Explainable cross-layer machine learning for enterprise WLAN auditing
2026, vol.18 , no.3, pp. 25-36
Article [2026-03-03]
This paper presents an explainable cross-layer machine learning method for auditing enterprise and campus wireless local area networks. It combines passive radio and Medium Access Control evidence with service, mobility, security and configuration indicators to identify anomalous windows, infer root causes and generate audit scores for operator review. The learning process uses unsupervised anomaly admission and supervised root-cause classification, while the reporting layer produces evidence-supported recommendations. Evaluation is conducted with CrossAudit-WLANSim, a Python-based discrete-time simulator configured for three enterprise sites, twelve access points and 69120 audit windows. Under site drift, the drift-aware configuration reaches an anomaly F1-score of 0.770 and an eight-state macro-F1 of 0.855, outperforming a network-only baseline and reducing false-positive alarms.
wlan audit, explainable machine learning, cross-layer telemetry, concept drift
https://doi.org/10.59035/FYPL5639
Victor Stoynov. Explainable cross-layer machine learning for enterprise WLAN auditing. International Journal on Information Technologies and Security, vol.18 , no.3, 2026, pp. 25-36. https://doi.org/10.59035/FYPL5639