Rogue Access-Point Detection System · Hacking Project

Continuously detect and localize rogue and evil-twin access points by correlating RF observations against an authorized baseline and wired-network data.

**The problem**
Rogue access points — unauthorized APs plugged into the corporate network or evil twins impersonating the corporate SSID — provide attackers a stealthy bridge for data theft and credential harvesting that bypasses perimeter controls. Most organizations lack systematic detection, relying on occasional manual walk-throughs. The gap is continuous, automated identification of both wired-side rogue APs and RF-side evil twins with rapid localization.

**What you'll build**
Build a detection system that maintains an authorized-AP baseline (BSSID, SSID, channel, vendor, security config, wired MAC/switch port) and continuously compares observed RF beacons against it, flagging unknown BSSIDs, SSID impersonation with mismatched BSSID/IE fingerprints, and security-config mismatches. Correlate RF detections with wired-side switch CAM/MAC-table data to distinguish true network-attached rogues from neighbor APs, and use multi-sensor RSSI to localize the offender.

**Objective** — Continuously detect and localize rogue and evil-twin access points by correlating RF observations against an authorized baseline and wired-network data.

**Expected outcome** — A rogue-AP detection system with an authorized-AP inventory, real-time rogue/evil-twin alerts, wired-side correlation, and RSSI-based localization.

**Difficulty** — Advanced — requires RF monitoring, baseline management, wired/RF correlation, and localization logic working together.

**Primary category** — SOC / Wireless Intrusion Detection; Secondary = Network Defense, Threat Hunting, Asset Management

**Security domains** — Primary = Blue Team; Secondary = Purple Team, Incident Response, Security Research, Network Security

**Technical focus** — rogue AP detection, evil-twin detection, BSSID/SSID/IE fingerprinting, authorized-AP baselining, wired-side CAM/MAC correlation, RSSI trilateration/localization, beacon analysis, SIEM alerting

**Core technologies** — Languages: Python, Go; Frameworks/Libraries: Scapy, SNMP libraries (pysnmp), Kismet API; Security Tools: Kismet, aircrack-ng, nzyme, Wireshark; Cloud/Infra: Raspberry Pi/OpenWrt sensors, managed switches (SNMP/CAM access), Docker, Elastic; AI/Data: scikit-learn for fingerprint matching, Grafana; Databases: Elasticsearch, PostgreSQL, InfluxDB

**Where it's valued** — Enterprise security, finance, healthcare, retail, government, critical infrastructure, MSSPs

**Careers it builds toward** — SOC Analyst/Engineer, Wireless Security Engineer, Detection Engineer, Network Security Engineer, Incident Responder

**Framework alignment**
• MITRE ATT&CK: Detects Adversary-in-the-Middle T1557 (evil twin), Hardware Additions T1200 (rogue AP on network), Network Sniffing T1040, Valid Accounts T1078 via credential capture
• NIST CSF 2.0: Detect (DE.CM continuous monitoring, DE.AE), Identify (ID.AM asset management), Respond
• OWASP: N/A (network/RF layer)
• CIS Controls v8: Control 1 (Inventory of Enterprise Assets), Control 13 (Network Monitoring and Defense), Control 12 (Network Infrastructure Management), Control 4 (Secure Configuration)

**Innovation** — Improved Existing Solution — rogue detection is a known capability, but open-source RF-plus-wired correlation with localization is valuable and not commonly built well. Scores: Innovation 6/10, Startup 6/10, Enterprise-Readiness 7/10, Patent = Possible.