Autonomous embedded system for wireless security auditing using TinyML at the edge: decision tree classifier on ESP32-S3
DOI:
https://doi.org/10.64041/riidg.v5i4.76Keywords:
TinyML, edge AI, IoT, Wi-Fi auditing, LPWAN, LoRaWAN, ESP32-S3, decision tree, cybersecurityAbstract
The expansion of the Internet of Things (IoT) and low-power wide-area networks (LPWAN) broadens the attack surface, while pocket-sized wireless auditing tools (Bruce, Marauder, NEMO) remain manual and reactive. Objective. To assess the feasibility of running an artificial intelligence model at the edge, on a low-cost microcontroller, to autonomously classify the security configuration of wireless networks. Methods. A prototype was built on the M5Stack Cardputer-Adv (ESP32-S3) with an SX1262 LoRa module. A total of 697 records (333 Wi-Fi, 301 BLE, 63 LoRa) were collected in Guayaquil, Ecuador; 17 features were derived; and a decision tree, a random forest, and a small neural network were compared. The selected model was transcribed into native C++ and validated against the Python version. Results. The decision tree (maximum depth 5) achieved an accuracy of 99.0%, precision of 87.5%, recall of 100%, and F1 of 93.3%, with a latency of 0.07 ms and a size of 2.3 KB. The Python–C++ agreement was 100% across 25 cases. The complete firmware used 16.1% of RAM and 27.6% of Flash. Out of 25 real networks, 12 were classified as a threat, but only one corresponded to an open network. Conclusions. The approach is technically feasible on pocket-sized hardware; field validation shows that the "suspiciously strong signal" rule generates false positives, and that real-time evaluation of LoRa/BLE remains future work.
Downloads
References
Abiodun, O. I., Jantan, A., Omolara, A. E., Dada, K. V., Mohamed, N. A. y Arshad, H. (2018). State-of-the-art in artificial neural network applications: A survey. Heliyon, 4(11), e00938. https://doi.org/10.1016/j.heliyon.2018.e00938
Adelantado, F., Vilajosana, X., Tuset-Peiró, P., Martínez, B., Melià-Seguí, J. y Watteyne, T. (2017). Understanding the limits of LoRaWAN. IEEE Communications Magazine, 55(9), 34-40. https://doi.org/10.1109/MCOM.2017.1600613
Al-Fuqaha, A., Guizani, M., Mohammadi, M., Aledhari, M. y Ayyash, M. (2015). Internet of Things: A survey on enabling technologies, protocols, and applications. IEEE Communications Surveys & Tutorials, 17(4), 2347-2376. https://doi.org/10.1109/COMST.2015.2444095
Antonakakis, M., April, T., Bailey, M., et al. (2017). Understanding the Mirai botnet. En Proceedings of the 26th USENIX Security Symposium (pp. 1093-1110). USENIX Association.
Aras, E., Ramachandran, G. S., Lawrence, P. y Hughes, D. (2017). Selective jamming of LoRaWAN using commodity hardware. En Proceedings of the 14th EAI International Conference on Mobile and Ubiquitous Systems (MobiQuitous 2017) (pp. 363-372). ACM. https://doi.org/10.1145/3144457.3144478
Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L. y Rieck, K. (2022). Dos and don'ts of machine learning in computer security. En Proceedings of the 31st USENIX Security Symposium (pp. 3971-3988). USENIX Association.
Atzori, L., Iera, A. y Morabito, G. (2010). The Internet of Things: A survey. Computer Networks, 54(15), 2787-2805. https://doi.org/10.1016/j.comnet.2010.05.010
Augustin, A., Yi, J., Clausen, T. y Townsley, W. M. (2016). A study of LoRa: Long range & low power networks for the Internet of Things. Sensors, 16(9), 1466. https://doi.org/10.3390/s16091466
Banbury, C., Reddi, V. J., Torelli, P., et al. (2021). MLPerf Tiny benchmark. En Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks. https://arxiv.org/abs/2106.07597
Banerjee, A., Venkatasubramanian, K. K., Mukherjee, T. y Gupta, S. K. S. (2012). Ensuring safety, security, and sustainability of mission-critical cyber-physical systems. Proceedings of the IEEE, 100(1), 283-299. https://doi.org/10.1109/JPROC.2011.2165689
Breiman, L. (2001). Random forests. Machine Learning, 45(1), 5-32. https://doi.org/10.1023/A:1010933404324
Breiman, L., Friedman, J. H., Olshen, R. A. y Stone, C. J. (1984). Classification and regression trees. Wadsworth.
Buczak, A. L. y Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153-1176. https://doi.org/10.1109/COMST.2015.2494502
Butun, I., Österberg, P. y Song, H. (2020). Security of the Internet of Things: Vulnerabilities, attacks, and countermeasures. IEEE Communications Surveys & Tutorials, 22(1), 616-644. https://doi.org/10.1109/COMST.2019.2953364
Butun, I., Pereira, N. y Gidlund, M. (2019). Security risk analysis of LoRaWAN and future directions. Future Internet, 11(1), 3. https://doi.org/10.3390/fi11010003
Centenaro, M., Vangelista, L., Zanella, A. y Zorzi, M. (2016). Long-range communications in unlicensed bands: The rising stars in the IoT and smart city scenarios. IEEE Wireless Communications, 23(5), 60-67. https://doi.org/10.1109/MWC.2016.7721743
David, R., Duke, J., Jain, A., Janapa Reddi, V., Jeffries, N., Li, J., Kreeger, N., Nappier, I., Natraj, M., Wang, T., Warden, P. y Rhodes, R. (2021). TensorFlow Lite Micro: Embedded machine learning for TinyML systems. Proceedings of Machine Learning and Systems, 3, 800-811.
Deng, S., Zhao, H., Fang, W., Yin, J., Dustdar, S. y Zomaya, A. Y. (2020). Edge intelligence: The confluence of edge computing and artificial intelligence. IEEE Internet of Things Journal, 7(8), 7457-7469. https://doi.org/10.1109/JIOT.2020.2984887
Diro, A. A. y Chilamkurti, N. (2018). Distributed attack detection scheme using deep learning approach for Internet of Things. Future Generation Computer Systems, 82, 761-768. https://doi.org/10.1016/j.future.2017.08.043
Eldefrawy, M. H., Butun, I., Pereira, N. y Gidlund, M. (2019). Formal security analysis of LoRaWAN. Computer Networks, 148, 328-339. https://doi.org/10.1016/j.comnet.2018.11.017
Facuy, J., Pasini, A., Estévez, E., Moran, C., Illescas, W. y Veloz, V. (2026). A blockchain-enhanced neural network framework for secure e-waste forecasting in smart cities. Frontiers in Public Health, 14, 1779806. https://doi.org/10.3389/fpubh.2026.1779806
Facuy Delgado, J. y Arcos-Jacome, D. (2026). Emergent language among AI agents: A path toward energy efficiency and water conservation. Frontiers in Sustainability, 6, 1717425. https://doi.org/10.3389/frsus.2025.1717425
Facuy Delgado, J. P., Santillán Indacochea, S. D., Soria Vera, R. I. y Toledo Navarrete, A. E. (2025). La mente creativa del diseñador vs el impacto de la inteligencia artificial en el diseño gráfico: nuevas herramientas y métodos creativos. Ethos Scientific Journal, 3(1), 89-102. https://doi.org/10.63380/esj.v3n1.2025.90
Han, S., Mao, H. y Dally, W. J. (2016). Deep compression: Compressing deep neural networks with pruning, trained quantization and Huffman coding. En International Conference on Learning Representations (ICLR 2016). https://arxiv.org/abs/1510.00149
He, H. y Garcia, E. A. (2009). Learning from imbalanced data. IEEE Transactions on Knowledge and Data Engineering, 21(9), 1263-1284. https://doi.org/10.1109/TKDE.2008.239
Jacob, B., Kligys, S., Chen, B., Zhu, M., Tang, M., Howard, A., Adam, H. y Kalenichenko, D. (2018). Quantization and training of neural networks for efficient integer-arithmetic-only inference. En Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 2704-2713). IEEE. https://doi.org/10.1109/CVPR.2018.00286
justcallmekoko. (s. f.). ESP32 Marauder: A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32 [Software]. GitHub. https://github.com/justcallmekoko/ESP32Marauder
Khan, M. A. y Salah, K. (2018). IoT security: Review, blockchain solutions, and open challenges. Future Generation Computer Systems, 82, 395-411. https://doi.org/10.1016/j.future.2017.11.022
Kolias, C., Kambourakis, G., Stavrou, A. y Gritzalis, S. (2016). Intrusion detection in 802.11 networks: Empirical evaluation of threats and a public dataset. IEEE Communications Surveys & Tutorials, 18(1), 184-208. https://doi.org/10.1109/COMST.2015.2402161
Kolias, C., Kambourakis, G., Stavrou, A. y Voas, J. (2017). DDoS in the IoT: Mirai and other botnets. Computer, 50(7), 80-84. https://doi.org/10.1109/MC.2017.201
LoRa Alliance. (2020). LoRaWAN L2 1.0.4 specification (TS001-1.0.4). LoRa Alliance. https://lora-alliance.org
M5Stack Technology Co. (2024). M5Stack Cardputer-Adv: Technical documentation and user guide. https://docs.m5stack.com/en/core/Cardputer-Adv
Meidan, Y., Bohadana, M., Mathov, Y., Mirsky, Y., Shabtai, A., Breitenbacher, D. y Elovici, Y. (2018). N-BaIoT: Network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Computing, 17(3), 12-22. https://doi.org/10.1109/MPRV.2018.03367731
Mirsky, Y., Doitshman, T., Elovici, Y. y Shabtai, A. (2018). Kitsune: An ensemble of autoencoders for online network intrusion detection. En Proceedings of the Network and Distributed System Security Symposium (NDSS 2018). https://doi.org/10.14722/ndss.2018.23204
n0xa. (s. f.). M5Stick-NEMO: Firmware for M5Stick and Cardputer devices [Software]. GitHub. https://github.com/n0xa/m5stick-nemo
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., Vanderplas, J., Passos, A., Cournapeau, D., Brucher, M., Perrot, M. y Duchesnay, É. (2011). Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12, 2825-2830.
Powers, D. M. W. (2011). Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. Journal of Machine Learning Technologies, 2(1), 37-63.
pr3y. (s. f.). Bruce: Versatile ESP32 firmware for red team operations [Software]. GitHub. https://github.com/pr3y/Bruce
Quinlan, J. R. (1986). Induction of decision trees. Machine Learning, 1(1), 81-106. https://doi.org/10.1007/BF00116251
Ray, P. P. (2022). A review on TinyML: State-of-the-art and prospects. Journal of King Saud University - Computer and Information Sciences, 34(4), 1595-1623. https://doi.org/10.1016/j.jksuci.2021.11.019
Raza, U., Kulkarni, P. y Sooriyabandara, M. (2017). Low power wide area networks: An overview. IEEE Communications Surveys & Tutorials, 19(2), 855-873. https://doi.org/10.1109/COMST.2017.2652320
Roman, R., Zhou, J. y Lopez, J. (2013). On the features and challenges of security and privacy in distributed Internet of Things. Computer Networks, 57(10), 2266-2279. https://doi.org/10.1016/j.comnet.2012.12.018
Saito, T. y Rehmsmeier, M. (2015). The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLoS ONE, 10(3), e0118432. https://doi.org/10.1371/journal.pone.0118432
Sarker, I. H., Kayes, A. S. M., Badsha, S., Alqahtani, H., Watters, P. y Ng, A. (2020). Cybersecurity data science: An overview from machine learning perspective. Journal of Big Data, 7, 41. https://doi.org/10.1186/s40537-020-00318-5
Semtech Corporation. (2023). SX1262: Long range, low power, sub-GHz RF transceiver — Datasheet. https://www.semtech.com/products/wireless-rf/lora-connect/sx1262
Shannon, C. E. (1948). A mathematical theory of communication. Bell System Technical Journal, 27(3), 379-423. https://doi.org/10.1002/j.1538-7305.1948.tb01338.x
Shi, W., Cao, J., Zhang, Q., Li, Y. y Xu, L. (2016). Edge computing: Vision and challenges. IEEE Internet of Things Journal, 3(5), 637-646. https://doi.org/10.1109/JIOT.2016.2579198
Shone, N., Ngoc, T. N., Phai, V. D. y Shi, Q. (2018). A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1), 41-50. https://doi.org/10.1109/TETCI.2017.2772792
Sicari, S., Rizzardi, A., Grieco, L. A. y Coen-Porisini, A. (2015). Security, privacy and trust in Internet of Things: The road ahead. Computer Networks, 76, 146-164. https://doi.org/10.1016/j.comnet.2014.11.008
Sommer, R. y Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. En 2010 IEEE Symposium on Security and Privacy (pp. 305-316). IEEE. https://doi.org/10.1109/SP.2010.25
Vailshery, L. S. (2023). Number of Internet of Things (IoT) connected devices worldwide from 2019 to 2030. Statista. https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide/
Vanhoef, M. y Piessens, F. (2017). Key reinstallation attacks: Forcing nonce reuse in WPA2. En Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (pp. 1313-1328). ACM. https://doi.org/10.1145/3133956.3134027
Vanhoef, M. y Ronen, E. (2020). Dragonblood: Analyzing the Dragonfly handshake of WPA3 and EAP-pwd. En 2020 IEEE Symposium on Security and Privacy (pp. 517-533). IEEE. https://doi.org/10.1109/SP40000.2020.00031
Warden, P. y Situnayake, D. (2019). TinyML: Machine learning with TensorFlow Lite on Arduino and ultra-low-power microcontrollers. O'Reilly Media.
Yang, K., Forte, D. y Tehranipoor, M. M. (2017). CDTA: A comprehensive solution for counterfeit detection, traceability, and authentication in the IoT supply chain. ACM Transactions on Design Automation of Electronic Systems, 22(3), Artículo 42. https://doi.org/10.1145/3005346
Yang, X., Karampatzakis, E., Doerr, C. y Kuipers, F. (2018). Security vulnerabilities in LoRaWAN. En 2018 IEEE/ACM Third International Conference on Internet-of-Things Design and Implementation (IoTDI). IEEE. https://doi.org/10.1109/IoTDI.2018.00022
Zhou, Z., Chen, X., Li, E., Zeng, L., Luo, K. y Zhang, J. (2019). Edge intelligence: Paving the last mile of artificial intelligence with edge computing. Proceedings of the IEEE, 107(8), 1738-1762. https://doi.org/10.1109/JPROC.2019.2918951
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Jefferson Wladimir Valdez Coello, Jussen Paúl Facuy Delgado, Frederick Alexander Farfán Jijón
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Los contenidos de esta revista se publican bajo la licencia Creative Commons Atribución–NoComercial–SinDerivadas 4.0 Internacional (CC BY-NC-ND 4.0).
Usted es libre de compartir el material en cualquier medio o formato, siempre que:
-
Reconozca la autoría original.
-
No utilice la obra con fines comerciales.
-
No realice obras derivadas, adaptaciones o modificaciones.
Enlace oficial: https://creativecommons.org/licenses/by-nc-nd/4.0/
