Each access point radiates signal power that decays with distance under the log-distance path-loss model:
RSSI(d) = TxPower − 10·n·log₁₀(d / d₀)
d₀ = 1 m, n ≈ 2.6 (indoor path-loss exponent)
The phone's radio always associates with whichever AP broadcasting the target SSID has the strongest RSSI — signal strength alone says nothing about identity, which is exactly what an evil-twin attack exploits by out-shouting the legitimate APs with the boost slider above.
The on-device MTD engine then scores the chosen AP against three independent identity checks and sums weighted penalty flags into a 0–100 risk score:
risk = 40·(1 − spoofQuality)·[BSSID ∉ trust list]
+ 45·[cert hash ≠ pinned hash] (only if pinning is ON)
+ 15·[RSSI exceeds best trusted AP here by >12 dB]
- BSSID check — the MAC address of a genuine AP is enrolled in a trust list. A crude clone broadcasts an unrelated address and is caught outright; the spoof quality slider models an attacker who has captured or randomized their radio's MAC to mimic the vendor OUI of a real AP more and more convincingly, which proportionally weakens this one check — it never touches the certificate or RSSI checks.
- Certificate pinning — the strongest signal: even a perfect BSSID clone cannot forge the TLS certificate pinned to the corporate network during the 802.1X/WPA-Enterprise handshake. Switch it off to see why MTD vendors treat pinning as the primary evil-twin defense — without it, a high-quality BSSID clone plus a strong-enough rogue signal alone can slip under the threshold.
- RSSI anomaly — a weak secondary signal: real APs are fixed and calibrated, so a sudden signal far stronger than any known-good AP at this location is itself a soft indicator of a rogue transmitter forcing association.
When the score reaches the auto-block threshold, the MTD engine refuses the association before any traffic flows — the connection you see in the log as BLOCKED. Below threshold, the phone connects; if that AP was in fact the rogue twin, simulated data continues to flow to the attacker for as long as the link stays up. The nearby trusted APs slider redraws the office floor plan with more or fewer legitimate access points, changing how much cover the rogue AP has to blend into normal RF noise.