Real-time detection of Wi-Fi attacks using hybrid deep learning models on NodeMCU

Abstract

This paper presents a real-time, lightweight system for detecting Wi-Fi deauthentication (DA) attacks that uses the NodeMCU ESP8266 microcontroller for live packet sniffing and feature extraction. Tailored for low-power IoT environments, the system combines the sequential learning capabilities of Long short-term memory (LSTM), Gate recurrent unit (GRU), and Recurrent neural network (RNN) with the interpretability of logistic regression (LR). These hybrid models analyze Wi-Fi traffic in real time to detect anomalous behavior based on key metrics such as Received Signal Strength indicator (RSSI), DA, packet count, and Signal noise ratio (SNR), which are also displayed live on an OLED screen. The proposed framework uniquely integrates hybrid temporal deep learning with interpretable classification through (LR) in an ultra-low-cost embedded data acquisition setup through NodeMCU, addressing a gap in existing intrusion detection research that often focuses on either cloud-based processing or non-interpretable model. The system was trained and validated on a dataset of over 5,600 labeled samples collected under varied network conditions. Among the evaluated models, GRU_LR achieved the highest accuracy (96%) and demonstrated superior performance in identifying minority-class threats. By combining explainable AI with cost-effective embedded sensing, this work delivers a practical and transparent intrusion detection approach that can be readily adapted to diverse IoT and wireless security contexts.