Spatial localization of Wi-Fi threat sources in critical infrastructure via RADIO-SOC event correlation
2026, vol.18 , no.3, pp. 101-110
Article [2026-03-10]
Critical-infrastructure facilities increasingly rely on dense Wi-Fi deployments, which creates exposure to rogue access points, evil-twin impersonation, deauthentication attacks and hidden clients. The paper proposes Correlated Radio-SOC Localisation (CRSL), a framework that fuses distributed RF-sensor observations, wireless-activity features, indicators of compromise and SIEM/SOAR events. The method combines localisation based on multi-sensor measurements with temporal, identity and behavioural correlation of SOC events. The framework produces classified threat findings with an estimated uncertainty region and confidence score. The proposed architecture and evaluation protocol show how radio-event fusion can improve incident attribution and accelerate operational response in protected wireless environments.
wi-fi security, rogue access point, rf localisation, soc correlation, critical infrastructure
https://doi.org/10.59035/MKMU8096
Dmytro I. Prokopovych-Tkachenko, Oleksandr Galushchenko, Yuliia Kovalenko, Mykola Mormul, Volodymyr I. Sarychev, Anton Herasymenko. Spatial localization of Wi-Fi threat sources in critical infrastructure via RADIO-SOC event correlation . International Journal on Information Technologies and Security, vol.18 , no.3, 2026, pp. 101-110. https://doi.org/10.59035/MKMU8096