle or car dashboard and commuting through residential communities and urban roads. The processed file rogue_processed.csv extends this to 67,776 total rows by augmenting with 37,786 synthetic rogue samples generated via the included rogue_ap_generator module. Each raw record has 25 fields spanning physical layer, security, and vendor attributes. Key columns include: Timestamp_ms — milliseconds since device boot SSID / BSSID — network name and MAC address of the AP RSSI — received signal strength in dBm Channel / DSChannel — operating and DS parameter set channel BeaconInterval — AP's broadcast interval in Time Units (TU) SequenceNumber — 802.11 frame counter (low values are a rogue indicator) Encryption — WPA2 / WPA / WEP / Open OUI / VendorName — manufacturer info from BSSID prefix IsHidden, Privacy, HasHT, HTChannelWidth, HTStreams capability flags The processed file rogue_processed.csv adds 11 engineered features: is_rogue — binary ground-truth label (1 = rogue, 0 = legitimate) rogue_type — category string (e.g., evil_twin_last_octet, legitimate) BSSID_LocalAdmin — locally administered MAC address flag (key rogue indicator) LowSeqNumber, LowTSF — anomaly flags for unusually low counter values UnusualChannel — flag for non-standard channel operation Is_WEP, Is_Open — encryption downgrade flags Timestamp_Ratio — BeaconTimestamp / Timestamp_ms ratio as an anomaly indicator
Files
Steps to reproduce
Instrumentation The sole capture instrument is an ESP32 microcontroller paired with a MicroSD SPI module for on-device storage. No specialist network hardware, reagents, or lab equipment was used. Protocol The ESP32 Wi-Fi radio was operated in IEEE 802.11 promiscuous mode via esp_wifi_set_promiscuous_rx_cb(), which receives all 802.11 frames without associating to any network. A frame-type filter restricted captures to management frames, subtype 0x08 (beacon only). Data Collection Workflow FAT32 MicroSD inserted; ESP32 powered on via USB power bank Firmware auto-initializes promiscuous mode and begins channel hopping across channels 1–13 at 250 ms/channel Device mounted on bicycle (sessions 001, 004) or car dashboard (session 002) and driven through residential and urban roads in Chennai, Tamil Nadu, India Captures written to /captures/beacon_000.csv; files auto-rotate at 10 MB SD card retrieved; CSVs transferred and organized into session_001 through session_004 Software & Firmware Tool Purpose Arduino IDE + ESP32 Core Firmware compilation and flashing BeaconParser.ino IE extraction from raw beacon frames WifiScanner.ino Promiscuous mode and channel hopping LogStorage.ino Buffered SD card writes Pandas (Python) Session merging and feature engineering Post-Processing Sessions were merged using Pandas. Eleven features were engineered from the 25 raw fields using heuristic rules derived from known rogue AP indicators locally administered BSSIDs, low TSF/sequence numbers, evil twin SSID matching, WEP encryption, and non-standard channels. These rules produced the binary is_rogue label and _rogue_type categories in rogue_processed.csv. Synthetic Augmentation rogue_ap_generator/rogue_gen.py was used to generate 37,786 synthetic rogue samples, appended to the 29,990 real captures to produce the final labelled dataset of 67,776 rows.
Institutions
- Vellore Institute of Technology UniversityTamil Nadu, Vellore