Unlicensed or deceptive Wi-Fi access points (APs) can expose mobile devices to security threats. And their detection is difficult because normal roaming, AP maintenance, and missing logs produce realted warning signs. This work presents APGuard, which examines Wi-Fi associations using records collected from different parts of an enterprise network. The framework combines mobile association events, AP-controller reports, authorized AP inventory and gateway/DHCP observations. Records are then comapred using device and AP identities within a time window, after which the framework checks whether the evidence agrees, conflicts, or is unavailable. For this, a Random Forest uses these cross-plane indicators along with mobility and radio features. A independent three-state verification rule returns verified, investigate, or insufficient evidence, so an absent record alone is not treated as proof of an attack. On 25 held-out synthetic environments, cross-plane Random Forest achieves 88.92% F1-score and 86.20% recall. A mobility/radio-only Random Forest achieves 57.64% F1-score. A simple corroboration rule has a lower false-positive rate of 0.31%, but also lower recall. Stress tests show that recall falls for stealthier unauthorized APs, while normal outages increase false alerts. Nine synthetic log-replay cases check the software decisions. A final held-out comparison also tests the combined RF and three-state rule. Its recall is 55.76%, below the standalone RF result, because uncertain cases are withheld from attack alerts. These findings show the usefulness and the limits of cross-plane evidence under the evaluated conditions.

rogue access point, wireless association, enterprise Wi-Fi, multi-source corroboration, intrusion detection