{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T14:44:31Z","timestamp":1760366671704,"version":"build-2065373602"},"reference-count":30,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2022,1,7]],"date-time":"2022-01-07T00:00:00Z","timestamp":1641513600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003725","name":"National Research Foundation of Korea","doi-asserted-by":"publisher","award":["NRF-2020R1A2C1013308","NRF-2021R1F1A1063640"],"award-info":[{"award-number":["NRF-2020R1A2C1013308","NRF-2021R1F1A1063640"]}],"id":[{"id":"10.13039\/501100003725","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Distinguishing between wireless and wired traffic in a network middlebox is an essential ingredient for numerous applications including security monitoring and quality-of-service (QoS) provisioning. The majority of existing approaches have exploited the greater delay statistics, such as round-trip-time and inter-packet arrival time, observed in wireless traffic to infer whether the traffic is originated from Ethernet (i.e., wired) or Wi-Fi (i.e., wireless) based on the assumption that the capacity of the wireless link is much slower than that of the wired link. However, this underlying assumption is no longer valid due to increases in wireless data rates over Gbps enabled by recent Wi-Fi technologies such as 802.11ac\/ax. In this paper, we revisit the problem of identifying Wi-Fi traffic in network middleboxes as the wireless link capacity approaches the capacity of the wired. We present Weigh-in-Motion, a lightweight online detection scheme, that analyzes the traffic patterns observed at the middleboxes and infers whether the traffic is originated from high-speed Wi-Fi devices. To this end, we introduce the concept of ACKBunch that captures the unique characteristics of high-speed Wi-Fi, which is further utilized to distinguish whether the observed traffic is originated from a wired or wireless device. The effectiveness of the proposed scheme is evaluated via extensive real experiments, demonstrating its capability of accurately identifying wireless traffic from\/to Gigabit 802.11 devices.<\/jats:p>","DOI":"10.3390\/s22020437","type":"journal-article","created":{"date-parts":[[2022,1,9]],"date-time":"2022-01-09T23:08:26Z","timestamp":1641769706000},"page":"437","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Weigh-in-Motion: Lightweight Real-Time Identification of Gbps Wireless Traffic"],"prefix":"10.3390","volume":"22","author":[{"given":"Sungsoo","family":"Kim","sequence":"first","affiliation":[{"name":"School of Computing, Gachon University, 1342, Seongnam-daero, Sujeong-gu, Seongnam-si 13120, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9520-5855","authenticated-orcid":false,"given":"Joon","family":"Yoo","sequence":"additional","affiliation":[{"name":"School of Computing, Gachon University, 1342, Seongnam-daero, Sujeong-gu, Seongnam-si 13120, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4367-3913","authenticated-orcid":false,"given":"Jaehyuk","family":"Choi","sequence":"additional","affiliation":[{"name":"School of Computing, Gachon University, 1342, Seongnam-daero, Sujeong-gu, Seongnam-si 13120, Korea"}]}],"member":"1968","published-online":{"date-parts":[[2022,1,7]]},"reference":[{"key":"ref_1","unstructured":"Boeckl, K., Grayson, N., Howell, G., Lefkovitz, N., Ajmo, J., McGinnis, M., Sandlin, K., Slivina, O., Snyder, J., and Ward, P. (2021). Mobile Device Security: Bring Your Own Device (BYOD), Technical Report."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Choi, J. (2020). Detection of Misconfigured BYOD Devices in Wi-Fi Networks. Appl. Sci., 10.","DOI":"10.3390\/app10207203"},{"key":"ref_3","unstructured":"Bitglass (2021, June 15). 2021 BYOD Security Report. Available online: https:\/\/pages.bitglass.com\/CD-FY21Q2-BYOD2021_LP.html."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1866","DOI":"10.1109\/TVT.2021.3055263","article-title":"A Joint Rogue Access Point Localization and Outlier Detection Scheme Leveraging Sparse Recovery Technique","volume":"70","author":"Pu","year":"2021","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Pu, Q., Ng, J.K.Y., Deng, S., and Zhang, F. (2020, January 25\u201328). Rogue Access Point Localization Leveraging Compressive Sensing via Kernel Optimization. Proceedings of the 2020 IEEE Wireless Communications and Networking Conference (WCNC), Seoul, Korea.","DOI":"10.1109\/WCNC45663.2020.9120503"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"325","DOI":"10.1109\/TNET.2011.2159990","article-title":"Identifying 802.11 Traffic From Passive Measurements Using Iterative Bayesian Inference","volume":"20","author":"Wei","year":"2012","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1912","DOI":"10.1109\/TPDS.2011.125","article-title":"A Timing-Based Scheme for Rogue AP Detection","volume":"22","author":"Han","year":"2011","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"ref_8","unstructured":"(2013). Enhancements for Very High Throughput for Operation in Bands below 6 GHz (Standard No. IEEE Standards 802.11ac-2013)."},{"key":"ref_9","unstructured":"(2021). (Amendment to IEEE Std 802.11-2020): Enhancements for High-Efficiency WLAN (Standard No. IEEE Standards 802.11ax-2021)."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Venkataraman, A., and Beyah, R. (2009). Rogue access point detection using innate characteristics of the 802.11 mac. International Conference on Security and Privacy in Communication Systems, Springer.","DOI":"10.1007\/978-3-642-05284-2_23"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Amaral, P., Dinis, J., Pinto, P., Bernardo, L., Tavares, J., and Mamede, H.S. (2016, January 8\u201311). Machine learning in software defined networks: Data collection and traffic classification. Proceedings of the 2016 IEEE 24th International Conference on Network Protocols (ICNP), Singapore.","DOI":"10.1109\/ICNP.2016.7785327"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Fan, Z., and Liu, R. (2017, January 28\u201331). Investigation of machine learning based network traffic classification. Proceedings of the 2017 International Symposium on Wireless Communication Systems (ISWCS), Bologna, Italy.","DOI":"10.1109\/ISWCS.2017.8108090"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"107557","DOI":"10.1016\/j.comnet.2020.107557","article-title":"Online classification of user activities using machine learning on network traffic","volume":"181","author":"Labayen","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Bezawada, B., Bachani, M., Peterson, J., Shirazi, H., Ray, I., and Ray, I. (2018, January 19). Behavioral fingerprinting of iot devices. Proceedings of the 2018 Workshop on Attacks and Solutions in Hardware Security, Toronto, ON, Canada.","DOI":"10.1145\/3266444.3266452"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"18042","DOI":"10.1109\/ACCESS.2017.2747560","article-title":"Network traffic classifier with convolutional and recurrent neural networks for Internet of Things","volume":"5","author":"Carro","year":"2017","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Byeon, S., Yoon, K., Yang, C., and Choi, S. (2017, January 1\u20134). STRALE: Mobility-aware PHY rate and frame aggregation length adaptation in WLANs. Proceedings of the IEEE INFOCOM 2017\u2014IEEE Conference on Computer Communications, Atlanta, GA, USA.","DOI":"10.1109\/INFOCOM.2017.8056965"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"197","DOI":"10.1109\/COMST.2018.2871099","article-title":"A tutorial on IEEE 802.11ax high efficiency WLANs","volume":"21","author":"Khorov","year":"2018","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1109\/TNET.2016.2562259","article-title":"Radio Frequency Traffic Classification Over WLAN","volume":"25","author":"Kornycky","year":"2017","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Zhang, J., Li, F., Ye, F., and Wu, H. (2020, January 6\u20139). Autonomous Unknown-Application Filtering and Labeling for DL-based Traffic Classifier Update. Proceedings of the IEEE INFOCOM 2020\u2014IEEE Conference on Computer Communications, Toronto, ON, Canada.","DOI":"10.1109\/INFOCOM41043.2020.9155292"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"338","DOI":"10.1016\/j.procs.2015.04.191","article-title":"Intrusion Detection System (IDS): Anomaly Detection Using Outlier Detection Approach","volume":"48","author":"Jabez","year":"2015","journal-title":"Procedia Comput. Sci."},{"key":"ref_21","unstructured":"Jamshed, M.A., Moon, Y., Kim, D., Han, D., and Park, K. (2017, January 27\u201329). mOS: A Reusable Networking Stack for Flow Monitoring Middleboxes. Proceedings of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17), Boston, MA, USA."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"2648","DOI":"10.1109\/JSAC.2021.3087268","article-title":"Robust Online Learning against Malicious Manipulation and Feedback Delay With Application to Network Flow Classification","volume":"39","author":"Li","year":"2021","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z., and Weiss, W. (2021, October 30). IETF-RFC 2475-An Architecture for Differentiated Services. IETF RFC, Available online: https:\/\/doi.org\/10.17487\/RFC2475.","DOI":"10.17487\/rfc2475"},{"key":"ref_24","unstructured":"(2021, October 30). Wireshark. Available online: https:\/\/www.wireshark.org\/."},{"key":"ref_25","unstructured":"Stuart, A., and Kendall, M.G. (1963). The Advanced Theory of Statistics, Griffin."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"791","DOI":"10.3758\/BF03196706","article-title":"Likelihood ratios: A simple and flexible statistic for empirical psychologists","volume":"11","author":"Glover","year":"2004","journal-title":"Psychon. Bull. Rev."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Tan, K., Song, J., Zhang, Q., and Sridharan, M. (2005). A Compound TCP Approach for High-Speed and Long Distance Networks, Available online: https:\/\/www.microsoft.com\/en-us\/research\/publication\/a-compound-tcp-approach-for-high-speed-and-long-distance-networks\/.","DOI":"10.1109\/INFOCOM.2006.188"},{"key":"ref_28","unstructured":"(2021, October 30). iptime. Available online: http:\/\/iptime.com\/."},{"key":"ref_29","unstructured":"(2021, October 30). tp-link. Available online: https:\/\/www.tp-link.com\/us\/."},{"key":"ref_30","unstructured":"(2021, October 30). Regulation (EU) 2015\/2120 of the European Parliament and of the Council. Available online: http:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=uriserv:OJ.L_.2015.310.01.0001.01.ENG."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/2\/437\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T14:01:36Z","timestamp":1760364096000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/2\/437"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,7]]},"references-count":30,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2022,1]]}},"alternative-id":["s22020437"],"URL":"https:\/\/doi.org\/10.3390\/s22020437","relation":{},"ISSN":["1424-8220"],"issn-type":[{"type":"electronic","value":"1424-8220"}],"subject":[],"published":{"date-parts":[[2022,1,7]]}}}