WiMapper: A Lightweight Kernel-Based Framework for Rogue Access Point Detection on Edge Devices

Public wireless networks have evolved from convenient services into critical urban infrastructure, yet they remain fundamentally susceptible to identity-based exploits. The Evil Twin attack persists as a significant threat because client devices implicitly trust broadcast identifiers before a secure encryption channel is established. Existing defense mechanisms typically rely on either cost-prohibitive Wireless Intrusion Prevention Systems (WIPS), which necessitate centralized wired infrastructure, or computationally intensive Deep Learning models that exceed the resource capabilities of edge sensors. This paper presents WiMapper, a detection framework engineered specifically to resolve the trade-off between inspection frequency and computational cost on Resource-Constrained Edge Devices (RCEDs). The architecture introduces a Cascaded Admission Control mechanism: a deterministicO(1) whitelist (Track A) acts as a low-energy computational shield, filtering high-frequency naive traffic to preserve battery life, thereby permitting the deployment of a computationally richer One-Class Support Vector Machine (Track B) solely for ambiguous threats. By analyzing physics-informed statistical moments specifically Kurtosis and Skewness the model identifies the heavy-tailed impulsive noise artifacts characteristic of packet injection tools. Extensive simulations using the HCXY dataset and subsequent field validation confirm that this hybrid architecture achieves a Pareto-optimal balance between efficiency and accuracy, outperforming monolithic deep learning models on the edge. The framework attained a mean F1-Score of 0.740. Validation on an ESP32 microcontroller demonstrated a viable firmware inference latency of 19.8 ms, while vector-optimized benchmarking on an Edge Gateway (Raspberry Pi 5) yielded 0.16 ms, confirming the model’s scalability with a static memory footprint of 188.5 KB. These metrics confirm that the kernel-based approach significantly outperforms Isolation Forest and Autoencoder baselines, positioning it as a viable solution for dense, low-power security sensor networks.