Method and equipment for detecting man-in-the-middle attack by user equipment

Abstract

The purpose of the invention is to provide a method for detecting man-in-the-middle attack by user equipment. The method comprises the following steps: transmitting a plurality of corresponding TCP (Transmission Control Protocol) handshake requests to a plurality of random IP (Internet Protocol) addresses; determining TCP handshake success count corresponding to the corresponding TCP handshake requests according to whether the corresponding TCP handshake requests succeed in preset time; and determining whether man-in-the-middle attack does not exist or not in a current network of the user equipment if the TCP handshake success count is less than or equal to a TCP handshake success threshold. According to the method disclosed by the invention, SSLSniff man-in-the-middle attack, SSLStrip man-in-the-middle attack and website distortion man-in-the-middle attack in the man-in-the-middle attack can be actively detected, the coverage area is wide, the man-in-the-middle attack is rapidly recognized, the user waiting time is greatly shortened, and the user side can conveniently take corresponding defensive measures in the shortest time.

Description

technical field [0001] The present application relates to the communication field, and in particular to a technology for detecting man-in-the-middle attacks through user equipment. Background technique [0002] The rapid development of the network has brought convenience to human life, but it has also put forward higher requirements for network security. The network can be said to be a double-edged sword. In terms of network security, MITM (Man-in-the-Middle) attack has long been an ancient attack method commonly used by hackers, and it still has great room for expansion until today. [0003] Man-in-the-Middle Attack ("MITM attack") is an "indirect" intrusion attack. This attack mode is to place a computer controlled by the intruder virtually in the Between two communicating computers in a network connection, this computer is called a "middleman". The "man-in-the-middle" computer will forward frame data packets between two destination hosts communicating with each other, a...

AI Technical Summary

Problems solved by technology

The "man-in-the-middle" computer will forward frame data packets between two destination hosts communicating with each other, and the two destination hosts are unaware of this, which puts user communications in a dangerous network environment