Wireless multi-step attack mode excavation method for WLAN

Abstract

The invention discloses a wireless multi-step attack mode excavation method for WLAN. The method comprises the following steps of: 1, building a global attack library, consisting of: classifying wireless alarm according to different AP information in a WLAN environment and BSSID information of the AP, and building the global attack library based on the AP according to attributes of occurrence time; 2, building candidate attack links; 3, screening the candidate attack links; 4, correlating a multi-step attack behavior; 5, identifying a multi-step attack mode, consisting of: computing the correlation between adjacent attacks in the attack link, deleting the attack link with the correlation lower than a predetermined correlation threshold, and finally identifying the wireless multi-step attack mode. The wireless multi-step attack mode excavation method for WLAN has the advantages of being applicable to actual attack scenes of WLAN, and capable of effectively excavating the wireless multi-step attack mode and providing bases for the pre-identification of the multi-step attack intention.

Description

technical field [0001] The invention relates to a wireless multi-step attack mode mining method, more specifically, it relates to a WLAN-oriented wireless multi-step attack mode mining method. Background technique [0002] With the rapid development of computer networks, more and more users use WLAN, and the research on network security for WLAN has also received more and more attention. As an important means of network security protection, intrusion detection and defense technology has been relatively maturely applied in the traditional wired network environment, and the identification method for network multi-step attack patterns has also been studied in the wired network. However, the existing multi-step attack identification methods mainly use the data packet information above the network layer as identification features, while the WLAN wireless network contains more data packet features below the network layer. Due to the particularity of wireless networks, it is diffi...

AI Technical Summary

Problems solved by technology

These two methods mainly use the data packet information above the network layer (such as IP address and port number) as identification features, which can identify the multi-step attack intention of the wired network, but attacks against WLAN are often carried out when the IP address is not obtained. Therefore, it is not effective for the WLAN wireless network environment, and cannot accurately identify the wireless multi-step attack mode of the WLAN.

Images