WiFi Quality & DEAUTH Attack Detection for Trains: CNN-Based Localization Without GPS

GNS recently delivered a WiFi quality and security project for the MTR network that solves three problems at once: it detects DEAUTH (deauthentication) attacks against on-train WiFi at the packet layer, identifies the attacker's IP in real time, and locates the train without GPS using WiFi signal strength and a convolutional neural network (CNN). This article explains the technology behind each part and why the combination matters for railway operators.

The challenge: WiFi on trains is a security blind spot

Passenger and operational WiFi has become a core part of the railway experience. But every wireless network has a weak point that most monitoring tools ignore: the management frames that keep the network running. One of the most common attacks on these frames is the DEAUTH attack.

In the 802.11 protocol, an access point can tell a client to disconnect by sending a deauthentication frame. Attackers exploit this by broadcasting forged deauthentication frames that appear to come from the access point. Devices on the train get kicked off the network, reconnect, and get kicked off again. The result is dropped connections, poor passenger experience, and in the worst case interference with operational systems that depend on stable connectivity.

What makes DEAUTH attacks hard to handle is that they are cheap, portable and almost invisible. An attacker needs only a laptop or a small radio. There is no physical intrusion, no login, and often no trace in application-level logs — the attack happens below the layer that most monitoring software watches.

Why packet-layer analysis

Most WiFi monitoring tools look at traffic at the application level: how many bytes flowed, which servers were contacted, whether the connection dropped. A DEAUTH attack can be invisible to all of that, because the forged frames are management frames, not data traffic.

GNS therefore analyses WiFi at the packet layer — the raw 802.11 management and control frames that carry deauthentication requests. This lets the system:

• distinguish a legitimate disconnect (device moved out of range, network restart) from a forged deauthentication frame;
• detect attack patterns — for example, a burst of deauthentication frames targeting many clients at once, or frames repeating faster than normal network behaviour would allow;
• raise an alert the moment an attack pattern appears, rather than after the damage is done.

Packet-level visibility is the difference between knowing that "WiFi was unstable" and knowing that "a deauthentication attack was broadcast on this train at this time".

Identifying the attacker in real time

For every detected attack, the system extracts the source MAC address from the forged frames and, where the attacker is operating through a routable path, the associated IP address. That gives the operations team an actionable indicator: which device appears to be generating the attack, and from which network segment.

It is worth being precise about the limits: MAC addresses can be spoofed, so the extracted MAC is an indicator to correlate with, not a court-ready identity. What makes the identification genuinely useful is that it happens in real time and can be correlated with other signals — for example, the radio signal strength of the attacking device, which allows the team to narrow down where on the train (or near the trackside) the attacker is physically located. CCTV and patrols can then be pointed at the right carriage instead of the whole train.

Locating the train without GPS

The second half of the project answers a different question: where is this train right now? The obvious answer — GPS — does not work underground. Tunnels block satellite signals completely, and many of the line's most security-sensitive sections are exactly the ones GPS cannot cover.

GNS solves this with WiFi signal fingerprinting. Every location on the line has a distinctive radio environment: the set of access points a receiver can hear, and the relative signal strength (RSSI) of each one. A train's WiFi hardware is constantly sampling this environment. Those samples are fed into a CNN trained on the line's actual radio map, so the model learns the spatial patterns of the signal environment — not just "this AP is strong here", but how the whole fingerprint shifts as the train moves through tunnels, stations and cuts.

The CNN converts the live signal fingerprint into an estimated position on the track. Because the model relies on WiFi fingerprints rather than satellite signals, it keeps working deep underground, where GPS fails. The positioning uses hardware that is already on the train — no new trackside beacons or positioning infrastructure is required.

What operators get

Combined, the two halves give railway operators something they rarely have:

• Security visibility: a real-time view of WiFi attacks — when they happen, on which train, and which source appears to be behind them.
• Resilient positioning: train location that does not disappear in tunnels, useful for security correlation and for other location-dependent operations.
• Faster response: instead of responding to passenger complaints about "bad WiFi", the team can respond to a specific attack event with a specific train number and a narrowed physical location.
• A foundation for AI: the same radio data can be reused for predictive maintenance of on-board WiFi, coverage quality analysis, and continuous improvement of the positioning model.

Limitations and next steps

Packet-layer analysis is powerful but not a silver bullet. Attackers can spoof MAC addresses, so identification should be treated as correlation evidence. The positioning model's accuracy depends on the quality and freshness of the radio map, which should be periodically re-trained as the environment changes (new access points, tunnel refurbishment, seasonal effects). The natural next step is to fuse the WiFi fingerprint with other on-board signals — such as odometry and station dwell patterns — to make positioning even more robust.

Why this matters beyond railways

The same architecture — packet-layer security analysis combined with radio-fingerprint positioning — applies to any environment where connectivity matters and GPS does not work: tunnels, underground car parks, ports, factories and dense urban canyons. For operators, the lesson is simple: the data needed to secure and locate assets is often already being generated by the wireless network itself.

Want to discuss how packet-level analysis and AI can protect your network or locate your assets? Contact GNS.