RSS-based wireless spoofing attack positioning method

Abstract

The invention discloses an RSS-based wireless spoofing attack positioning method. The method comprises steps: a position fingerprint database corresponding to a WLAN (Wireless Local Area Network) environment is built; a beacon is adopted to monitor wireless data packets in the WLAN in real time, and an RSS data flow for each node is further acquired; a K-medoid algorithm is used for selecting multiple K values, and according to a corresponding clustering result after each K value carries out clustering on the RSS data flow for each node sequentially, multiple clustering results for each node can be acquired finally; after the acquired multiple clustering results for each node are evaluated, the optimal clustering result corresponding to each node is acquired; and after a representative object of multiple clusters in the optimal clustering result is acquired sequentially, the position fingerprint database is combined to calculate and acquire the position coordinates of an attacker, and a positioning result is outputted. One or more attackers can be positioned, the positioning accuracy is high, and the method of the invention can be widely applied to the wireless information safety field.

Description

technical field [0001] The invention relates to the field of wireless security research, in particular to an RSS-based wireless deception attack positioning method. Background technique [0002] Glossary: [0003] RSS: received signal strength; [0004] WLAN: WirelessLocalAreaNetworks, wireless local area network; [0005] ISM frequency band: IndustrialScientificMedicalBand, industrial, scientific and medical frequency band; [0006] ACL: access control list; [0007] AP: AccessPoint, access point, also called beacon in the present invention; [0008] RAP: Rogue Access Point; [0009] DoS: denial of service; [0010] MAC: Medium / MediaAccessControl, or MAC address, physical address, used to represent the identifier of each site on the Internet; [0011] SSID: ServiceSetIdentifier, service set identifier, SSID technology can divide a wireless local area network into several sub-networks that require different authentication. Each sub-network requires independent authent...

AI Technical Summary

Problems solved by technology

However, most of the current RSS-based WLAN security detection methods can only locate a single attacker. When multiple attackers use the same identity to cooperate with each other to launch a spoofing attack, none of these methods can determine the physical location of the attacker.

3. RSS is a physical property related to wireless signals. Due to various wireless interference factors, such as synchronous interference, asynchronous interference and physical interference, RSS is easy to generate more noise. The current research method is difficult to deal with the existence of outliers Or the RSS data of large and small clusters, so that the attacker cannot be accurately located

Images